TET & 4N6 - Misc/Forensics
Task
Tet is coming, TetCTF is coming again. Like every year, I continued to register to play CTF, read the rules to prepare for the competition. After reading the rules, my computer seemed unusual, it seemed like it was infected with malicious code somewhere. Can you find out?
Find the malicious code and tell me the IP and Port C2
What was the first flag you found?
After registering an account, I no longer remember anything about my account. Can you help me find and get the second flag?
Format : TetCTF{IP:Port_Flag1_Flag2}
Ex: TetCTF{1.1.1.1:1234_Hello_HappyForensics}
Solution
The Challenge.zip file is attached to the task:
Let's unpack the received zip archive:
The archive contained two files: Backup.ad1 and TETCTF-2024-20240126-203010.zip. Let's extract the contents of the second zip file:
After unpacking, we get a raw data file TETCTF-2024-20240126-203010.raw. Let's start the analysis from the file Backup.ad1.
First flag
We will use Volatility 3 and malfind functionality to check the list of process memory ranges that potentially contain injected code:
The output of the malfind command returned 4 results for the process with PID 1992, i.e. WINWORD.EXE:
WINWORD.EXE is the MS Word process. Let's check network connections, filtering them by process PID:
One of the network connections is in the ESTABLISHED state. If the WINWORD.EXE process is malicious, there is a high probability that a macro is responsible for the malicious content.
Output for the command line arguments for a process with PID 1992 allows us to associate this process with the TetCTF2024-Rules..docx file:
Let's check the address of this file:
And then we will extract it:
The content of the task suggests that something malicious happens after reading the rules. The contents of the TetCTF2024-Rules.docx file contain CTF rules:
Only specific files with enabled-macro can be used to contain VBA macros. The goal is to make it easier to detect files that have macros and to reduce the risk of attacks that use macros. Files with enabled macros use the letter m at the end of the extension such as .dotm, .docm, .xlsm, and .pptm.
Files with the extensions .dotm and .docm are Microsoft Word files. Let's check if there are any files in the system that have the macro enabled:
The Normal.dotm template opens whenever you start Microsoft Word, and it includes default styles and customizations that determine the basic look of a document.
So it's a standard Microsoft Word file. Let's see if anyone has tried to "improve" it. I wasn't able to dump it using Volatility:
But we can extract it using FTK Imager:
A .dotm file is a collection of XML files inside a ZIP archive. The contents of a .docx document can be viewed by unzipping it. Let's copy the extracted Normal.dotm file to the Linux virtual machine, and unpack it using unzip:
We can see that this file contains vbaProject.bin. First, we can use strings to check whether this file might contain something interesting:
We can see that this file contains a string in Base64. Let's use CyberChef to decode it:
We captured Flag 1:
IP and port
Strings in the vbaProject.bin file also contains an IP address 172.20.25.15 with port 4444:
The same address and port appeared in the network connection results for the WINWORD.EXE process. So we can assume that it is IP and Port C2:
Second flag
Now we have to find login data. We know from Backup.ad1 file that the user had at least 2 Internet browsers: Internet Explorer and Google Chrome. Let's start by analyzing the data of the second one.
Chrome logins are stored in the Login Data SQLite database in logins table. Search results, visited pages, and downloaded files should be included in a SQLite database called History which is also in this directory:
Since I was looking for a malicious macro, I wanted to check the history of downloaded files and visited websites to understand what happened. I extracted History file:
Next, I transferred this database to a Linux virtual machine and opened it with DB Browser for SQLite. After analyzing the downloads table I found the second flag:
We captured Flag 2:
This type of capturing the second flag wasn't intended. The author of the task was intended to solve this task in the following way:
Mimikatz is an open-source tool for collecting and using credentials on Windows systems. However, this tool is not malware, although it is commonly detected as malware.
Whole flag
The whole flag is as follows:
Last updated
