mbcoin [HackTheBox Forensics Challenge]
This challenge provide a phishing document with VBA macros that drop a VB script to disk and run it. The script tries to download and decode DLLs from five different webservers. We'll carve those files from the given PCAP and decode them, finding the DLL that provides the flag.
Challenge available here (must be logged in to HTB): https://app.hackthebox.com/challenges...
This challenge was based on a couple real world phishing campaigns.
VBA to VB to PowerShell based on SquirrelWaffle phishing document: https://www.malware-traffic-analysis....
The phishing lure text roughly based on: https://www.trendmicro.com/vinfo/hk-e...
[00:00] Intro
[00:56] Challenge Overview
[01:50] Strategy for starting with document
[02:08] Looking at VBA macros in .doc file with olevba from Linux
[05:11] Recovering VB strings from alt text using strings command
[06:39] Switching to Windows, opening document in Word
[07:20] Viewing macros in Macro Editor, adding comment to block final script run, getting VB script by running
[08:29] Getting VB from image alt text using Word
[08:50] Analysis of dropped VB script
[16:30] Starting notes about different URLs downloaded from
[17:45] Getting information about downloads from PCAP in Wireshark
[21:05] Exporting downloaded blobs from Wireshark
[22:40] Back to Linux, using Python to decrypt download into DLL
[27:20] Collecting flag using strings on Linux
[27:24] Running DLL on Windows to get flag
[28:04] Summary
In questa pagina del sito puoi guardare il video online mbcoin [HackTheBox Forensics Challenge] della durata di ore minuti seconda in buona qualità , che l'utente ha caricato 0xdf 25 agosto 2022, condividi il link con amici e conoscenti, su youtube questo video è già stato visto 952 volte e gli è piaciuto 47 spettatori. Buona visione!
