CTF Malware & Network Analysis

Obfuscated Scripts

• Replace eval/bash with echo to print underlying code
• Extract base64/hex blobs and analyze with file
• Common deobfuscation chain: base64 decode → gzip decode → reverse → base64 decode

Debian Package Analysis

ar -x package.deb           # Unpack debian package
tar -xf control.tar.xz      # Check control files
# Look for postinst scripts that execute payloads

Custom Crypto Protocols