IR #1 Challenge One

images/2-1.png

After downloading, we are left with a password protected zip file. This was unzipped using 7z and the provided password.

7z e <filename.zip>

3766572f638355c5028b60ca641b6f0d

images/2-2.png

The resulting file is easily imported into VirtualBox. I had heard some people were having trouble working with it in VMware, so switch to Vbox if needed.

The VM was initially set up with 4G of ram and 1 processor, which seemed sluggish, so I upped it to 2 processors which seemed to help.

Notice the ‘Description’ section of the VM details where the author left the login credentials.

images/2-3.png

*** First thing's first: Follow the instructions on the Background and make a snapshot. I jacked up my files when I started decrypting them. Thankfully I followed the warning. ***

On login, there are multiple encrypted files on the Desktop. The prompt for this section is to find the hidden file. First I looked for a file without an icon on the desktop, but no luck.

Next, I opened File Explorer to turn on Hidden Items and have a look around. Also note in the Recent files ‘updates.ps1’ seems sketch, because it is, but we'll get to that later.

images/2-4.png

Looking through the Documents there is a hidden folder named ‘hidden' > ‘directory’ > ‘Ransom note.txt’

This is the first flag:

images/2-5.png

IR #2 Challenge Two

images/3-1.png

Looking through Downloads, there is the updates.ps1 script which is a long string of what looks like obfuscated instructions, but no clue on how it got there.

Thinking about how malicious things get on a computer, Carl always clicks the links, so I opened Outlook Mail, and there is the phishing email and the second flag:

images/3-2.png

IR #3 Challenge Three

images/4-1.png

Looking at the updates.ps1 script, no, no I cannot reverse the malware. I suck at this right now. I just tried re-running it, and it choked.

images/4-2.png

I tried checking the PS history, but that has been wiped. I needed sleep so I went to bed.

images/4-3.png

I recently went to bsides in Ft. Wayne, IN

https://bsidesfortwayne.org/

and Carrie Roberts gave a talk called “10 Hacks to Bypass Powershell History Log”

She went over how even though an attacker may try to cover their tracks by deleting the history, there are multiple places where things get logged.

I decided to check Event Viewer. Clicking through the events, I find what looks like our obfuscated PS code:

images/4-4.png

There were 6 message blocks of obfuscated text, and after that there was a clear text version of the PS script that ran. I copied this as clear text at opened it in notepad.

This displayed the flag, as well as the encryption key for the encrypted files:

images/4-5.png

Thanks Carrie Roberts!

linkedin.com/in/carrie-roberts-oroneequalsone-on-twitter-94047735

images/4-6.png images/4-7.png

IR #4 Challenge Four

images/5-1.png

At the bottom of the PS script, there is an ‘Invoke-Webrequest -Method Post ’ This should be the exfiltration site.

images/5-2.png

This needs to to be MD5 hashed. I was rushed for time before work and couldn't get the hash to come out right, so I messaged the team and asked for help.

images/5-3.png

I was forgetting that echo automatically appends a \n character upon completion unless you add the -n flag. This was adding the newline before getting hashed.

Thanks @Pho3nix!

IR #5 Challenge Five

images/6-1.png

We were down to the last couple hours of the CTF, so I got lazy and asked chatGPT how to decrypt what was encrypted with the updates.ps1 script.

function decryptFiles {
    Param(
        [Parameter(Mandatory=$true, Position=0)]
        [string]$encryptedFilePath
    )

    $destinationFilePath = $encryptedFilePath -replace '\.enc$', ''

    $cipher = [System.Security.Cryptography.SymmetricAlgorithm]::Create("AES")
    $cipher.Key = [System.Text.Encoding]::UTF8.GetBytes("7h3_k3y_70_unl0ck_4ll_7h3_f1l35!")
    $cipher.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7

    $encryptedData = [System.IO.File]::ReadAllBytes($encryptedFilePath)

    $ivLength = [System.BitConverter]::ToInt32($encryptedData, 0)
    $iv = New-Object byte[] $ivLength
    [Array]::Copy($encryptedData, 4, $iv, 0, $ivLength)

    $decryptor = $cipher.CreateDecryptor($cipher.Key, $iv)

    $encryptedDataStream = New-Object System.IO.MemoryStream($encryptedData, ($ivLength + 4), ($encryptedData.Length - $ivLength - 4))
    $decryptedDataStream = New-Object System.IO.MemoryStream

    $decryptorStream = New-Object System.Security.Cryptography.CryptoStream($encryptedDataStream, $decryptor, [System.Security.Cryptography.CryptoStreamMode]::Read)

    $decryptorStream.CopyTo($decryptedDataStream)
    $decryptorStream.FlushFinalBlock()

    [System.IO.File]::WriteAllBytes($destinationFilePath, $decryptedDataStream.ToArray())

    $decryptedDataStream.Dispose()
    $decryptorStream.Dispose()
    $encryptedDataStream.Dispose()

    Remove-Item -LiteralPath $encryptedFilePath
}

# Example usage: Decrypt an encrypted file
$encryptedFilePath = "C:\Users\IEUser\Desktop\notes.txt.enc"
decryptFiles -encryptedFilePath $encryptedFilePath

The last three lines of the script denoted which file would be decrypted. I changed the $encryptedFilePath = “ ” to the file I wanted to decrypt, saved, and ran the script in powershell.

This would decrypt individual files. I decrypted one file at at time on the desktop and then looked through them. The file path MUST BE CHANGED after the first running of the script.

If you do not change the filepath, the same file is essentially reencrypted by the decryption function and the file is unreadable.

images/6-2.png

When looking over the NexGenInnovations.pdf, I saw something that looked like a footer.

images/6-3.png

It looked irregular, so let's zoom in. A bunch . . .

images/6-4.png

Well, I did laugh, jerks. Better than a rick roll. Checking the next footer, and zoom in some more:

images/6-5.png

Nahamcon 2023

IR #1 Challenge One

IR #2 Challenge Two

IR #3 Challenge Three

IR #4 Challenge Four

IR #5 Challenge Five

Closing Thoughts