If you open the log with Event Viewer, you may see there’s an entry for a (non-actual) event ID of 1337.
The error content isn’t very helpful.
Let’s take a hint from the title and run the event log through Chainsaw.
Nothing significant when using the stock rules. What if we poke specifically at Event ID 1337.
That looks interesting.
Copy the binary data and bring it over to CyberChef
From unintelligible binary to unintelligible PowerShell.
Copy the output and save it is a .ps1 file. We can run the script through PowerDecode.
PowerCode works down through the obfuscation layers, finally revealing the plain text of the command.
Now that the code has been deobfuscated, time to figure out what it does. I copied the code into PowerShell ISE and start isolating the different command sections.
One of the commands does a DNS lookup and directs the output into a string.
If we run the command on its own we can see the output. The last part of the script checks to see if the output matches the pattern of a Base64 encoded string, and if so, decodes it.
Now what was that about Tokyo?
Use the tag #HuntressCTF on BakerStreetForensics.com to see all related posts and solutions for the 2023 Huntress CTF.
Once the file was downloaded and extracted from the zip I ran the file command on it.
OK so we’ll be doing the analysis for this one on a Windows box to start.
Move the file to windows and rename to Fetch.wim
Open the .wim with 7zip explorer
Within the zip file we see a plethora of Prefetch (.pf) files, but among them we there is a fetch.zip
When we extract the contents of the zip file we have another directory of Prefetch files.
I extracted the .pf files to a folder.
I used Magnet AXIOM to process the prefetch files. Based on our scenario, I have keywords set for Huntress, ctf, and flag.
That was easy.
Opposable Thumbs
I know for a fact that Axiom can process thumbnail caches.
And BAM! there’s the flag.
Tragedy Redux
First things first, let’s get an idea of what kind of file we’re dealing with. Hmm. It shows as a zip archive. When the file is unzipped we see the structure below.
Looking at the structure, as seasoned analyst may identify that the tragedy_redux file is in fact a word document. Which will bring up another method in a minute. But before that let’s take a look at the vbaProject.bin file with olevba.
There’s a macro file with some curious fruit and vegetable related functions.
If you realized at the beginning this was a word doc file, you could append the file extension .docm to the file.
When opening the file in Word, there is a prompt to enable macros.
Once the document is open you see a document containing the definition of Tragedy.
From there we can go to Tools > Macros > Edit… we can get to the same vbs content we did with olevba.
The next step was to convert the vbs into something actionable. I struggled on this one, but one of my teammates was successful in converting the vbs to Python.
This code interprets the numeric values in longstring (Apples), as decimal representations of ASCII values, subtracts 17 from each value, and prints the corresponding characters. The characters are printed one by one without newlines, forming a string of characters as the output.
So we’ve got a url and a specific port. Firefox web browser yields…
So we need an Authorization header. 🤔
Time to look at the provided files. It looks to be the export of a Splunk application.
Time to download an eval copy of Splunk and… pause. There’s probably a simpler way to attack this.
The Silver Searcher is a command line tool I picked up during the CTF and I love it. It’s like Grep on PCP.
Once installed, the base command is ag, followed by what you’re searching for, and where. So let’s do a quick search for Authorization on all the contents of this directory.
That looks interesting. A clue? One of the PowerShell scripts has Authorization and what looks to be Base64 code.
We also see a comment about the $PORT being dynamic based on the Start button. Decoding the string in CyberChef…
At this point we have all the pieces, we just need to put them together. I started to look at different ways to pass an Authorization header to a web server. There’s proxy tools galore. And then there’s the basic’s like curl. After a bit of brushing up on my syntax I had:
Yay what looks like more Base64. Once more with our Chef’s hat and…
Traffic
rita was a tool I hadn’t used before but it was very easy to use. I installed it on my REMnux box and then ran it against the dataset.
I then used the command to generate an html report.
Looking through the DNS requests there’s something sketchy indeed.
Let’s go take a look at that.
Dumpster Fire
Let’s start with the_silver_searcher again and see if we have any luck with “Password”.
There’s a number of hits including references to an encryptedUsername and encryptedPassword in the logins.json file. So we’ve got some encrypted Firefox user passwords. If only there were a utility that could decrypt those. Enter firepwd.py, an open source tool to decrypt Mozilla protected passwords.
Run the script in Python and point it to the directory for the user profile (where the logins.json file is).
That’s a pretty LEET password 😉
Use the tag #HuntressCTF on BakerStreetForensics.com to see all related posts and solutions for the 2023 Huntress CTF.
The team at Huntress pulled off an amazing CTF that ran through the month of October with new challenges released daily. In this series, I’ll be providing my solutions to the challenges. WARNING Will Robinson, spoilers ahead! Use the tag #HuntressCTF to see all related posts.
Technical Support
There wasn’t really a solve to this one, but I’m including here for consistency. If you head to the Discord server for the event and went to the support channel, the flag was provided.
String Cheese
Taking this literally – we’ll run STRINGS on cheese:
If we scroll down through the output…
Notepad
Right click on the notepad file, open with VS Code or text editor of choice.
CaesarMirror
When you examined the text file you got
I copied the text over to CyberChef and started running some recipes on it. I found an algorithm that would work on it, well, one half at a time.
I took the original file and edited it into 2 versions, caesar_left.text and caesar_right.txt. I converted each side of the file, screenshotted the output, and then aligned them next to each other to read the complete output.
Book By Its Cover
Use the FILE command to get the properties of book.rar.
Hmm. A png file. Let’s open that with an image viewer.
BaseFFFF+1
Examining the file contents yielded…
Back to CyberChef. There’s Base64 and Base85 but neither of those work. Looking closer at the title…. BaseFFFF+1… FFFF is the Hexadecimal for 65535. Add one and you have 65536. I googled Base65536, and while it’s not in CyberChef it does exist.
Read the Rules
Head over to the Rules page. While you’re there, be sure to read up on what tools are not allowed. CTFs are usually not the situation where you bring a tank to a knife fight. Once you’ve read everything, visible, three or four times if you’re me, right, click on the webpage and choose view source.
Query Code
Once again the FILE command gives us our first clue.
It’s a png image so open with an image viewer and you have a QR code. Scan that with a QR reader and…
Dialtone
The provided wav file is a recording of different telephone buttons being pushed. The first thing to do is identify what buttons/numbers are being pushed. Using the site DialABC I uploaded the wav file and then transcribed the DTMF Tone outputs.
13040004482820197714705083053746380382743933853520408575731743622366387462228661894777288573. That is on heck of a phone number!
A hint on Discord led me to the next step. It referenced that this was a BigInteger value. After several trips with Alice down various rabbit holes I found a PowerShell syntax to convert BigInt to strings.
Hmm. Looks closer to what an encoded flag might look like, but still not there yet. Back over to CyberChef and sprinkle a little Magic dust… and we see that the next and last decoding step is to From_Hex.
Layered Security
The file command indicates that it’s a GIMP image file. I recall that GIMP is an open-source application that’s comparable to Adobe Photoshop. I’d used it previously but not in a long time. I also can’t help but think of Pulp Fiction and “Bring out the Gimp.”
After a morbid chuckle and a quick installation, I launch GIMP and open the file. In the bottom right we see there are a number of faces that are part of this picture.
As we peel down the layers we find the flag in one of the images.
Comprezz
We’ve been pretty successful starting with the file command, so let’s start there.
As the challenge suggests, no I have not heard of this file type. A quick google for compress’d data 16 bits takes me to several posts on how to uncompress theses files. After a brief trial and error (it may have taken me 2 times), I cat’d the file and then piped it to uncompress.
That’s it for the challenges in the Warm Up category. There were also challenges in Forensics, Malware and Miscellaneous.
Use the tag #HuntressCTF to see all related posts. Now that October is over, I’ll be releasing as many of these as I can.
