Como ya os dije no tuvimos demasiado tiempo para participar en este CTF así que este es el último writeup que os puedo escribir sobre las pruebas que resolvimos.
Nos dan el siguiente enunciado:
Memory Analysis
Find the website that the fake svchost is accessing.
You can get the flag if you access the website!!
memoryanalysis.zip
The challenge files are huge, please download it first.
Hint1: http://www.volatilityfoundation.org/
Hint2: Check the hosts file
password: fjliejflsjiejlsiejee33cnc
Una vez más nos dan la parte de investigación casi completa, sabemos que es un dump de memoria y por el proceso svchost que se trata de un windows.
También nos dan la pista para que utilicemos volatility, una herramienta muy útil para este tipo de pruebas y que os recomiendo le echeis un vistazo si no la conocéis.
En este caso yo preferí salirme un poco por la tangente y probar un método que ya me había funcionado en otros tipos de pruebas de forense, y eso fue utilizar strings.
Para realizar los filtrados más rápido pase el resultado de strings a un archivo:
strings forensic_100.raw > forensic_100.strings
Pero, así no puedo buscar el nombre del archivo host ¿no? Con volatility podría haber buscado el proceso y extraer el archivo pero conociendo el contenido por defecto del archivo hosts busque la ip 127.0.0.1 e hice que grep me mostrara la linea a continuación para evitar falsos positivos; en caso de necesitar más información siempre podía ir ampliando el número de lineas:
grep -A 1 127.0.0.1 forensic_100.strings
El cual nos ofrece el siguiente resultado:
127.0.0.1 tIcfChangeNotificationDestroy -- 127.0.0.1 0,0,0,0,0,0 -- F127.0.0.1 + 0x%X -- 127.0.0.1 Unrecoverable memory allocation failure -- v127.0.0.1 255.240.0.0 -- 127.0.0.1 tIcfChangeNotificationDestroy -- 127.0.0.1 255.240.0.0 -- 127.0.0.1 0,0,0,0,0,0 -- 127.0.0.1 localhost 153.127.200.178 crattack.tistory.com attack.tistory.com -- 127.0.0.1 Unrecoverable memory allocation failure -- 127.0.0.1 tIcfChangeNotificationDestroy -- 127.0.0.1 255.240.0.0 -- 127.0.0.1 0,0,0,0,0,0 -- 127.0.0.1 localhost 153.127.200.178 crattack.tistory.com -- 127.0.0.1:1028 crattack-747355:0 -- 127.0.0.1:1033 svchost.exe:1320 -- 127.0.0.1:1900 svchost.exe:1036 -- 127.0.0.1:123 H49 t
Ahí podemos ver dos resultados muy interesantes apuntando crattack.tistory.com a la ip 153.127.200.178 , probamos a hacer otra búsqueda esta vez utilizando el dominio:
grep crattack.tistory.com forensic_100.strings
Que nos devuelve los siguientes resultados:
Host: crattack.tistory.com Referer: http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd Host: crattack.tistory.com Access-Control-Allow-Origin: http://crattack.tistory.com Host: crattack.tistory.com Host: crattack.tistory.com Host: crattack.tistory.com Host: crattack.tistory.com http://crattack.tistory.com/trackback/90W 153.127.200.178 crattack.tistory.com attack.tistory.com Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico Visited: SYSTEM@http://crattack.tistory.com/rss Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico \http://crattack.tistory.com/plugin/CallBack_bootstrapperSrc?nil_profile=tistory&nil_type=copied_post g;http://crattack.tistory.com/favicon.ico http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd C:\Program Files\Internet Explorer\iexplore.exe http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd C:\Program Files\Internet Explorer\iexplore.exe http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd 153.127.200.178 crattack.tistory.com http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd "C:\Program Files\Internet Explorer\iexplore.exe" http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico http://crattack.tistory.com/favicon.ico Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http:crattack.tistory.com http:crattack.tistory.com http:crattack.tistory.com http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd crattack.tistory.com crattack.tistory.com >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico http:crattack.tistory.com http:crattack.tistory.com http:crattack.tistory.com Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd :2016120620161207: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd :2016120620161207: SYSTEM@:Host: crattack.tistory.com :2016120620161207: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico ://crattack.tistory.com/favicon.ico tp://crattack.tistory.com/favicon.ico >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico w:2016120620161207: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico http://crattack.tistory.com/favicon.ico Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd ://crattack.tistory.com/favicon.ico w:2016120620161207: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico http:crattack.tistory.com http:crattack.tistory.com http:crattack.tistory.com http:crattack.tistory.com Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd tp://crattack.tistory.com/favicon.ico Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd http://crattack.tistory.com/favicon.ico crattack.tistory.com >Visited: SYSTEM@http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd crattack.tistory.com:http crattack.tistory.com
Parece que hemos encontrado la url que necesitamos, sabiendo que en lugar de apuntar a la dirección del DNS tenemos que utilizar la que encontramos anteriormente visitamos la siguiente web:
http://153.127.200.178/entry/Data-Science-import-pandas-as-pd
La cual nos descarga un archivo que al abrirlo nos muestra la siguiente flag:
SECCON{_h3110_w3_h4ve_fun_w4rg4m3_}
Quizás vuelva a resolver esta prueba utilizando volatility pero como veis, con solamente dos comandos básicos hemos conseguido resolverla sin mayor problema.
Este ha sido el último writeup de la SECCON de este año, como la plataforma sigue abierta, y si el tiempo me lo permite, intentaré terminar alguna de las otras pruebas que deje a medias y os mostraré como lo hice.
Como siempre, gracias por vuestra visita y un saludo!
