mbcoin [HackTheBox Forensics Challenge]
This challenge provide a phishing document with VBA macros that drop a VB script to disk and run it. The script tries to download and decode DLLs from five different webservers. We'll carve those files from the given PCAP and decode them, finding the DLL that provides the flag.
Challenge available here (must be logged in to HTB): https://app.hackthebox.com/challenges...
This challenge was based on a couple real world phishing campaigns.
VBA to VB to PowerShell based on SquirrelWaffle phishing document: https://www.malware-traffic-analysis....
The phishing lure text roughly based on: https://www.trendmicro.com/vinfo/hk-e...
[00:00] Intro
[00:56] Challenge Overview
[01:50] Strategy for starting with document
[02:08] Looking at VBA macros in .doc file with olevba from Linux
[05:11] Recovering VB strings from alt text using strings command
[06:39] Switching to Windows, opening document in Word
[07:20] Viewing macros in Macro Editor, adding comment to block final script run, getting VB script by running
[08:29] Getting VB from image alt text using Word
[08:50] Analysis of dropped VB script
[16:30] Starting notes about different URLs downloaded from
[17:45] Getting information about downloads from PCAP in Wireshark
[21:05] Exporting downloaded blobs from Wireshark
[22:40] Back to Linux, using Python to decrypt download into DLL
[27:20] Collecting flag using strings on Linux
[27:24] Running DLL on Windows to get flag
[28:04] Summary
Auf dieser Seite können Sie das Online-Video mbcoin [HackTheBox Forensics Challenge] mit der Dauer stunde minuten sekunde in guter Qualität ansehen, das der Benutzer 0xdf 25 August 2022 hochgeladen hat, den Link mit Freunden und Bekannten teilen, dieses Video wurde auf Youtube bereits 952 Mal angesehen und es wurde von 47 den Zuschauern gefallen. Viel Spaß beim Betrachtenden Zuschauern gefallen!
