Challenge

We receive a Windows PE binary. Running file on it shows it is a compiled AutoHotkey (AHK) script.

Approach

  1. Use ExeInfo PE / Detect-It-Easy to confirm the binary is an AutoHotkey compiled executable.
  2. Use AutoHotkey Decompiler or extract the embedded script with Resource Hacker.
  3. The embedded AHK source contains a simple password comparison:
1
2
3

password := "AHK_1s_lIs+eni4g"
If (InputVar = password)
    MsgBox, boroCTF{AHK_1s_lIs+eni4g}
  1. The flag is the password itself wrapped in the boroCTF format.

Flag

boroCTF{AHK_1s_lIs+eni4g}