search

Forensics - Relic Maps

Hack the Box Cyber Apocalypse CTF 2023, Relic Maps Forensics Challenge Writeup

We started off with a file download. This file is a Microsoft OneNote attachment, all the rage for phishing a few months ago (and still a bit today). I immediately went and dropped it into CyberChef so I can mess with it.

The first thing I ran on it was strings and tada! We got the commands that would execute if you enabled it.

relicmaps.one strings

In the commands run we see two main parts. Both are similar, with the usage of powershell to download a file and then running the file. The main one of interest for this is the windows.bat file that gets renamed to system32.bat.

If we download the file from the link we get this:

window.bat contents

In the contents we can see it declaring a ton of variables and then combining them to create commands that will actually run. To make this readable I used sublime to edit out junk and created a python version of it and had it print it out to me.

Using this I got the commands being run on the system. From that I gathered it was trying to hide that it was running powershell commands by copying the powershell executable and using the copy instead. With powershell it was then decrypting an AES encrypted payload decompressing it from GZip and then running it. I modified the powershell to try to print this out so I could see what the payload was but it kept breaking.

To fix this I had it print the contents to a output.gz file like this:

Decrypting the payload

Once I had it saved I threw it into CyberChef and got the flag!

Flag in CyberChef

PWNED!!

PreviousMisc - PersistenceNextForensics - Artifacts of Dangerous Sightings

Last updated