Maze

Technical Walkthrough

Writeup

Challenge

• Name: Maze
• Category: Reversing
• Difficulty: Medium
• Mode: file

Summary

maze.exe is a Windows PyInstaller bundle that hides a multi-stage reversing

chain. The visible executable asks for a route, decrypts an AES ZIP, repairs a

second-stage Linux ELF using a PRNG key derived from maze.png, and the ELF

then validates the final HTB-format answer through sliding 3-byte sums.

The solve path was:

1. Extract the PyInstaller CArchive.
2. Disassemble the main Python 3.8 bytecode.
3. Decode the nested obf_path module to recover the PNG-derived PRNG seed.
4. Decrypt and repair the second-stage ELF.
5. Parse the ELF’s sum table and solve the linear constraints.

Artifact Inventory

• files/a12c733f-ef44-47e3-941d-19d83b135774.zip: original challenge archive.
• files/extracted/rev_maze/maze.exe: Windows x64 PyInstaller bundle.
• files/extracted/rev_maze/maze.png: image used by the obfuscated helper to

derive a PRNG seed.

• files/extracted/rev_maze/enc_maze.zip: AES-encrypted ZIP containing the

second-stage file maze.

• analysis/source-audit.md: local audit of the PyInstaller bundle, nested

module, seed derivation, ELF repair, and table solve.

Analysis

The PyInstaller cookie and table of contents were parsed from maze.exe. The

main script entry is named maze, and the embedded PYZ contains a module named

obf_path.

The main Python 3.8 bytecode was disassembled in Docker. It accepts only one

route string, calls obf_path.obfuscate_route(), decrypts enc_maze.zip, then

modifies every tenth byte of the extracted maze file.

The imported obf_path module contains nested marshal, LZMA, and zlib layers.

Decoding those layers without executing them shows that it reads four bytes

from maze.png at offsets 4817, 2624, 2640, and 2720; their sum is the

PRNG seed 493. The module also prints a clue to generate 300 random integers

with randint(32, 125).

Using that random stream as the XOR key after the main script’s +80 mod 256

step repairs the encrypted ZIP’s extracted maze file into a valid Linux

x86-64 ELF. The repaired ELF then checks the final answer:

• It requires the input to begin with HTB.
• It has a 36-dword table at .rodata offset 0x2060.
• Each table entry is the sum of a 3-character sliding window.
• A 36-entry table means the final answer is 38 bytes.

With the fixed HTB prefix, each next character is determined by:

next = table[i] - previous - current

RAG returned only generic reversing guidance, so it was recorded as advisory.

All decisive evidence comes from the current local artifacts.

Solve

The reproducible solver is [solve.py](<local workspace>).

It performs the complete chain:

1. Reads maze.png and derives seed 493.
2. Uses 7z with the recovered AES ZIP password to extract the second-stage

maze.

1. Repairs every tenth byte using the seed-derived random key.
2. Reads the dword table from the repaired ELF.
3. Solves the sliding-sum equations.
4. Writes the generated HTB-format candidate to the requested output path.

The repaired ELF was then validated with the generated candidate. The redacted

success transcript is stored at

analysis/decoded-elf-validation-redacted.txt.

Harness capture used:

python3 scripts/challenge_exec.py Reversing/Maze -- \
  python3 Reversing/Maze/solve/solve.py \
  --workspace Reversing/Maze \
  --output Reversing/Maze/analysis/flag-candidate.txt \
  --decoded-elf analysis/decoded/solved_dec_maze \
  --transcript analysis/solve-transcript.txt

python3 scripts/challenge_harness.py capture-flag Reversing/Maze \
  --from analysis/flag-candidate.txt

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• PyInstaller bundles can be solved cleanly by parsing the CArchive and PYZ

structures instead of treating the PE as native code.

• Obfuscated helper modules may carry dynamic repair clues; nested marshal and

compressed payloads should be decoded but not blindly executed.

• A sliding-sum table becomes a deterministic linear solve when the prefix is

known.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Maze
• Category: Reversing
• Difficulty: Medium
• Mode: file
• Remote instance: none
• Start time: 2026-06-12T15:55:46Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

-

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Reversing
• Challenge: Maze
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches