FFModule

Platform: HackTheBox | Category: Reversing | Type: Challenge | Difficulty: Medium | OS: Windows | Author: D3v0o0Nu11 | Date: 2022-11-08 | Status: Solved Techniques: crc32_api_hash_resolution, custom_transform_reversal, firefox_pr_write_hook_analysis, shellcode_unpacking, static_flag_recovery

Summary

Task: A Windows PE loader injects XOR-decoded shellcode into Firefox, where it hooks NSS networking code to steal plaintext POST data before TLS encryption. Solution: Reverse the injector and shellcode, identify the custom rolling transform used for UDP exfiltration, and apply the same routine to the embedded marker to recover the flag.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: HackTheBox | ID: 20221108_hackthebox_ffmodule
• Tags: firefox, xor, windows, pe32, shellcode, process_injection, api_hashing, crc32c, nss3, udp_exfiltration
• Indicators: XOR-decoded blob injected into firefox.exe, CreateRemoteThread + WriteProcessMemory injection chain, CRC32C-based API resolution in shellcode, hook checks for outgoing buffer starting with POST, nss3.dll / PR_Write targeting
• Source: 20221108_hackthebox_ffmodule.md

Foothold

Vulnerability / Misconfiguration

1. Crc32_api_hash_resolution
2. Custom_transform_reversal
3. Firefox_pr_write_hook_analysis
4. Shellcode_unpacking
5. Static_flag_recovery

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• crc32_api_hash_resolution
• custom_transform_reversal
• firefox_pr_write_hook_analysis
• shellcode_unpacking
• static_flag_recovery
• Tags: firefox, xor, windows, pe32, shellcode, process_injection, api_hashing, crc32c, nss3, udp_exfiltration

Original Writeup

<details><summary>Click to expand original content</summary>

Description

The challenge provides ffmodule.exe, a 64-bit Windows console executable presented as a Firefox hooking module. The goal is to understand what the injected payload does and recover the hidden flag from the malware logic.

Analysis

main prints Running Firefox (105.0.1) Hooking Module and decodes the first 0x5a4 bytes of its .data section with XOR key 0x72. The decoded blob is x64 shellcode that gets injected into firefox.exe through the standard remote injection sequence: CreateToolhelp32Snapshot, Process32First, Process32Next, OpenProcess, VirtualAllocEx, WriteProcessMemory, VirtualProtectEx, and CreateRemoteThread.

Inside the shellcode, APIs are resolved dynamically with CRC32C hashing. The resolver walks the export table and matches GetProcAddress by hash 0x43aac47d, then resolves helpers such as VirtualAlloc and VirtualProtect. It also searches for Firefox NSS libraries by hashed names and locates PR_Write, which is the function chosen for hooking.

The hook activates only when the outgoing buffer begins with POST, which means the malware intercepts plaintext HTTP POST bodies before Firefox passes them into the TLS layer. Stolen data is then obfuscated with a custom 32-byte rolling transform and sent out with sendto() over UDP to 127.0.0.1:1337.

The same transform is also applied to an embedded 16-byte 0xff marker. Reversing that routine yields the flag directly.

Solution

1. Open ffmodule.exe and identify the .data decode loop using XOR key 0x72.
2. Extract and decode the first 0x5a4 bytes to obtain the shellcode.
3. Disassemble the shellcode and follow the export-hash resolver to confirm GetProcAddress, VirtualAlloc, VirtualProtect, NSS module discovery, and the PR_Write hook.
4. Notice the POST comparison at the start of the hook, showing the payload only steals outgoing plaintext form data.
5. Reconstruct the rolling byte transform used before sendto().
6. Apply that same transform to the embedded 16 * 0xff marker to reveal the flag.

#!/usr/bin/env python3

FLAG = b"HTB{REDACTED}"

def main():
    print(FLAG.decode())

if __name__ == "__main__":
    main()

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR