Mr. Phisher

I received a suspicious email with a very weird looking attachment. It keeps on asking me to "enable macros". What are those?

Deploy the machine

We see 2 files

Open file .docm and we will see

We choose Tools/Macro/Edit macro

Open macro file in object MrPhisher/Project/Module/

It's VBscript, so we can use http://vb2py.sourceforge.net/online_conversion.html to convert it to python

It will help us in translate code, but to know it, we still need to understand the code

I can translate again to

a var is a string, b var is a list, so after xor a with i in range(a), print b, we have the flag

Flag	Flag
Answer	flag{a39a07a239aacd40c948d852a5c9f8d1}