Тот сайт с GitHub (That site from GitHub)

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-26 | Status: Solved Techniques: Base64 decoding of hidden payloads, ELF binary strings analysis, Embedded binary extraction from scripts, Suspicious shell script analysis

Summary

Task: Analyze a suspicious website archive cloned from GitHub. Solution: Found hidden malicious code in update.sh script (97KB with empty lines hiding base64-encoded Python that creates and executes a hidden ELF binary), extracted the binary and found the flag using strings.

Тот сайт с GitHub — hackerlab

Description

"Я взял за основу один сайт с GitHub. Мне понравился дизайн, осталось только его немного обновить"

(I took one site from GitHub as a base. I liked the design, just need to update it a bit)

Archive: task.zip

Analysis

Step 1: Examining the Archive

 bash read-only • copy allowed Copy
unzip task.zip
ls -la

Archive contents:

• HTML files (index.html and others)
• CSS styles
• JPG images
• update.sh — suspiciously large script (97KB!)

Step 2: Analyzing update.sh

 bash read-only • copy allowed Copy
ls -la update.sh
# -rw-r--r--  1 user  staff  97280 Dec 26 12:00 update.sh
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

head -20 update.sh

The script looks like a simple loading animation:

 bash read-only • copy allowed Copy
#!/bin/bash
echo "Updating..."
# ... loading animation code ...

But 97KB for such a script is a clear red flag!

Step 3: Finding Hidden Content

 bash read-only • copy allowed Copy
# Check the number of lines
wc -l update.sh
# 1500+ lines

# Find non-empty lines
grep -v '^$' update.sh | tail -20

Among hundreds of empty lines, a hidden command was discovered:

 bash read-only • copy allowed Copy
echo "aW1wb3J0IG9zCmltcG9ydCBzeXMKCmJ5dGVfYXJyYXkgPSBb..." | base64 -d | python3

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 4: Decoding Base64

 bash read-only • copy allowed Copy
echo "aW1wb3J0IG9zCmltcG9ydCBzeXMKCmJ5dGVfYXJyYXkgPSBb..." | base64 -d

Result — a Python script:

 python read-only • copy allowed Copy
import os
import sys

byte_array = [
    0x7f, 0x45, 0x4c, 0x46,  # ELF magic bytes
    0x02, 0x01, 0x01, 0x00,
    # ... thousands of bytes ...
]

# Create hidden ELF file
with open('.hehe.elf', 'wb') as f:
    f.write(bytes(byte_array))

# Make executable and run
os.chmod('.hehe.elf', 0o755)
os.system('.hehe.elf')

Step 5: Extracting the Binary

 python read-only • copy allowed Copy
#!/usr/bin/env python3
# extract_elf.py
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

byte_array = [
    0x7f, 0x45, 0x4c, 0x46,
    # ... (copy the array from the decoded script)
]

with open('hidden.elf', 'wb') as f:
    f.write(bytes(byte_array))

print(f"Extracted: hidden.elf ({len(byte_array)} bytes)")

 bash read-only • copy allowed Copy
python3 extract_elf.py
file hidden.elf
# hidden.elf: ELF 64-bit LSB executable, x86-64

Step 6: Finding the Flag

 bash read-only • copy allowed Copy
strings hidden.elf | grep -i codeby

Solution

Complete script to extract the flag:

 bash read-only • copy allowed Copy
#!/bin/bash

# 1. Find base64 string in update.sh
B64=$(grep -v '^$' update.sh | grep 'base64 -d' | sed 's/.*echo "\([^"]*\)".*/\1/')
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# 2. Decode the Python script
echo "$B64" | base64 -d > hidden_script.py

# 3. Extract byte_array and create ELF
python3 << 'EOF'
import re

with open('hidden_script.py', 'r') as f:
    content = f.read()

# Extract byte array
match = re.search(r'byte_array\s*=\s*\[([\s\S]*?)\]', content)
if match:
    bytes_str = match.group(1)
    # Parse hex values
    hex_values = re.findall(r'0x[0-9a-fA-F]+', bytes_str)
    byte_data = bytes([int(x, 16) for x in hex_values])
    
    with open('hidden.elf', 'wb') as f:
        f.write(byte_data)
    print(f"Extracted {len(byte_data)} bytes to hidden.elf")
EOF
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# 4. Find the flag
strings hidden.elf | grep -E 'CODEBY\{.*\}'

Conclusions

This task demonstrates a real supply chain attack technique:

1. Attacker clones a popular repository
2. Adds an "update" script with malicious code
3. Code is hidden among empty lines
4. When executed, a hidden binary is created and run

Lesson: Always review scripts before running them, especially from untrusted sources! ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍