Ctf Malware
Malware/C2/PE reversing cheat-sheet for CTFs; the stream-cipher keystream trick actually paid off
Test report
- Verdict
- Tested · Works
- Score
- Tested
- Jul 20, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · fb0150c
I fetched the GitHub tree and raw SKILL.md + all 3 supporting files (scripts-and-obfuscation 449 lines, c2-and-protocols 274, pe-and-dotnet 108) — every relative link resolves and the content is real CTF material (named case studies: Poison Ivy, DarkComet, Cobalt Strike, LimeRAT). Trigger phrasings tested — ACTIVATE: "deobfuscate this malicious PowerShell C2 stager", "PCAP with RC4-encrypted WebSocket C2 traffic, help decrypt", "extract config and C2 domain from this .NET RAT"; NOT: "write a keygen for this crackme, no malware behavior" (skill itself says pivot to ctf-reverse), "recover deleted files from this disk image" (forensics) — 5/5 correct. Output: baseline said reverse the binary to recover key+nonce and reimplement the cipher; the skill's "stream ciphers = keystream XOR plaintext, send all-nullbytes so 0 XOR k = k recovers the raw keystream, then XOR against captured ciphertext — no key recovery needed; concatenate all payloads chronologically if both directions share keystream" is a materially faster, concretely correct solution path (win, ~8). Security: grep clean, no curl|sh / base64 payloads / referral exfil.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 8/10
- Docs & honesty 5/5
What Ctf Malware does
A reference skill for malware-analysis CTF challenges: obfuscated script deobfuscation, C2/PCAP protocol reversing, custom-crypto decryption, PE/.NET config extraction, YARA, shellcode, and memory forensics. Triggers on malware/C2/traffic-analysis CTF tasks, and correctly pivots away to sibling reverse/forensics skills for non-malware work.
How to install Ctf Malware
Copy the `ctf-malware/` directory (SKILL.md + the 3 supporting .md files) into your agent's skills directory (e.g. `~/.claude/skills/ctf-malware/`). No build step. To actually run the referenced techniques you separately `pip install yara-python pefile capstone oletools unicorn pycryptodome volatility3` and install tshark/binwalk/ghidra via apt/brew.
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger Ctf Malware
-
/ctf-malwareMalware/C2/PE reversing cheat-sheet for CTFs; the stream-cipher keystream trick actually paid off
It also activates on plain-language prompts like these:
-
Decode this obfuscated JavaScript malware sample for me -
Analyze this PE binary for anti-analysis tricks -
Extract the C2 configuration from this sample
Frequently asked questions
- Is the Ctf Malware skill free?
- Yes. The skill itself is free from ljagiello/ctf-skills. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Ctf Malware work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 20, 2026. Verdict: Tested · Works. I fetched the GitHub tree and raw SKILL.md + all 3 supporting files (scripts-and-obfuscation 449 lines, c2-and-protocols 274, pe-and-dotnet 108) — every relative link resolves and the content is real CTF material (named case studies: Poison Ivy, DarkComet, Cobalt Strike, LimeRAT). Trigger phrasings tested — ACTIVATE: "deobfuscate this malicious PowerShell C2 stager", "PCAP with RC4-encrypted WebSocket C2 traffic, help decrypt", "extract config and C2 domain from this .NET RAT"; NOT: "write a keygen for this crackme, no malware behavior" (skill itself says pivot to ctf-reverse), "recover deleted files from this disk image" (forensics) — 5/5 correct. Output: baseline said reverse the binary to recover key+nonce and reimplement the cipher; the skill's "stream ciphers = keystream XOR plaintext, send all-nullbytes so 0 XOR k = k recovers the raw keystream, then XOR against captured ciphertext — no key recovery needed; concatenate all payloads chronologically if both directions share keystream" is a materially faster, concretely correct solution path (win, ~8). Security: grep clean, no curl|sh / base64 payloads / referral exfil.
- What is the Ctf Malware SkillProof Score?
- 9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 5/5.
- How do I install Ctf Malware?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Ctf Malware with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.