\n\nThis page has been machine-translated from the original page.
\n
I participated in corCTF 2024, which started on July 27, 2024.
\nThis time the Rev challenges were far too difficult for me, and I did not feel like I could solve any of them, so I retired early after solving only two Forensics problems.
\nI wrote brief writeups only for the challenges I solved, so I am collecting them here.
\n\n\n\nOur intelligence team created a chat app, and secretly distributed it to the lemonthinker gang. We’ve given you the application source and a capture taken by one of our agents - can you uncover their plans?
\n
Analyzing the pcap file provided with the challenge shows that meaningless-looking payloads were being sent and received as shown below.
\nAfter checking the script that was also provided with the challenge, I confirmed that the keys and messages encrypted by the encrypt function seemed to be exchanged as TCP packets.
import random\nfrom scapy.all import *\nimport csv\n\nsources, destinations, messages = [], [], []\n\nwith open('chatlogs.csv', mode='r') as file:\n csv_reader = csv.reader(file)\n for row in csv_reader:\n sources.append(row[0])\n destinations.append(row[1])\n messages.append(row[2])\n\ndef encrypt(message):\n messagenums = []\n for character in message:\n messagenums.append(ord(character))\n keys = []\n for i in range(len(messagenums)):\n keys.append(random.randint(10, 100))\n\n finalmessage = []\n for i in range(len(messagenums)):\n finalmessage.append(messagenums[i] * keys[i])\n\n return keys, finalmessage\n\nfor i in range(len(messages)):\n finalmessage, keys = encrypt(messages[i])\n print(finalmessage, keys)\n packet1 = IP(src=sources[i], dst=destinations[i])/TCP(dport=80)/Raw(load=str(finalmessage))\n send(packet1)\n packet2 = IP(src=sources[i], dst=destinations[i])/TCP(dport=80)/Raw(load=str(keys))\n send(packet2)So I wrote the following script to decrypt each message and obtained the flag.
\nimport ast\nfrom scapy.all import *\n\ndef print_decrypted(p,k):\n for i in range(len(p)):\n print(chr(p[i]//k[i]), end=\"\")\n print()\n return\n\n\ndef extract_tcp_payload(pcap_file, src_ip=None, dst_ip=None, src_port=None, dst_port=None):\n packets = rdpcap(pcap_file)\n payloads = []\n\n for packet in packets:\n if packet.haslayer('TCP'):\n if src_ip and packet['IP'].src != src_ip:\n continue\n if dst_ip and packet['IP'].dst != dst_ip:\n continue\n # if src_port and packet['TCP'].sport != src_port:\n # continue\n if dst_port and packet['TCP'].dport != dst_port:\n continue\n \n tcp_payload = bytes(packet['TCP'].payload)\n if tcp_payload:\n payloads.append(tcp_payload)\n \n return payloads\n\n\npcap_file = \"challenge.pcap\"\nsrc_ip = \"192.168.134.8\"\ndst_ip = \"192.168.87.251\"\nsrc_port = 0\ndst_port = 80\n\npayloads = extract_tcp_payload(pcap_file, src_ip, dst_ip, src_port, dst_port)\n\nfor i, payload in enumerate(payloads):\n if i % 2 == 0:\n p = ast.literal_eval(payload.decode())\n else:\n k = ast.literal_eval(payload.decode())\n print_decrypted(p,k)Being able to analyze pcap files with scapy was extremely convenient. It seems easier than using tcpdump.
\n\n\nAfter successfully infiltrating the lemonthinker gang, we’ve obtained their current location - the UK. We’ve attained some security logs from a gang member’s PC, but need some help in answering information relating to these.
\n
This challenge involved analyzing the Windows Security Event Log provided with the challenge and answering six questions.
\n\n\nHello agent. Thanks for your hard work in the field researching. We’ll now ask you 6 questions on the information you’ve gathered.\nI’d like to take this opportunity to remind you that our targets are located in the United Kingdom, so their timezone is BST (UTC +1).\nWe’d like to confirm what the username of the main user on the target’s computer is. Can you provide this information?
\n
The administrator user that was added first looked like the likely one, and slice1 was the correct answer.
\n\nNow, we’d like the name of the computer, after it was renamed. Ensure that it is entered in exactly how it is in the logs.
\n
The computer name was changed twice, and after the change made by what seemed to be the attacker, it was lemon-squeezer.
\n\nI wonder if they’ll make any lemonade with that lemon-squeezer…\nGreat work! In order to prevent their lemons from moulding, the lemonthinkers changed the maximum password age. What is this value? Please enter it as an integer number in days.
\n
From the password-policy change audit, you can tell that it was extended to 83 days.
\n\n\nIt seems that our targets are incredibly smart, and turned off the antivirus. At what time did this happen? Give your answer as a UNIX timestamp.
\n
Converting the time when Defender was stopped into a UNIX timestamp gives 1721946160.
\n\nThe main lemonthinker, slice1, hasn’t learnt from the-conspiracy and has (again) downloaded some malware on the system. What is the name of the user created by this malware?
\n
The answer is the user notabackdoor, which was the last account created.
\n\nFinally, we’d like to know the name of the privilege level of the user created by the malware. What is this?
\n
The answer here was simply Administrator.
The final answers were as follows.
\nslice1\nlemon-squeezer\n83\n1721946160\nnotabackdoor\nAdministratorSubmitting these answers gives the flag.
\nAfter that, a computer account named LEMON-SQUEEZER$ starts showing suspicious activity, so it looks like the attack began around the time of this rename.
The password policy was changed, and Max. Password Age was set to 83.
Defender was also disabled.
\n