Zip Known Plaintext

Category: FORENSICS · Difficulty: Basic · Points: 150 · Challenge: 482

Background

An encrypted archive discovered on an adversarial staging server protects exfiltrated audit records. One member file is known to be identical to an unmodified open-source operational license. Exploit the stream cipher implementation to recover the archive passkey. FORMAT: FLAG{ }

Analysis

The evidence file is 590 bytes and carries a generator marker followed by a single configuration line. Reading printable runs across the file recovers the value directly:

$ strings -n 8 evidence-040.raw
[FORENSIC_TRIAGE_TARGET_040]
CONFIDENTIAL_FLAG=FLAG{cwa2026_afd1e144face137b}

The file holds no filesystem image, no archive structure and no encoded payload beyond the plaintext line above. No ZIP local file header or central directory is present and no known-plaintext pair exists, so the stream cipher analysis described in the brief was not required.

Result

FLAG{cwa2026_afd1e144face137b}