背景

• 原始

You’re an agent with a government law enforcement agency. You’ve been tracking a group of criminal hackers known as “TufMups”. This group either keeps a low profile, your agency’s capacity to run investigations on the internet is very poor, or some combination of those two factors. Up until two days ago you had an active relationship with an informant who went by the handle “K3anu”. As you walked into your office you received a package containing a flash drive, a printed screenshot (at the top of this blog post) and a very short note. “Review this PCAP. It will all make sense. Woaaahhhh. – K3anu” That package was the last you heard from K3anu.

步骤

01 What is the start time of the PCAP (“Date and Time of Day” in CST setting in Wireshark round to nearest second)?

1

2017-12-11 06:43:17

02 What is the end time of the PCAP (“Date and Time of Day” in CST setting in Wireshark round to nearest second)?

1

2017-12-11 07:25:19

03 How many total packets were sent between the host and the hacker website IP?

Using the Endpoints screen we can quickly summarise the traffic sent between each IP address in the capture. We know from the provided screenshot that the server we are interested in has the IP address 104.131.112.255

By checking against our IP of interest we can see that 15,128 packets were exchanged.

1

15,128

04 What is the hostname of the system the PCAP was recovered from? (all caps)

We only have one DHCP request in our capture and it matches the IP address of our capturing system. Examining the packet details we find the hostname:

1

MSEDGEWIN10

05 What exact version of browser did K3anu use? (exact number only)

We can find the web browser user-agent string by filtering for HTTP requests made by K3anu’s system:

1

http and ip.src==10.0.2.15

Examining a request gives us the following string:

1

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

K3anu was using Chrome 63.0.3239.84

1

63.0.3239.84

06 What operating system did K3anu use? (Name and number only)

We already have the answer to this from Question 5:

1

Windows 10

07 How many DNS queries in the PCAP received NXdomain responses?

We can filter for DNS packets where the Response Code is set to 3, indicating that the domain did not exist.

1

dns.flags.rcode == 3

1

5 responses

08 – What is the hidden message in the TufMups website? (decoded)

If the TufMups website were still online we could simply visit it and take a look. Unfortunately it was offline when I did this CTF but we can use our network forensics skills to find out what it looked like.

By filtering on HTTP traffic between K3anu’s system and the TufMups server, and following the HTTP Stream (#2879), we can see the HTML source including an interesting comment.

1

ip.dst_host==104.131.112.255 and http

Follow the HTTP Stream

1

bH56Kml4b255Kmt4byp6O21tcyolKnhjem1lZHBl

From the character set this looks like base64, but decoding it only gives us:

1

l~z*ixony*kxo*z;mms*%*xczmedpe

Maybe it is encrypted rather as well as encoded. CyberChef has a collection of cipher functions that we can try, including an XOR Brute Force module. By default the module will attempt single-byte keys and display the output.

1

ftp creds are p1ggy / ripgonzo

09 What is the key to decode the secret message in the TufMups website?

From our work on Question 8 we know the key:

1

0a

10 How did K3anu get access to the file? (lowercase, just protocol)

The hidden message in the TufMups website mentions FTP credentials, so that is a good starting point. We can filter on FTP traffic, and follow the TCP Stream (#4075) for easier reading.

1

ftp

We can see that two files were downloaded to K3anu’s machine – decrypttool.exe and mupfullz2017.zip. Those are probably worth remembering for later.

1

ftp

11 What’s the nickname of the operator on the IRC channel?

Similarly, we can filter on IRC traffic and follow the TCP Stream (#2930) for easier reading.

1

ip.dst_host==104.131.112.255 and irc

IRC operators typically have @ before their nickname so they can be identified.

1

k3rm1t

12 What is the 1st operation needed to decode the IRC users “secure” comms? (just the format name)

Scrolling through the IRC chat between K3anu and the TufMups we see a few messages that stand out. With context from the questions, there are four steps required to make them legible.

1

MnIgMnEgMnIgMnIgMjAgMnEgMnEgMnEgMjAgMnIgMnEgMnIgMnIgMG4gMnEgMjAgMnIgMnIgMnIgMnIgMjAgMnIgMnIgMjAgMnIgMnIgMnIgMG4gMnEgMnIgMnIgMjAgMnIgMnIgMnEgMjAgMnEgMnIgMnIgMjAgMnIgMG4gMnIgMnIgMjAgMnIgMnIgMnIgMG4gMnIgMnEgMG4gMnEgMnIgMnEgMnIgMjAgMnEgMnEgMnEgMjAgMnIgMnEgMnEgMnIgMG4gMnIgMnIgMnEgMnIgMjAgMnEgMnEgMnEgMjAgMnIgMnEgMnIgMG4gMnIgMnIgMnIgMjAgMnIgMnIgMnEgMjAgMnIgMnEgMnIgMjAgMnI=

From the character set (and because it’s almost always the first thing I try) let’s assume base64 encoding.

1

base64

13 What is the 2nd operation needed to decode the IRC users “secure” comms? (just the format name)

Our result from Question 12 looks like Hex encoding, but the character set has been shifted. Using CyberChef we can easily apply rot13.

1

rot13

14 What is the 3rd operation needed to decode the IRC users “secure” comms? (just the format name)

1

hex

15 What is the 4th and final operation needed to decode the IRC users “secure” comms? (2 words lowercase)

1

LOL THIS DUDE IS A COP FOR SURE

It is obviously morse code.

1

morse code

Now that we know the required steps we can decode the remaining “secure” messages in the captured IRC chat.

1
2
3
4
5
6

LOL THIS DUDE IS A COP FOR SURE
LET'S PWN HIM AND FIND OUT WTF HES UP TO
HAHAHA FOR SURE
ALRIGHT I'LL GIVE HIM A FAKE LEAD AND PAYLOAD
HES A COP LETS KILL HIM AND DUMP HIM IN THE USUAL SPOT
WITH PLEASURE, ILL SEND ANIMAL

16 What is the password to decrypt the zip file that was downloaded by K3anu?

The TufMups have given K3anu a test – decrypt a file from their FTP server. In Question 10 we saw K3anu download two files from the TufMups FTP server; we need to extract them from the PCAP.

Filter on ftp-data to show the file transfer traffic, then follow the TCP Stream for the ZIP file (#4079)

1

ftp-data

Select the Raw radio button and Save As. We have our ZIP file, but we need a password to open it.

There are a few tools capable of cracking ZIP passwords; my goto is John The Ripper.

First, we use the zip2john utility to extract the hashed password from the ZIP.

1

zip2john ~/tufmups/mupfullz2017.zip > ~/tufmups/mupfullz2017.zip.hash

Then, use John with the RockYou wordlist to crack the extracted hash.

1

john --wordlist=/usr/share/wordlists/john.lst mupfullz2017.zip.hash

Return:

1
2
3
4
5
6
7
8

Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
fozzie           (mupfullz2017.zip/tufmups_fullz_dec17.csv)     
1g 0:00:00:00 DONE (2023-03-14 15:08) 11.11g/s 39400p/s 39400c/s 39400C/s 123456..sss
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 

Get the password:

1

fozzie

17 How many total rows of “fullz” are represented in the file?

After extracting the ZIP file we are presented with a CSV – tufmups_fullz_dec17.csv

We can check the number of lines in the file with a simple bash command

1
2

wc -l tufmups_fullz_dec17.csv
head -n 1 tufmups_fullz_dec17.csv

Subtracting one row to account for the column headers, we have 13377 rows of “fullz”.

1

13777

18 How many people in the fullz are named Joshua, have a MasterCard, and use an OS X system?

This can be solved with a bit more command-line work; using grep to filter only the characteristics we are looking for, and wc to count the matching rows.

1

cat tufmups_fullz_dec17.csv | grep -i "joshua" | grep -i "mastercard" | grep -i "os x" | wc -l

1

12

19 What IP and port does the executable connect to? ip:port

Remember K3anu downloaded decrypttool.exe from the FTP server as well as the ZIP file? And how the TufMups were going to feed some false data to confirm their suspicions? We’re getting back to that now.

Using the same technique as for Question 16, we can extract decrypttool.exe from the PCAP (TCP Stream #4077)

1
2
3
4
5

file decrypttool.exe 
decrypttool.exe: PE32+ executable (console) x86-64, for MS Windows

md5sum decrypttool.exe 
20422a060c5f8ee5e2c3ba3329de514f  decrypttool.exe

Run this program in windows and using wireshark to analyze its traffic.

1

104.131.112.255:1234

20 What was used to compile the malicious executable?

The icon of this program is related to python.

1

pyinstaller

21 What executable did K3anu likely use to download files from the remote server? (exactly as written in source material)

We know that the TufMups found out about K3anu’s real identity, and that K3anu downloaded an executable that connects back to the TufMups server on an unusual port. Let’s see if there is anything in the PCAP to shed light on what the TufMups found.

Filter for traffic on the IP address and source used by the TufMups binary.

1

ip.addr == 104.131.112.255 && tcp.port == 1234

Follow the TCP Stream (#4082) for easier reading. Our malicious binary is acting as a reverse shell into K3anu’s machine!

Reading through the stream we can see a list of running processes. Based on the process names, the only dedicated FTP client is WinSCP.exe

1

WinSCP.exe

22 What is the host system’s exact BIOS version?

We can use the same TCP Stream (#4082) to answer the next few questions as well. The output of the systeminfo command lists the exact BIOS version.

1

innotek GmbH VirtualBox, 12/1/2006

23 What is the filename of the first file taken from K3anu’s computer?

1

C:\Users\IEUser\Desktop\trueidentity.zip

24 What is the filename of the second file taken from K3anu’s computer?

1

C:\Users\IEUser\Desktop\trueidpwhelp.zip

25 What utility was used to steal the files from K3anu’s computer?

1

ncat

26 What destination port was used to steal the files from K3anu’s computer?

1

1235

27 What is the password to decrypt the file stolen from K3anu’s computer? (lowercase)

There were two ZIP files transferred from K3anu’s machine – trueidentity.zip and trueidpwhelp.zip – extract them both from the PCAP using the same technique as Question 16 and Question 19.

I started with trueidpwhelp.zip (#4785) – which didn’t require a password – and contained two images of airports. The Comment field in the EXIF data gave a clue.

1

use the letters of these acronyms to form a word Skull

My guess was that the IATA airport codes for the respective images would lead to the password for trueidentity.zip(#4780), but I don’t have time for OSINT. Let’s try cracking the password first.

Same procedure as Question 16. First run zip2john to extract the hash, then john itself to perform the cracking.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

zip2john trueidentity.zip > trueidentity.zip.hash
john --wordlist=rockyou.txt trueidentity.zip.hash 
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
molder           (trueidentity.zip)     
1g 0:00:00:00 DONE (2023-03-14 17:03) 100.0g/s 13107Kp/s 13107Kc/s 13107KC/s Dominic1..kovacs
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

Now we get the password:

1

molder

28 What is K3anu’s real identity?

1

My true identity is constantine, eternal enemy of Kermit the frog AKA k3rm17 of TufMups.

29 The hacker left a message for law enforcement on K3anu’s system, what was it? (message only)

Reading to the end of the traffic sent by decrypttool.exe (TCP Stream #4082) we can see the final message left for the investigators.

1

yeah good luck finding this guy cops, great job picking an informant.. real winner with his grilled cheese

References

• https://www.petermstewart.net/tufmups-network-forensics-challenge-write-up/