Recovery

Catégorie: Blockchain Difficulté: easy Flag: HTB{n0t_y0ur_k3ys_n0t_y0ur_c01n5}

Challenge

Description

---

We are The Profits. During a hacking battle our infrastructure was compromised as were the private keys to our Bitcoin wallet that we kept. We managed to track the hacker and were able to get some SSH credentials into one of his personal cloud instances, can you try to recover my Bitcoins?

Username: satoshi

Password: L4mb0Pr0j3ct

NOTE: Network is regtest, check connection info in the handler first.

Ce challenge tourne sur un docker, disponible sur Github

Résolution

Il faut se connecter en SSH sur la machine, un service electrum tourne sur le port 50002 et une seed de portefeuille est dans les fichiers lisibles.

On va donc relancer la connexion ssh en bindant le port local 50002 au port 50002 de la machine distante avec l’option -L 50002:localhost:50002

$ ssh satoshi@94.237.56.188 -p 41788 -L 50002:localhost:50002
satoshi@94.237.56.188's password:
Linux ng-team-103851-blockchainrecoveryca2024-e4mkz-fb7df67cd-gjqsg 5.10.0-18-amd64 #1 SMP Debian 5.10.140-1 (2022-09-02) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sat Mar 16 17:17:36 2024 from 10.30.12.117
satoshi@ng-team-103851-blockchainrecoveryca2024-e4mkz-fb7df67cd-gjqsg ➜  ~ cat wallet/electrum-wallet-seed.txt
game keep fiscal awkward episode visual exile sea load junior garden try

Ensuite on lance electrum en local en lui précisant que le serveur de test est en local sur le port 50002. Il se connectera alors à travers le tunnel créé avec ssh à la machine distante.

On utilise ensuite la seed que l’on a trouvé pour récupérer le wallet perdu

On voit qu’il y a 1000 mBTC dans le wallet, on les envoie tout simplement à l’adresse demandée dans la description du challenge

Enfin on se connecte au serveur raw pour récupérer le flag

ncat 94.237.56.188 52779
Hello fella, help us recover our bitcoins before it's too late.
Return our Bitcoins to the following address: bcrt1q5mne549hedkmrnypjd66yynvedet5dek4dt8rl
CONNECTION INFO:
  - Network: regtest
  - Electrum server to connect to blockchain: 0.0.0.0:50002:t

NOTE: These options might be useful while connecting to the wallet, e.g --regtest --oneserver -s 0.0.0.0:50002:t
Hacker wallet must have 0 balance to earn your flag. We want back them all.

Options:
1) Get flag
2) Quit
Enter your choice: 1
HTB{n0t_y0ur_k3ys_n0t_y0ur_c01n5}