3 ms·
"Run-only" AppleScript is compiled to a bytecode format that is very poorly documented. In 2017, I released a CTF reverse-engineering challenge called Scriptabb
by nneonneo 6y ago
"Run-only" AppleScript is compiled to a bytecode format that is very poorly documented. In 2017, I released a CTF reverse-engineering challenge called Scriptabble, in which contestants had to understand a compiled AppleScript file which very slowly computed a flag, then fix or reimplement the algorithm to compute it faster.
Teams generally solved it by reverse engineering the AppleScript runtime to understand the VM bytecode; one writeup is here: https://twitter.com/_niklasb/status/856594863294472193 https://twitter.com/_niklasb/status/856594863294472193
So, I guess I can't be too surprised that run-only AppleScript ended up as a good malware vector - it's so poorly documented, and there are so few tools to understand it, that it could easily fly under the radar.
- chairmanwow1 6y agoI have to compliment you on the design of this challenge. That sounds really hard (but also really fun). How'd it go?
- nneonneo 6y agoIt was harder than expected! One of the big difficulties with releasing macOS challenges is that not everyone or every team has access to macOS (unlike, say, Linux which is freely available). In principle, contestants could have reversed it by piecing together scattered bits of documentation from the web; in practice, it's a lot easier to debug and reverse with the actual runtime in hand. I was sincerely impressed that several teams were able to solve it by reversing the AppleScript VM. For future competitions featuring macOS problems, we'll probably rent a cloud Mac for the duration of the contest (24-48h) and give contestants gated access to it, to remove that particular handicap.