Overview
Given a Linux ELF binary named greetings. Running file checks shows signs of PyInstaller wrapping.
Reconnaissance
PyInstaller embeds a PKG archive at the tail end of the binary, identified by the MEI\\x0c\\x0b\\x0a\\x0b\\x0e magic bytes.
Exploitation Strategy
The main script code lies in the PKG data table as a compressed zlib stream, separate from the PYZ modules archive. We write a script to locate and extract zlib streams from the binary.
Solution Code
import zlib
import re
with open("greetings", "rb") as f:
data = f.read()
# Search for compressed streams
for pos in range(64000, 200000):
try:
dc = zlib.decompress(data[pos:])
if b'Kaal{' in dc:
strings = re.findall(b'[\x20-\x7e]{5,}', dc)
for s in strings:
print(s.decode())
except:
continueFlag
Kaal{Py$nstaLLer_1s_N0t_Encrypt10n}