Category: Forensics

Flag: scsc26{m4lici0us_m4cr0_1n_r3p0rt_f1l3}

Description: this file is dangerous.

The file was a gzip archive, and its stored filename was Reporting.odt. That matched the challenge warning: an OpenDocument file can carry LibreOffice Basic macros.

file '/home/rei/Downloads/SCSC2026Final/malic1ous-odt.gz'

/home/rei/Downloads/SCSC2026Final/malic1ous-odt.gz: gzip compressed data, was "Reporting.odt", last modified: Fri May 15 14:08:13 2026, from Unix, original size modulo 2^32 62004

exiftool -G -s -a '/home/rei/Downloads/SCSC2026Final/malic1ous-odt.gz'

[File]          FileType                        : GZIP
[File]          MIMEType                        : application/x-gzip
[ZIP]           ArchivedFileName                : Reporting.odt

After decompressing it, file identified the result as OpenDocument Text. Listing the ODT container showed a Basic macro module at Basic/Standard/scsc.xml.

gzip -dc '/home/rei/Downloads/SCSC2026Final/malic1ous-odt.gz' > '/home/rei/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/Reporting.odt'

file '/home/rei/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/Reporting.odt'

/home/rei/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/Reporting.odt: OpenDocument Text

unzip -l '/home/rei/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/Reporting.odt'

Archive:  /home/rei/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/Reporting.odt
  Length      Date    Time    Name
---------  ---------- -----   ----
       39  05-15-2026 14:05   mimetype
    15743  05-15-2026 14:05   settings.xml
      535  05-15-2026 14:05   Basic/Standard/scsc.xml
      345  05-15-2026 14:05   Basic/Standard/script-lb.xml
      338  05-15-2026 14:05   Basic/script-lc.xml
        0  05-15-2026 14:05   Configurations2/
    15047  05-15-2026 14:05   styles.xml
      899  05-15-2026 14:05   manifest.rdf
     7852  05-15-2026 14:05   content.xml
      982  05-15-2026 14:05   meta.xml
    50927  05-15-2026 14:05   Thumbnails/thumbnail.png
     1362  05-15-2026 14:05   META-INF/manifest.xml
---------                     -------
    94069                     12 files

Extracting the ODT exposed Basic/Standard/scsc.xml. The AutoOpen macro launched calc.exe, then assigned the flag in a commented StarBasic line.

unzip -o '/home/rei/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/Reporting.odt' -d '/home/rei/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/odt'

inflating: /home/rei/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/odt/Basic/Standard/scsc.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE script:module PUBLIC "-//OpenOffice.org//DTD OfficeDocument 1.0//EN" "module.dtd">
<script:module xmlns:script="http://openoffice.org/2000/script" script:name="scsc" script:language="StarBasic" script:moduleType="normal">REM  *****  SRIWIJAYA SECURITY SOCIETY  *****

Sub AutoOpen()
    Shell &quot;C:\Windows\System32\calc.exe&quot;, 1
    Dim strCommand As String
    &apos;strCommand = &quot;scsc26{m4lici0us_m4cr0_1n_r3p0rt_f1l3}&quot;
    MsgBox strCommand
End Sub
</script:module>