{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-heroctf-2023-en","result":{"data":{"markdownRemark":{"id":"8eb407e0-41f8-5a0f-bbbb-5d9c7d0f3594","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in Hero CTF 2023, which started on 5/13, as 0nePadding.

\n

My final placement was 84th out of 1085 teams.

\n

\n \n \n \n \n \n \n \n \n

\n

Hero CTF was a pretty unusual(?) CTF, and almost every Reverse challenge involved handling real malware samples.

\n

It was a very intense and fun CTF, so as usual I’m writing up the challenges I learned from.

\n\n

Table of Contents

\n\n

Give My Money Back(Rev)

\n
\n

Joel sat at his desk, staring at the computer screen in front of her. She had just received a strange email from an unknown sender. Joel was intrigued. She hesitated for a moment, wondering if she should open the email or not. But her curiosity got the best of her, and she clicked on the message. Your goal is to help Joel find out who stole her money!

\n

Warning : The attached archive contains real malware, do not run it on your machine! Archive password: infected

\n

The flag corresponds to the email used for the exfiltration and the name of the last exfiltrated file, e.g. Hero{attacker@evil.com|passwords.txt}.

\n

Format : Hero{email|filename}\nAuthor : xanhacks

\n
\n

The very first challenge already involved real malware.

\n

Reading the provided sample (a VBS file), it looked like it was executing something using an obfuscated script.

\n

\n \n \n \n \n \n \n \n \n

\n

When I removed the eval processing in my analysis environment and deobfuscated it, I was able to obtain the plaintext of the code executed by the malware.

\n

\n \n \n \n \n \n \n \n \n

\n

From there, I recovered the attacker’s email address that became the flag and the filename of the stolen confidential file, and solved the challenge.

\n

Scarface(Rev)

\n
\n

Maybe you can find my password… But you can’t push it to the limit like me.

\n

Format : Hero{password}\nAuthor : SoEasY

\n
\n

This was a reversing challenge involving an ELF file rather than malware.

\n

Decompiling it with Ghidra gave the following main function.

\n
undefined8 main(void)\n{\n  uint uVar1;\n  char *__s;\n  void *pvVar2;\n  size_t sVar3;\n  char *__s_00;\n  int local_2c;\n  char *local_28;\n  \n  __s = (char *)malloc(0x40);\n  pvVar2 = malloc(0x40);\n  printf(\"Can you push it to the limit ? \");\n  fgets(__s,0x3f,stdin);\n  sVar3 = strcspn(__s,\"\\n\");\n  __s[sVar3] = '\\0';\n  sVar3 = strlen(__s);\n  if (sVar3 != 0x1f) {\n    fail();\n  }\n  for (local_28 = \"https://www.youtube.com/watch?v=Olgn9sXNdl0\"; *local_28 != '=';\n      local_28 = local_28 + 1) {\n  }\n  __s_00 = (char *)UNO_REVERSE_CARD(local_28);\n  sVar3 = strlen(__s_00);\n  uVar1 = decode(__s_00,sVar3 & 0xffffffff,pvVar2);\n  for (local_2c = 0; local_2c < 0x1f; local_2c = local_2c + 1) {\n    if ((byte)(__s[local_2c] ^ *(byte *)((long)pvVar2 + (ulong)(long)local_2c % (ulong)uVar1)) !=\n        (&DAT_00102050)[local_2c]) {\n      fail();\n    }\n  }\n  printf(\"Well done! You can validate with the flag Hero{%s}\\n\",__s);\n  printf(\"(And watch a last time this : %s)\",\"https://www.youtube.com/watch?v=Olgn9sXNdl0\");\n  return 0;\n}
\n

The code is very simple: it accepts input with the same length as https://www.youtube.com/watch?v (0x1f) and validates it as a password.

\n

At this point, you can see that the values used for verification are generated by the following three lines.

\n
__s_00 = (char *)UNO_REVERSE_CARD(local_28);\nsVar3 = strlen(__s_00);\nuVar1 = decode(__s_00,sVar3 & 0xffffffff,pvVar2);
\n

Looking at each step, none of them depend on the user’s input, and they always generate the same values.

\n

So I performed dynamic analysis with gdb, extracted the values of pvVar2 and uVar1, and then used the following solver to recover the flag.

\n
#   __s_00 = (char *)UNO_REVERSE_CARD(i);\n#   sVar3 = strlen(__s_00);\n#   uVar1 = decode(__s_00,sVar3 & 0xffffffff,pvVar2);\n#   for (j = 0; j < 0x1f; j = j + 1) {\n#     if ((byte)(__s[j] ^ *(byte *)((long)pvVar2 + (ulong)(long)j % (ulong)uVar1)) !=\n#         (&DAT_00402050)[j]) {\n#       fail();\n#     }\n#   }\n\ns_00 = \"0ldNXs9nglO=\"\nsVar3 = len(s_00)\n\nuVar1 = 0x8\ndecode_map = [0xd2,0x57,0x4d,0x5e,0xcf,0x67,0x82,0x53,0x80]\nDAT_00402050 = [ 0x81, 0x63, 0x34, 0x01, 0x87, 0x54, 0xee, 0x1f, 0xe2, 0x08, 0x39, 0x6e, 0x90, 0x0a, 0xdb, 0x0c, 0xbe, 0x66, 0x39, 0x2a, 0xa3, 0x54, 0xdd, 0x15, 0x80, 0x66, 0x7e, 0x10, 0x8b, 0x46, 0xa3, 0x00, 0x00, 0x00, 0x00 ]\nflag = \"\"\n\nfor i in range(0x1f):\n    flag += chr(DAT_00402050[i] ^ decode_map[i%8])\n\nprint(flag)\n# S4y_H3lL0_t0_mY_l1ttl3_FR13ND!!
\n

InfeXion(Rev)

\n

This was a series of challenges about analyzing real malware that had been observed recently.

\n

The problem was released while the server used by the malware to download its second-stage sample was still alive.

\n

Task1

\n
\n

On 2023-04-29 10:10:07, we received the following order from a C2 server located on the domain {C2 URL}:

\n

{C2 URL}

\n

Warning : This series of challenges contains real world malware. Do not execute it on your host, use a VM !!

\n

The flag corresponds to malware family that sends this order, e.g. Hero{QAKBOT}.

\n

Format : Hero{malware-family}\nAuthor : xanhacks

\n
\n

This challenge asked for the malware family that issues commands from C2 such as down-n-exec|https://<malware distribution server>/qk7kvg.VBS|qk7kvg.VBS.

\n

I first thought it was STRRAT, but that was not correct, so I dug a little deeper and found the following article.

\n

Reference: Agent Tesla Malware Analysis: WSHRAT Acting as a Dropper

\n

That led me to the correct flag, Hero{WSHRAT}.

\n

Task2

\n
\n

A script named qk7kvg.VBS appears to have been executed on the victim’s machine. Find the next step in the infection chain!

\n

Warning : This series of challenges contains real world malware. Do not execute it on your host, use a VM !!

\n

The flag corresponds to the URL and the Windows path of the downloaded file, e.g. Hero{https://dropbox.com/file/xyz|C:\\Windows\\Temp\\malware.exe}.

\n

Format : Hero{URL|FULL_PATH}\nAuthor : xanhacks

\n
\n

In this task, the flag was the URL of the server distributing the second-stage sample referenced in the sample qk7kvg.VBS retrieved from C2.

\n

The URL was written in plaintext in the sample.

\n

Task3

\n
\n

A powershell script named vidyud.jpg appears to have been executed on the victim’s machine. Find the next step in the infection chain! How the first binary runs the second one?

\n

Warning : This series of challenges contains real world malware. Do not execute it on your host, use a VM !!

\n

The flag corresponds to the name of technique and the method name for hiding the malicious process, e.g. Hero{DLL Injection|mainMethod}.

\n

Format : Hero{Technique|Method name}\nAuthor : xanhacks

\n
\n

Analyzing the second-stage sample downloaded by qk7kvg.VBS, I found that although it had a .png extension, the file actually contained an obfuscated PowerShell script.

\n

This script generates two binary files from obfuscated byte data.

\n

After deobfuscating it and saving the byte data as files, I was able to obtain the following two samples.

\n

Reference: VirusTotal - File - d0043009211a1d48c601ad011eec26bfb01d56331fe2509a7422d2ed984089bf

\n

Reference: VirusTotal - File - ecae6a842a9d1e85254965536628840d2dd28145db57e32d821b10ec9744ba8f

\n

Finally, it was run with the following command, loading sample A and passing the data from sample B to a function in it.

\n
[Reflection.Assembly]::Load($uiououououououououoououo).GetType('Hhd95inlxpu7aiKwB3.Erc4ahc0TZJlqBWO9w').GetMethod('rdgUsOpw7').Invoke($null,[object[]] ('C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe',$cbbzqwqwqqwqwwqw))
\n

Because it is loaded and executed with [Reflection.Assembly]::Load, we can tell that $uiououououououououoououo, which stores the data for sample A, was created in .NET.

\n

So I analyzed the extracted file with ILSpy, and by looking at the function rdgUsOpw7 in the class Hhd95inlxpu7aiKwB3.Erc4ahc0TZJlqBWO9w, which is specified by the GetType method, I was able to understand its behavior.

\n

In the end, the correct flag was Process Hollowing, the technique used to inject the code, together with g8tOGbvTY, the function called by rdgUsOpw7.

\n

Task4

\n
\n

The second binary seems to be the real malware! Extract its configuration.

\n

Warning : This series of challenges contains real world malware. Do not execute it on your host, use a VM !!

\n

The flag corresponds to the C2 protocol, host and port, e.g. Hero{smb|sub.example.com|9932}.

\n

Format : Hero{protocol|domain|port}\nAuthor : xanhacks

\n
\n

This challenge was to identify the communication destination and protocol used by the second sample.

\n

Here, I was able to determine the flag simply by using the VirusTotal analysis results as they were.

\n

Reference: VirusTotal - File - ecae6a842a9d1e85254965536628840d2dd28145db57e32d821b10ec9744ba8f

\n

Hero Ransom(Rev)

\n
\n

The mission of analyzing this malware is given to you in order to recover an encrypted file.

\n

Do not run the malware on yout host machine.

\n

Format : Hero{flag}\nAuthors : SoEasY & Log_s

\n
\n

You are given a ransomware sample with the following hash.

\n

Reference: VirusTotal - File - fb0d5f066ee85b307b6bf83c8cf88699cac719c35637a4b74b2760c16bc805b9

\n

After looking through the main function decompiled in Ghidra, I focused on the following line.

\n

\n \n \n \n \n \n \n \n \n

\n

It seemed to be calling an address stored in a register.

\n

When I set a breakpoint at this point in WinDbg and followed the execution, it allocated stack space and then called 0x2a7c4d28cec.

\n
> bp hero_ransom+0x1c04\n\n> u @rcx L2\n000002a7`c4d28238 4883ec28        sub     rsp,28h\n000002a7`c4d2823c e8ab0a0000      call    000002a7`c4d28cec
\n

A function call beginning with 4883ec28 looks like the start of a PE entry function.

\n

When I printed this call destination as well, it looked like it was invoking code with something like a function prologue.

\n
> uf 000002a7`c4d28cec\n000002a7`c4d28cec 48895c2420      mov     qword ptr [rsp+20h],rbx\n000002a7`c4d28cf1 55              push    rbp\n000002a7`c4d28cf2 488bec          mov     rbp,rsp\n000002a7`c4d28cf5 4883ec20        sub     rsp,20h\n000002a7`c4d28cf9 488b0510e50400  mov     rax,qword ptr [000002a7`c4d77210]\n000002a7`c4d28d00 48bb32a2df2d992b0000 mov rbx,2B992DDFA232h\n000002a7`c4d28d0a 483bc3          cmp     rax,rbx\n000002a7`c4d28d0d 7574            jne     000002a7`c4d28d83  Branch\n{{ omitted }}
\n

This function seems to have been decompressed from somewhere at runtime and expanded in memory, and it does not appear to be embedded in the original binary as raw bytes.

\n

After referring to the Writeup, I learned that a tool called HollowsHunter can be used to dump PE binaries expanded in memory like this.

\n

So I ran a memory scan with HollowsHunter, specifying the PID identified with the pseudo-register $tpid, and obtained a file named 2a7c4d00000.exe.

\n
> ? $tpid\nEvaluate expression: 2288 = 00000000`000008f0\n\n>hollows_hunter64.exe /pid 2288\nHollowsHunter v.0.3.6 (x64)\nBuilt on: May 14 2023\n\nusing: PE-sieve v.0.3.6.0\n\n>> Scanning PID: 2288 : hero_ransom.exe\n>> Detected: 2288\n--------\nSUMMARY:\nScan at: 05/16/23 12:31:13 (1684240273)\nFinished scan in: 141 milliseconds\n[*] Total scanned: 1\n[*] Total suspicious: 1\n[+] List of suspicious:\n[0]: PID: 2288, Name: hero_ransom.exe
\n

This matched the suspicious function-call code I had confirmed in the debugger.

\n

Next, I analyzed the dumped binary further with Ghidra.

\n

Looking at the main function, it was as follows.

\n
undefined8 main(void)\n{\n  undefined local_28 [16];\n  undefined8 local_18;\n  undefined8 local_10;\n  \n  local_18 = 0;\n  local_10 = 0;\n  local_28 = ZEXT816(0);\n  func1((undefined (*) [32])local_28,(undefined (*) [32])&DAT_140069a00,1);\n  func2((longlong **)local_28);\n  return 0;\n}
\n

ZEXT816(0) seems to zero-extend 8 bytes to 16 bytes. In other words, the original 8-byte zero becomes a 16-byte zero and is stored in local_28.

\n

Also, DAT_140069a00 contains a single . character.

\n

The official Writeup identifies the logic very quickly with static analysis, but honestly I felt it was extremely difficult to analyze on my own.

\n

First, local_28 is given together with . to func1, and after that local_28 is passed to func2.

\n

I had no idea where the actual encryption was being performed, so for the moment I tried running the malware under Noriben.

\n

It seemed that this malware encrypts files under the folder where the malware is executed.

\n

That suggests that func1, which receives ., is probably traversing the current directory.

\n

From here, I followed the processing with WinDbg.

\n
> bp Hero+0x571f
\n

I first set a breakpoint on the main function and traced the execution, but by the time func1 finished, no file encryption had occurred.

\n

In other words, the encryption routine seems to be on the func2 side.

\n

Static analysis gave me no clue where the encryption processing was taking place, so I decided to inspect the arguments at each function call with WinDbg.

\n

However, func2 makes a huge number of function calls, so I first wrote all function-call arguments to a file with the following command.

\n
> .logopen /t C:\\Users\\Public\\windbg.log\n> .while (1) { pc;.echo rcd;dc @rcx L10;.echo rdx; dc @rdx L10;.echo r8; dc @r8 L10;.echo r9; dc @r9 L10;.echo stack; dc @rsp L10;.echo rip; u rip L1 }
\n

This let me dump the arguments at each function call inside func2, so I looked through them for a function whose arguments included test.txt, which I had placed in the same folder as the malware.

\n

However, even after staring at Ghidra for about four hours while reading the Writeup, I unfortunately still could not determine exactly where the encryption processing was happening.

\n

I want to read the official writeup and retry it another day.

\n

dev.corp(Forensic)

\n

Task1

\n
\n

The famous company dev.corp was hack last week.. They don’t understand because they have followed the security standards to avoid this kind of situation. You are mandated to help them understand the attack.

\n

For this first step, you’re given the logs of the webserver of the company.

\n

Could you find :

\n\n

Format : Hero{CVE-XXXX-XXXX:/etc/passwd}\nAuthor : Worty

\n

Here is a diagram representing the company’s infrastructure:

\n
\n

\n \n \n \n \n \n \n \n \n

\n

This felt like a very practical forensic challenge.

\n

The challenge provided access logs for the web server.

\n

From these, I needed to identify the vulnerability abused in the attack and the most sensitive information among the stolen files.

\n

Since this was access-log analysis, I used the cut and uniq commands to look for suspicious paths and operations.

\n

As a result, I found access that looked like path traversal exploiting CVE-2020-11738, and I determined that the accessed id_rsa_backup was the most sensitive file.

\n

In the end, the flag was Hero{CVE-2020-11738:/home/webuser/.ssh/id_rsa_backup}.

\n

Heap(Forensic)

\n
\n

We caught a hacker red-handed while he was encrypting data. Unfortunately we were too late to see what he was trying to hide. We did however manage to get a dump of the java heap.

\n

Try to find the information he wants to hide from us.

\n

Format : Hero{}\nAuthor : Thib

\n
\n

The provided challenge file was heap.hprof.

\n

Looking at it with Hexdump and similar tools, it seemed to be a dump of memory information from something like an Android app.

\n

The .hprof format is used for Java VM dump files, but apparently .hprof files dumped from Android Studio differ from the standard format, so they need to be converted once with hprof-conv before being loaded into MAT.

\n

Reference: java - How do I analyze a .hprof file? - Stack Overflow

\n

Reference: Quickly capturing hprof files for Android’s Memory Analyzer - Qiita

\n

So I converted the file format with the following command.

\n
hprof-conv heap.hprof heap-conv.hprof
\n

Next, I launched MemoryAnalyzer.exe and analyzed the converted file.

\n

On the first screen, I pressed the blue button to create a Histogram.

\n

\n \n \n \n \n \n \n \n \n

\n

Since the encryption mode turned out to be EBC, I was able to decrypt the flag using the obtained Key and message.

\n

\n \n \n \n \n \n \n \n \n

\n

Windows Stands For Loser(Forensic)

\n

I ran out of energy, so I’ll review this one another day…

\n

Reference: HeroCTFv5/Forensics/WindowsStandsForLoser at main · HeroCTF/HeroCTF_v5 · GitHub

\n

OpenPirate(OSINT)

\n

This challenge was to access hero.pirate.

\n

Apparently, the pirate domain is managed by OpenNIC.

\n

So, using the following as a reference, I configured an OpenNIC public server as my DNS resolver.

\n

Reference: Alternative DNS services - ArchWiki

\n

After that, I was able to access hero.pirate and recover the flag.

\n

\n \n \n \n \n \n \n \n \n

\n

PDF-Mess(Stego)

\n
\n

This file seems to be a simple copy and paste from wikipedia. It would be necessary to dig a little deeper…

\n

Good luck!

\n

Format : Hero{}\nAuthor : Thibz

\n
\n

When I broke the PDF file into objects with pdfstreamdumper, I found the following code.

\n
const CryptoJS=require('crypto-js'),key='3d3067e197cf4d0a',ciphertext=CryptoJS['AES']['encrypt'](message,key)['toString'](),cipher='U2FsdGVkX1+2k+cHVHn/CMkXGGDmb0DpmShxtTfwNnMr9dU1I6/GQI/iYWEexsod';
\n

If you simply decrypt the AES ciphertext above, you can recover the flag.

\n

PNG-G(Stego)

\n
\n

Don’t let appearances fool you.

\n

Good luck!

\n

Format : Hero{}\nAuthor : Thibz

\n
\n

The provided challenge file is an image named pngg.png.

\n

\n \n \n \n \n \n \n \n \n

\n

Although the extension is png, when I checked the exif data I found that [File Type] was APNG.

\n
ExifTool Version Number         : 12.40\nFile Name                       : pngg.png\nDirectory                       : /home/ubuntu/Hacking/CTF/2023/heroctf/Stego/PNG-G\nFile Size                       : 500 KiB\nFile Modification Date/Time     : 2023:05:14 00:55:20+09:00\nFile Access Date/Time           : 2023:05:17 22:09:16+09:00\nFile Inode Change Date/Time     : 2023:05:14 00:55:20+09:00\nFile Permissions                : -rw-r--r--\nFile Type                       : APNG\nFile Type Extension             : png
\n

So this image appears to be animated.

\n

So I used APNG Disassembler download | SourceForge.net to split the APNG file into images, and I was able to obtain an image file containing the flag as shown below.

\n

\n \n \n \n \n \n \n \n \n

\n

Subliminal(Stego)

\n
\n

An image has been hidden in this video. Don’t fall into madness.

\n

Little squares size : 20x20 pixels

\n

Format : Hero{}\nAuthor : Thibz

\n
\n

When I played the provided mp4 file, I noticed that a 20*20-pixel image was moving one square at a time on each frame, as shown below.

\n

\n \n )\nwidth = int(cap.get(cv2.CAP_PROP_FRAME_WIDTH))\nheight = int(cap.get(cv2.CAP_PROP_FRAME_HEIGHT))\nprint(width,height)\n\n# Size of the image tiles to concatenate\nsize = (20, 20)\nimages = []\n\nx = 0 # Initial x-coordinate\ny = 0 # Initial y-coordinate\ncrop_x = 20 # Crop width along the x-axis\ncrop_y = 20 # Crop width along the y-axis\n\n# Extract images\nframe_count = 0\ni = 0\nwhile cap.isOpened():\n ret, frame = cap.read()\n if not ret:\n break\n frame_count += 1\n\n # Process one frame at a time\n crop_img = frame[y:y+crop_y, x:x+crop_x]\n images.append(crop_img)\n if x+crop_x == width:\n # Combine the images\n result = cv2.hconcat(images)\n cv2.imwrite('./images/result{}.jpg'.format(i), result)\n images = []\n\n x = 0\n i += 1\n if y+crop_y == height:\n break\n else:\n y += crop_y\n print(x,y)\n else:\n x += crop_x\n\n# Release the video file\ncap.release()\n\nimages = []\nfor i in range(36):\n images.append(cv2.imread('./images/result{}.jpg'.format(i)))\n\nresult = cv2.vconcat(images)\ncv2.imwrite('result.jpg', result)\n

This let me extract the flag from the resulting image.

\n

\n \n \n \n \n \n \n \n \n

\n

Summary

\n

This time again I mainly worked on Rev and Forensic, and I really enjoyed how distinctive the problems were, using real malware and incidents almost as-is.

\n

There are still a few challenges I haven’t solved yet, so I want to retry them while reading the writeups.

","fields":{"slug":"/ctf-heroctf-2023-en","tagSlugs":["/tag/ctf-en/","/tag/rev-en/","/tag/forensic-en/","/tag/osint-en/","/tag/english/"]},"frontmatter":{"date":"2023-05-16","description":"Hero CTF 2023 Writeup","tags":["CTF (en)","Rev (en)","Forensic (en)","OSINT (en)","English"],"title":"Hero CTF 2023 Writeup","socialImage":{"publicURL":"/static/354a25e616ee5512c3e7d6805372d84b/ctf-heroctf-2023.png"}}}},"pageContext":{"slug":"/ctf-heroctf-2023-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}