mbcoin [HackTheBox Forensics Challenge]
This challenge provide a phishing document with VBA macros that drop a VB script to disk and run it. The script tries to download and decode DLLs from five different webservers. We'll carve those files from the given PCAP and decode them, finding the DLL that provides the flag.
Challenge available here (must be logged in to HTB): https://app.hackthebox.com/challenges...
This challenge was based on a couple real world phishing campaigns.
VBA to VB to PowerShell based on SquirrelWaffle phishing document: https://www.malware-traffic-analysis....
The phishing lure text roughly based on: https://www.trendmicro.com/vinfo/hk-e...
[00:00] Intro
[00:56] Challenge Overview
[01:50] Strategy for starting with document
[02:08] Looking at VBA macros in .doc file with olevba from Linux
[05:11] Recovering VB strings from alt text using strings command
[06:39] Switching to Windows, opening document in Word
[07:20] Viewing macros in Macro Editor, adding comment to block final script run, getting VB script by running
[08:29] Getting VB from image alt text using Word
[08:50] Analysis of dropped VB script
[16:30] Starting notes about different URLs downloaded from
[17:45] Getting information about downloads from PCAP in Wireshark
[21:05] Exporting downloaded blobs from Wireshark
[22:40] Back to Linux, using Python to decrypt download into DLL
[27:20] Collecting flag using strings on Linux
[27:24] Running DLL on Windows to get flag
[28:04] Summary
On this page of the site you can watch the video online mbcoin [HackTheBox Forensics Challenge] with a duration of hours minute second in good quality, which was uploaded by the user 0xdf 25 August 2022, share the link with friends and acquaintances, this video has already been watched 952 times on youtube and it was liked by 47 viewers. Enjoy your viewing!
