Lion Cipher Lab
Extract a C2 beacon configuration from a payload and turn it into IOCs — recover the XOR key with no key, parse the TLV, emit indicators
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
A file hash changes for free every time an operator rebuilds. The C2 host, the URI, the user-agent and the campaign-level traffic key do not — they are reused across a whole family because standing up new infrastructure is expensive. Those indicators are baked into the payload as an obfuscated config, and the analyst who can pull them out turns one unknown blob into a block-list, a hunt query, and a cluster of related samples. Config extraction is daily bread for a malware-focused CTI analyst and the whole reason automated parser frameworks exist. The single-byte-XOR-plus-TLV case you…
What you'll learn
- the shape almost every commodity beacon shares: C2 host/IP, port, URI, user-agent, sleep/jitter, kill-date and a traffic key packed as a length-prefixed Type-Length-Value (TLV) blob behind trivial obfuscation
- recovering a single-byte XOR key WITH NO KEY and NO disassembly, by searching all 256 values for the one that reproduces a known magic/sentinel
- why a printable-ratio score alone is NOT enough — measuring, on your own artifact, that the real key ranks only 42nd of 256 on printability and that a short sentinel leaves false candidates
- parsing a TLV record stream safely: Type/Length/Value walking, fixed-width integers with struct.unpack, length-bounded reads, and a terminator
- emitting the result as usable intelligence: a STIX-ish indicator bundle and a flat IOC CSV, keyed to a kill-date
- the honest ceiling: single-byte XOR is the EASY case — real families use RC4/AES, per-sample keys, nested configs and per-field encodings, and where to go then
- doing all of this safely on a synthetic, plainly-benign artifact you build yourself, with documentation-range indicators that can never point at a live host
Steps in this lab
- The idea in plain language: a beacon carries its orders as an obfuscated TLV blob
- Safety and scope: you build the only thing you analyse
- Set up: confirm Python and make a scratch folder
- Define the TLV format and build the synthetic payload (make_beacon.py)
- The analyst's problem: no key, no source, just bytes
- Write the extractor and run the 256-key search (extract_config.py)
- Read Phase A: why 'most printable' is a trap
- Read Phase B: the sentinel picks the one true key
- The honest negative: a short sentinel lets false keys survive
- Parse the TLV and emit the IOCs
- Try the same recovery by hand in CyberChef (optional)
- Honest limits — single-byte XOR is the easy case