Incident Response and Threat Intelligence Challenge
As we mentioned in our previous posts on the Web and Cloud challenges, every year DarkLab organises a capture the flag cybersecurity competition designed for undergraduate students aiming to raise the competency level of future talents to better prepare them for a meaningful career in cybersecurity.
HackaDay 2020 was held on 2 December 2020, and saw the Open University of Hong Kong’s YH team crowned as winning team, and the Hong Kong University of Science and Technology’s Machine Brickers as runners up.
The theme this year was “Security the Basics”, based on the experience and real life challenges that organisations in Hong Kong have faced in 2020 – as observed by our own Red Team and Incident Response professionals.
In this series of three blog posts, we want to provide the solution to the different challenges students faced. We hope that this will stimulate even more students to get their hands on the keyboard next year! In this post we cover the Incident Response (IR) and Threat Intelligence (TI) questions.
Ransomware Attack Again 1 (50 pts, 14 solves)
Description: Our client has been hit by a ransomware attack. While the rest of the client’s PCs have been restored, the head of IT insists to decrypt the data to recover an important screenshot of server settings and passwords. They refuse to pay the ransom. The sysadmin left only the snapshot of the infected server.
It seems there is not much left to see. We’re reaching out to you, our best malware analyst, to help research and find a way to decrypt the screenshot.
RDP: hackaday2020-teamX-ransomware.eastasia.cloudapp.azure.com , X is your team number
After connecting via RDP to the machine, we can see another user named sysadmin by navigating around the file system. On that user desktop, the following are found :
- Ransomware affected file with extension HKADYYY
- Ransom note HKADYYY-README, containing a flag
hackaday{y0u_hAve_b33n_R@ns0meD!}
Ransomware Attack Again 2 (100 pts, 7 solves)
Description: Other than the ransom note, what other artefacts could you find?
By navigating the windows event logs, we notice a suspicious code snippet under powershell – large base64 payload (powershell with -e option).
The following two values are found by decoding the base64
- Caller script : . $prog -InV 'MTIzNDU2Nzg5MDEyMzQ1Ng=='
- Second flag
hackaday{wHo$_G0T_my_r@r1Sonn?!}
Ransomware Attack Again 3 (50 pts, 2 solves)
Description: sometimes there is public research on the ransomware behavior which may help you to decrypt the files. Try to surf the net!
A search online will not reveal much, until you check on Twitter, where you will find the following tweet.
The tweet contains the following link : https://0bin.net/paste/xBy4OoNz#0lSty7wpQSy2risE3g6X2Idj4HTNyhy6YaUgeWBmC0-
This 0bin.net post includes a small summary of the ransomware, a decryption routine, and the third flag hackaday{Blrdi3 w!th th3 g00d n@vvS}
Ransomware Attack Again 4 (300 pts, 0 solves)
Description: You are in the final step, tell me the content of the decrypted file!
According to the decryption routine, successful decryption requires two values :
- IV : Given by base64 string located in the loader : MTIzNDU2Nzg5MDEyMzQ1Ng==
- Key-seed : random two-digit and the SID (obtained by checking the user that executed the ransomware i.e. sysadmin)
00S-1-5-21-1580626154-3826959220-856111413-500 to 99S-1-5-21-1580626154-3826959220-856111413-500
The following decryption code is implemented with the IV and Key (two digit is 99):
$IV = "MTIzNDU2Nzg5MDEyMzQ1Ng=="
$Key = "ODgxM2QyOTU4ZjljODAzOGVjMDhiMjljYjFjODgzMGM="
$aesManaged = New-Object "System.Security.Cryptography.AesManaged"
$aesManaged.Mode = [System.Security.Cryptography.CipherMode]::CBC
$aesManaged.Padding = [System.Security.Cryptography.PaddingMode]::Zeros
$aesManaged.BlockSize = 128
$aesManaged.KeySize = 256
$aesManaged.IV = [System.Convert]::FromBase64String($IV)
$aesManaged.Key = [System.Convert]::FromBase64String($Key)
$decryptor = $aesManaged.CreateDecryptor();
$fileToDecrypt = "C:\path\to\encrypted\file.HKADYYY"
$encryptedFile = [System.IO.File]::ReadAllBytes($fileToDecrypt)
$bytes = $encryptedFile
$unencryptedData = $decryptor.TransformFinalBlock($bytes, 0, $bytes.Length);
[System.IO.File]::WriteAllBytes($fileToDecrypt,$unencryptedData)
Rename-Item -Path $fileToDecrypt -NewName ($fileToDecrypt.Substring(0, ($fileToDecrypt.Length - 8)))
$aesManaged.Dispose()
Using the routine to decrypt the file:
Decryption routine will reveal the final flag
hackaday{fr33d!fin@l1y~}
That’s is for this blog series, we hope you enjoyed reading and looking forward to seeing you at Hackaday 2021!
Feel free to contact us at [darklab dot cti at hk dot pwc dot com] for any further information.