Rating:


Buzz buzz, can you find the honey?
file: veebee.vbe

VBE is encrypted VBS. Using https://master.ayra.ch/vbs/vbs.aspx or https://github.com/DidierStevens/DidierStevensSuite/blob/master/decode-vbe.py we can decrypt it.

From the first link we see:

The content should start with #@~^XXXXXX== and end with ==^#~@ plus a "null" char, which is not visible in most editors.

Looking at the file, we have two scripts and some garbage at the start. Splitting the two scripts into different files and running through the decode produces the flag in the second vbe script.

Flag: flag{f805593d933f5433f2a04f082f400d8c}

Original writeup (https://thomaspreece.com/2021/03/15/nathamcon-ctf-2021/#1-veebee).