HTB:CA2023 Forensics Interstellar python decrypt for phase 2

decrypt_phase2.py

import base64
from Crypto.Cipher import AES


### borrowed from https://gist.github.com/lopes/168c9d74b988391e702aac5f4aa69e41
def decrypt(data, key):
    cipher = AES.new(key, AES.MODE_CBC, data[:AES.block_size])
    return cipher.decrypt(data[AES.block_size:])

key = base64.b64decode("DGCzi057IDmHvgTVE2gm60w8quqfpMD+o8qCBGpYItc=")
#iv = [0,1,1,0,0,0,0,1,0,1,1,0,0,1,1,1] #IV not specified, probably the first 16 bytes

### get the encrypted bytes
with open('./destdir/Anni%3fTheda=Merrilee%3fc','rb') as f:
    blob = f.read()
blob = base64.b64decode(blob)
blob = decrypt(blob,bytearray(key))
blob = base64.b64decode(blob.decode().strip('\x00'))

with open('./phase2.dec','wb') as f:
    f.write(blob)