CyberChef VS AutoHotkey

Then we take the encrypted text and use CyberChef to decrypt it.

Let's go to CyberChef and insert our pieces of evidence.

A parameter was changed from '2AMBCgIQBg' to 'CgIIAdgDAQ%3D%3D' which is just the correct base64 encoding they should have been using the entire time.

I don't think this was a hostile action by Google, I think someone just added better input validation for security reasons and it accidently broke the bad requests they were sending.

https://gchq.github.io/CyberChef/#recipe=URL_Decode()From_Ba...

❗This is indeed the flag, but the text is encrypted with Base64. Usually, the presence of padding character "=" indicates that's Base64 type of encoding (but that's only one of the hints). To decrypt it, we can use CyberChef. Copy-paste the text and we either:

It uses a combination of magic bytes (like the `file` command), entropy analysis and character frequency detection to determine whether an output is likely to be of interest to the user.

The file type mechanism is written here[0]. There's a list of all signatures we detect here[1].

[0] https://github.com/gchq/CyberChef/blob/master/src/core/lib/F...

I think this can be deciphered using CyberChef...

DownloadAHK() { global wb wb.Stop() file := A_Temp "\ahk-install.exe" switchPage("downloading") Sleep 10 if !Download("https://autohotkey.com/download/ahk-install.exe", file, "DownloadAHK_Progress") { MsgBox 0x2010,, Download failed. switchPage("start") return } Run "%file%" /exec waitclose %A_ScriptHwnd% /exec downloaded "%file%" ExitApp } Exec_WaitClose(hwnd) { DetectHiddenWindows On WinWaitClose ahk_id %hwnd% } Exec_Downloaded(file) { ; global SilentMode := true DetermineVersion() QuickInstall()

All you have to do (other than have autohotkey installed) is

But, if you just install AutoHotKey, you can run these two scripts to select a first and a second dictionary: Select Dictionaries Zipfile

You could try (and I have no affiliation with) http://autohotkey.com - then allocate the key to something like ctrl-F13 (often unused - but reachable via sending system keystroke).

Honestly, it's a bit silly of autohotkey.com to have such strict protections, especially on its downloads. You may be able to workaround by using the github releases instead which are far less restrictive.

try out autohotkey.com

autohotkey.com Go to the ahk website, click download, then choose 'Download v1.1 (deprecated)'