# Forensics - Artifacts of Dangerous Sightings

With this challenge we started with a disk image. Now, this image was a VHDX file. This just happens to be pretty much unsupported by Autopsy, the tool I really wanted to use for this. Now this caused me a quick headache but I got it working by using FTK Imager to mount the image on my machine and then open the mounted disk as a data source with Autopsy.

Now with it mounted I could let Autospy analyze the disk and I could poke around easier. After poking around for about 10 minutes I came across the ConsoleHost\_history.txt file. In here was the powershell command history... Very spicy.

It was indeed very spicy and had something called "finpayload" being hidden inside ActiveSyncProvider.dll.

<figure><img src="https://2826773145-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1uhiofTFnZvCKEvs4fJk%2Fuploads%2F7Bl3Jlk7gADP3R2taiGH%2FhtbCyberApoc23_Artifacts_of_blahblah1.PNG?alt=media&#x26;token=2e93d18f-5cde-4e16-8632-b23498f6a9da" alt=""><figcaption><p>In the bottom right you can see the text in the file (Powershell history)</p></figcaption></figure>

Now, because we had the whole disk, we can go grab that ActiveSyncProvider.dll file and extract whats in there. Easy Peasy.

<figure><img src="https://2826773145-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1uhiofTFnZvCKEvs4fJk%2Fuploads%2F6mLesqRkz3YAGmMAXdgn%2FhtbCyberApoc23_Artifacts_of_blahblah2.PNG?alt=media&#x26;token=793081d3-a913-4dd3-89fb-550b6eb4d510" alt=""><figcaption><p>LOTS of encoded powershell</p></figcaption></figure>

After extracting it we are left with so much encoded powershell. Yuck. Lets get it back into plaintext...

<figure><img src="https://2826773145-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1uhiofTFnZvCKEvs4fJk%2Fuploads%2FggVCWCjIdrTwhQUS68ZM%2FhtbCyberApoc23_Artifacts_of_blahblah3.PNG?alt=media&#x26;token=f9ce0515-8eb6-4280-a9a4-1f04362a5788" alt=""><figcaption><p>The decoded powershell</p></figcaption></figure>

<figure><img src="https://2826773145-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1uhiofTFnZvCKEvs4fJk%2Fuploads%2FfqXyzpgobzolWL5fFOjD%2Fmc-jugger-nuggets.gif?alt=media&#x26;token=b13bbbdc-c878-4042-9590-eabc66a20657" alt=""><figcaption><p>My honest reaction</p></figcaption></figure>

Ew. This is even grosser than the encoded powershell.

Where do I even start?

I didn't know, but after some googling I figured out what it was doing. It was starting by creating variables with values of 0, 1, 2, 3, etc. This was done with this section:

```powershell
${[~@} = $(); ${!!@!!]} = ++${[~@}; ${[[!} = --${[~@} + ${!!@!!]} + ${!!@!!]}; ${~~~]} = ${[[!} + ${!!@!!]}; ${[!![!} = ${[[!} + ${[[!}; ${(~(!} = ${~~~]} + ${[[!}; ${!~!))} = ${[!![!} + ${[[!}; ${((!} = ${!!@!!]} + ${[!![!} + ${[[!}; ${=!!@!!}  = ${~~~]} - ${!!@!!]} + ${!~!))}; ${!=} =  ${((!} - ${~~~]} + ${!~!))} - ${!!@!!]}; ${=@!~!} = "".("$(@{})"[14]+"$(@{})"[16]+"$(@{})"[21]+"$(@{})"[27]+"$?"[1]+"$(@{})"[3]); ${=@!~!} = "$(@{})"[14]+"$?"[3]+"${=@!~!}"[27]; ${@!=} = "["+"$(@{})"[7]+"$(@{})"[22]+"$(@{})"[20]+"$?"[1]+"]";
```

I didn't know it but apparently "++${\[\~@}" is equal to 1 in powershell. And each integer can be encoded in a similar, weird, way.

I got to this by using powershell ISE and putting a breakpoint at the end and then hovering over each variable to get their value. I would then go back to the saved text I had and find and replace all with the appropriate character/integer.

At the end of that I had this file:

{% file src="<https://2826773145-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1uhiofTFnZvCKEvs4fJk%2Fuploads%2Fck0uq7gEuaJh6uhk8cSR%2Ftranslated.txt?alt=media&token=53d95961-df13-468f-b992-cc0f5b0dde27>" %}
Almost done...
{% endfile %}

With this I could just change the iex at the end of the file to an echo and get the contents by running it. And thats what I did.

<figure><img src="https://2826773145-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1uhiofTFnZvCKEvs4fJk%2Fuploads%2F4ehmEIqvL46bfwEl49yR%2FhtbCyberApoc23_Artifacts_of_blahblahFlag.PNG?alt=media&#x26;token=e8120f55-7341-42ef-b5d1-0b403d8e3c35" alt=""><figcaption><p>The Flag!</p></figcaption></figure>

There's the flag! And here's the fully translated file:

{% file src="<https://2826773145-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F1uhiofTFnZvCKEvs4fJk%2Fuploads%2FyApBhyDFJU3DkgZBx47Q%2FfullyTranslated.txt?alt=media&token=a1017525-a8b1-4e9b-ac91-4639d65d134c>" %}

PWNED!!