A base64 blob in setup.py

Unpack a suspicious Python sdist, find the encoded string its setup.py executes, decode it with base64 -d, and name the host and environment variables it steals.

Terminal mission
Advanced
3 objectives
0 of 3 solved

Briefing

A developer ran pip install python-dateutils (with an s) on a build box. The real package is python-dateutil. The downloaded sdist was saved for analysis and unpacked into quarantine/.

Malicious packages often hide their payload as a base64 string passed to exec(). base64 -d turns it back into readable code without running it.

analyst@malware-lab

malware-lab · Supply chain

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@malware-lab:~/quarantine/python-dateutils-2.9.1$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.