SCSC2026 Final - reporting - Forensics Writeup

Flag: scsc26{m4lici0us_m4cr0_1n_r3p0rt_f1l3}

Description: this file is dangerous.

The file was a gzip archive, and its stored filename was Reporting.odt. That matched the challenge warning: an OpenDocument file can carry LibreOffice Basic macros.

1
file '/home/LIGHT/Downloads/SCSC2026Final/malic1ous-odt.gz'

1
/home/LIGHT/Downloads/SCSC2026Final/malic1ous-odt.gz: gzip compressed data, was "Reporting.odt", last modified: Fri May 15 14:08:13 2026, from Unix, original size modulo 2^32 62004

1
exiftool -G -s -a '/home/LIGHT/Downloads/SCSC2026Final/malic1ous-odt.gz'

1
[File]          FileType                        : GZIP
2
[File]          MIMEType                        : application/x-gzip
3
[ZIP]           ArchivedFileName                : Reporting.odt

After decompressing it, file identified the result as OpenDocument Text. Listing the ODT container showed a Basic macro module at Basic/Standard/scsc.xml.

1
gzip -dc '/home/LIGHT/Downloads/SCSC2026Final/malic1ous-odt.gz' > '/home/LIGHT/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/Reporting.odt'

1
file '/home/LIGHT/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/Reporting.odt'

1
/home/LIGHT/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/Reporting.odt: OpenDocument Text

1
unzip -l '/home/LIGHT/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/Reporting.odt'

1
Archive:  /home/LIGHT/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/Reporting.odt
2
  Length      Date    Time    Name
3
---------  ---------- -----   ----
4
       39  05-15-2026 14:05   mimetype
5
    15743  05-15-2026 14:05   settings.xml
6
      535  05-15-2026 14:05   Basic/Standard/scsc.xml
7
      345  05-15-2026 14:05   Basic/Standard/script-lb.xml
8
      338  05-15-2026 14:05   Basic/script-lc.xml
9
        0  05-15-2026 14:05   Configurations2/
10
    15047  05-15-2026 14:05   styles.xml
11
      899  05-15-2026 14:05   manifest.rdf
12
     7852  05-15-2026 14:05   content.xml
13
      982  05-15-2026 14:05   meta.xml
14
    50927  05-15-2026 14:05   Thumbnails/thumbnail.png
15
     1362  05-15-2026 14:05   META-INF/manifest.xml
16
---------                     -------
17
    94069                     12 files

Extracting the ODT exposed Basic/Standard/scsc.xml. The AutoOpen macro launched calc.exe, then assigned the flag in a commented StarBasic line.

1
unzip -o '/home/LIGHT/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/Reporting.odt' -d '/home/LIGHT/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/odt'

1
inflating: /home/LIGHT/Downloads/SCSC2026Final/CTFChan_Forensics_SCSC2026Final_reporting/odt/Basic/Standard/scsc.xml

1
<?xml version="1.0" encoding="UTF-8"?>
2
<!DOCTYPE script:module PUBLIC "-//OpenOffice.org//DTD OfficeDocument 1.0//EN" "module.dtd">
3
<script:module xmlns:script="http://openoffice.org/2000/script" script:name="scsc" script:language="StarBasic" script:moduleType="normal">REM  *****  SRIWIJAYA SECURITY SOCIETY  *****
4

5
Sub AutoOpen()
6
    Shell &quot;C:\Windows\System32\calc.exe&quot;, 1
7
    Dim strCommand As String
8
    &apos;strCommand = &quot;scsc26{m4lici0us_m4cr0_1n_r3p0rt_f1l3}&quot;
9
    MsgBox strCommand
10
End Sub
11
</script:module>