Official emo Discussion

HTB Content Challenges
41

Man, this challenge blew me away. Learned so much (and also banged my head against the wall for about 3 days straight :rofl:).

@antmar904 : No, you were on the right track with the base64

@Thms84 : If you can read the PS, filter out the junk, see what the PS actually does. One thing that helped me : open the console and reproduce it

PS : If someone is willing to discuss this, DM

42

I have the decoded ps script but iā€™m having issues with it. let me go through it again!

Itā€™s heavily obfuscated which is the issue but Itā€™s a learning curve.

43

Yes exactly. Look at the PS closely, if itā€™s too obfuscated, find something that can peel off some layers for you, or do it manually.

44

Yeup, I am getting close. The last for loop is crazy obfuscated.

45

Iā€™m soooo confused. I still havenā€™t figured out the VBA macro stuff - so far iā€™ve just been trying to convert it to VBS so i can run it (since I donā€™t have Office to run the VBA - and iā€™d rather not buy office).

Iā€™m stuck at an error; It canā€™t create a w*nmg*t object. Iā€™m so lost nowā€¦

46

Hi everyone,
with dynamic analysis, i deobfuscated the ps code and got the flag but i am confused.
[Small Spoiler] ā†’ The line that helped me get the flag was : ${A8I3KE1}.(ToCharArray).Invoke() | (ForEach-Object) -Process { ${FN5GGmSh} += ([byte][char]${} -bxor SomeKey )
where ${FN5GGmSh} is an array of numbers and ${A8I3KE1} has to do with the links found in the obfuscated code.
So i initially went and xored the decimal value of each character of the links with the xor key but it didnt work. Then i tried doing it with the numbers the ${FN5GGmSh} holds and it got me the flag.
Was the line ${FN5GGmSh} += ([byte][char]${} -bxor SomeKey a hint that we should xor the values of ${FN5GGmSh} instead of the linksā€¦? ( as you can tell, im new to obfuscation & powershell ) .

Also, is there any static analysis writeup ? Because dynamic analysis feels like ā€œcheatingā€ .

47

Is it possible to do this challenge without dynamic analysis resp. execution of the file? Havenā€™t got an Office licence on my FlareVM.
I extracted all the Macros, but I think it will be a brainf**k to de-obfuscate them.

Edit:
I found the flag. Really nice challenge @0xdf ! :slight_smile:
Some hints

  • If it is not possible for you to run the file on your malware analysis machine, use google
  • I did not de-obfuscate the VBA macros
  • Think smart. Use the given script/commands to reverse it a little bit instead of creating own solutions

Feel free to DM me for more hints

49

Finally, I managed to solve it.

What I used (if it is useful for someone):

> Virustotal for sandboxing

> Cyberchef

> Prints and execute

That was my nooby way to solve it, hope it helps

Feel free to PM me