Reverse Engineering
Stealer (110 pts)
Description
We received a phishing email within which we have found this file. We believe this executable acts as some sort of credential stealer. Note: This is a defused real malware, consider disabling your AV.
Solution
Given PE32 .NET, open it using dnspy.
Looks like it was obfuscated, so take a look on entrypoint by right click on Ifw... then "Go to Entry Point"
So there are so many functions called in entrypoint and all of the function name are obfuscated
Looking at some called function and then i notice that there are some pattern in those functions. For example in function \u032E\uFFFD\uFFFDμ¬\uFFFD()
We can see that there is something like "global" variable used to store all the leaked data. Clicking the variable we will go to the class of the variable. Scrolling to bottom we will see some "encrypted" values.
At first i didn't think that this malware are well known malware (i was thinking that the author created this by himself). But when i search the encrypted value i found several code that use the same value.
So this one is known malware, the code that we found looks like interesting because it use the value for decryption process. Lets try to find any reference regarding snake keylogger.
We found the explanation of the decrypt code
So lets try to find the ciphertext value in configuration class. In this case we assume that the RID of the malware is same because the code is actually same.
Finally, just change the ciphertext in code and got interesting base64 value.
Decode the base64 encoded string and got the flag.
Flag: BHFlagY{t3legr4m_g0es_w!ld}
RD What Now? (180pts)
Description
I have some files missing but I think I can figure it out anyways.
Solution
Given .rdb file, stuck for a long time finding what kind of file is this. During the competition my friend (nyxmare) did binwalk to the file and found some interesting string on the decompressed zlib.
Based on some information gathering i conclude that it was file from R programming language. Narrowing the search, i found some reference about .rdb file.
---TBU---
Load each decompressed zlib using readRDS
Create z3 solver based on constraint on each function
Flag: BHFlagY{Rnt_vu|ns_Of_Seri4liz4t10n_sUp3r_fun!!}
Broken Authentication (280 pts)
Description
A friend of mine has sent me this authenticator, he said it's not working fine even with the right password. Can you help?
Solution
Given PE 64 bit, open it using IDA.
When we run the application there will be messagebox popped up and will process our input. When i tried to set breakpoint at main function the messagebox popped up first but the breakpoint is not triggered. So the process of popping up messagebox and checking our input is not done by the main function.
In Windows we know that there is a methodology to call function before main function. One of the methodology is through initterm, there is a sample that how we can "define" function called through initterm.
Now, lets try to inspect what function called through initterm. Breakpoint on initterm
There will be no messagebox popped up, so the "actual" code still not executed. Now take a look on First variable.
Looking at all function we will notice that only the last function are suspicious, so rename the function.
Take a look on sub_7FF7EAB74D20 function. Breakpoint at 0x7FF7EAB74DEF we will see the decrypted string at *rbx
Continue the dynamic analysis then we can conclude some insights.
The VBscript code are resides in line 59-67, it "obfuscated" using xor operation. The easy way to get the plaintext code just breakpoint on
(*(_QWORD *)v6 + 40i64)function call and take a look on second argument.
The code looks like same like the messagebox popped up when we run the progam. From code above we can see that our input is stored at WshShell Environment Process with key "KPASS". Back to the code now then continue to the next function sub_7FF7EAB75020.
Line 88 is the process of decrypting the javascript code, dump the ciphertext and decrypt it using python
So the javascript is obfuscated, lets deobfusacte it using online tools.
See the full code in this gist. Lets focus on the main logic of the input validation.
We cannot directly execute above javascript code using interpreter like node, based on information that i found we can execute above code in internet explorer. Trying to find executable that can run above script i found "csript.exe". We can run above script like using nodejs executable.
Back to the javascript code, there are some insight that we can note
Line 16-17: initialization of k1 variable that will be used key for encryption. It filled with Math.random values multiplied with some constant
Line 18 & 21: base64 decode and write malware to dll file, next it will be dynamically loaded through dynamicwrapper
Line 24: registering some function from library to be used through _0x47f0ea variable
Line 42 & 63: example of loaded function from malware.dll
Now we know what the code did, our input that has been stored in KPASS is used as the plaintext and then encrypted using windows API. Lets take a look on some function to extract some useful information
CryptCreateHash
Based on wincrypt documentation 32771 (0x8003) is CALG_MD5
CryptHashData
k1 will be the key for the encryption process
CryptDeriveKey
Based on wincrypt documentation 26126 (0x660e) is CALG_AES_128
CryptEncrypt
d that store h5 value (hex value of our input) will be the plaintext
k1 is random but it looks like bruteforceable, lets analyze it
Math.random value is 0-1 (0 inclusive, 1 exclusive)
Minimum = 0
Maximum = 0.99
So the possible value generated is 0,1,2,3
The length of the key is 8 so the bruteforce process will be very fast. Last, because we know the compared ciphertext lets reverse the flow by decrypting the known ciphertext and get the actual input (flag). Below is the script i used to implement algorithm explained before.
Flag: BHFlagY{ca11ing_n4tiv3_c0d3_fr0m_j5_vb5_ps}
Last updated