{"id":782,"date":"2023-04-27T00:27:43","date_gmt":"2023-04-26T15:27:43","guid":{"rendered":"https:\/\/emeth.jp\/diary\/?p=782"},"modified":"2024-08-10T14:38:13","modified_gmt":"2024-08-10T05:38:13","slug":"ricerca-ctf-2023-writeup-forensics","status":"publish","type":"post","link":"https:\/\/emeth.jp\/diary\/2023\/04\/ricerca-ctf-2023-writeup-forensics\/","title":{"rendered":"Ricerca CTF 2023 writeup (forensics)"},"content":{"rendered":"\n<p>\u53c2\u52a0\u3057\u30661\u554f\u89e3\u304d\u307e\u3057\u305f\u3002<\/p>\n\n\n\n<!--more-->\n\n\n\n<h2 class=\"wp-block-heading\">[forensics] My name is Power! (257pt)<\/h2>\n\n\n\n<p>\u5c55\u958b\u3059\u308b\u30684.5GB\u306e<code>memory.raw<\/code>\u30d5\u30a1\u30a4\u30eb\u3002<br>\u306a\u3093\u3060\u304b\u308f\u304b\u3089\u306a\u3044\u304c\u3001\u3068\u308a\u3042\u3048\u305a\u30e1\u30e2\u30ea\u30d5\u30a9\u30ec\u30f3\u30b8\u30c3\u30af\u3068\u8a00\u3048\u3070<a href=\"https:\/\/github.com\/volatilityfoundation\/volatility3\" target=\"_blank\" rel=\"noopener\" title=\"Volatility\">Volatility<\/a>\u3068\u3044\u3046\u3053\u3068\u3067\u3084\u3063\u3066\u307f\u308b\u3002<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n$ vol3 -f memory.raw windows.info\nVolatility 3 Framework 2.4.2\nProgress:  100.00               PDB scanning finished\nVariable        Value\n\nKernel Base     0xf80648600000\nDTB     0x1ae000\nSymbols file:\/\/\/home\/tkito\/volatility3\/volatility3\/symbols\/windows\/ntkrnlmp.pdb\/797E613DB16DB6C0E57795A0CB03F471-1.json.xz\nIs64Bit True\nIsPAE   False\nlayer_name      0 WindowsIntel32e\nmemory_layer    1 FileLayer\nKdVersionBlock  0xf806492099b8\nMajor\/Minor     15.22621\nMachineType     34404\nKeNumberProcessors      4\nSystemTime      2023-04-18 08:45:26\nNtSystemRoot    C:\\Windows\nNtProductType   NtProductWinNt\nNtMajorVersion  10\nNtMinorVersion  0\nPE MajorOperatingSystemVersion  10\nPE MinorOperatingSystemVersion  0\nPE Machine      34404\nPE TimeDateStamp        Tue Aug 10 18:00:02 1982\n<\/pre><\/div>\n\n\n<p>Windows 10\u3068\u3044\u3046\u3053\u3068\u3067\u307b\u3063\u3068\u4e00\u5b89\u5fc3\u3002Windows\/Linux\/Mac\u3058\u3083\u306a\u304b\u3063\u305f\u3089\u3069\u3046\u3057\u3088\u3046\u304b\u3068\u3002<\/p>\n\n\n\n<p>Windows\u3068\u308f\u304b\u3063\u305f\u306e\u3067\u3001\u602a\u3057\u3044\u3084\u3064\u304c\u3044\u306a\u3044\u304b\u898b\u3066\u3044\u3053\u3046\u3002<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n$ vol3 -f memory.raw windows.pstree\nVolatility 3 Framework 2.4.2\nProgress:  100.00               PDB scanning finished\nPID     PPID    ImageFileName   Offset(V)       Threads Handles SessionId       Wow64   CreateTime      ExitTime\n\n...snip...\n\n*** 748 640     winlogon.exe    0xd38576750080  3       -       1       False   2023-04-18 08:36:17.000000      N\/A\n**** 952        748     fontdrvhost.ex  0xd385768630c0  5       -       1       False   2023-04-18 08:36:18.000000      N\/A\n**** 4344       748     userinit.exe    0xd38577cc1080  0       -       1       False   2023-04-18 08:36:24.000000      2023-04-18 08:36:54.000000\n***** 4384      4344    explorer.exe    0xd38577cd9080  71      -       1       False   2023-04-18 08:36:24.000000      N\/A\n****** 5472     4384    OneDrive.exe    0xd38579656080  22      -       1       False   2023-04-18 08:36:45.000000      N\/A\n****** 2468     4384    VBoxTray.exe    0xd3857998a080  13      -       1       False   2023-04-18 08:36:44.000000      N\/A\n****** 4484     4384    SecurityHealth  0xd3857997e080  2       -       1       False   2023-04-18 08:36:43.000000      N\/A\n****** 2788     4384    cmd.exe 0xd385741eb140  2       -       1       False   2023-04-18 08:37:55.000000      N\/A\n******* 5536    2788    winpmem_mini_x  0xd3857af020c0  3       -       1       False   2023-04-18 08:45:12.000000      N\/A\n******* 2900    2788    conhost.exe     0xd385741ed140  4       -       1       False   2023-04-18 08:37:55.000000      N\/A\n****** 4688     4384    regedit.exe     0xd38571e42140  3       -       1       False   2023-04-18 08:39:38.000000      N\/A\n****** 6772     4384    cmd.exe 0xd3857ae980c0  2       -       1       False   2023-04-18 08:44:16.000000      N\/A\n******* 1460    6772    conhost.exe     0xd38579426080  6       -       1       False   2023-04-18 08:44:16.000000      N\/A\n******* 2068    6772    powershell.exe  0xd3857a35e080  20      -       1       False   2023-04-01 08:44:54.000000      N\/A\n**** 724        748     LogonUI.exe     0xd3857698d1c0  0       -       1       False   2023-04-18 08:36:18.000000      2023-04-18 08:36:31.000000\n**** 1028       748     dwm.exe 0xd3857694c080  18      -       1       False   2023-04-18 08:36:18.000000      N\/A\n<\/pre><\/div>\n\n\n<p>explorer.exe\u306e\u5b50\u30d7\u30ed\u30bb\u30b9\u3092\u898b\u3066\u3044\u304f\u3002<br><code>OneDrive.exe<\/code>\u3084<code>VBoxTray.exe<\/code>\u3001<code>SecurityHealth(Systray.exe)<\/code>\u306f\u7279\u306b\u5909\u306a\u3082\u306e\u3067\u306f\u306a\u3044\u3002<br><code>cmd.exe<\/code>\u304b\u3089\u306e<code>winpmem_mini_x<\/code>\u306f\u3053\u306e\u30e1\u30e2\u30ea\u30a4\u30e1\u30fc\u30b8\u3092\u53d6\u5f97\u3057\u305f<a href=\"https:\/\/github.com\/Velocidex\/WinPmem\" target=\"_blank\" rel=\"noopener\" title=\"WinPmem\">WinPmem<\/a>\u306e\u30d7\u30ed\u30bb\u30b9\u3067\u3042\u308d\u3046\u3002<br>\u6b8b\u308bregedit.exe\u3068cmd.exe\u304b\u3089\u306epowershell.exe\u306f\u554f\u984c\u306a\u3044\u3068\u306f\u8a00\u3048\u306a\u3044\u306e\u3067\u3001\u3053\u306e\u8fba\u3092\u8a73\u3057\u304f\u898b\u3066\u3044\u3063\u305f\u65b9\u304c\u3088\u3055\u305d\u3046\u3002<br>regedit.exe\u306fGUI\u306a\u306e\u3067\u5f8c\u56de\u3057\u306b\u3057\u3066\u3001powershell.exe\u306b\u3064\u3044\u3066\u8a73\u3057\u304f\u77e5\u308b\u305f\u3081\u3001\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u3092\u53d6\u5f97\u3057\u3066\u307f\u308b\u3002<\/p>\n\n\n\n<p>\u203bMarkdown\u3067\u30e1\u30e2\u53d6\u3063\u3066\u305f\u3089Windows Defender\u306b\u6012\u3089\u308c\u305f\u306e\u3067\u3001\u3053\u3053\u304b\u3089\u306f\u753b\u50cf\u3067\u3002<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-1.png\"><img loading=\"lazy\" decoding=\"async\" width=\"928\" height=\"457\" src=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-1.png\" alt=\"\" class=\"wp-image-785\" srcset=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-1.png 928w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-1-300x148.png 300w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-1-768x378.png 768w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-1-624x307.png 624w\" sizes=\"auto, (max-width: 928px) 100vw, 928px\" \/><\/a><\/figure>\n<\/div>\n\n\n<p>\u660e\u3089\u304b\u306b\u602a\u3057\u3044\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u3002\u4ee5\u4e0b\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u306e\u7c21\u5358\u306a\u89e3\u8aac\u3002<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>pOwERsHEll<\/code>\n<ul class=\"wp-block-list\">\n<li>Windows\u306e\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u3067\u306f\u5927\u6587\u5b57\u5c0f\u6587\u5b57\u3092\u533a\u5225\u3057\u306a\u3044\u306e\u3067\u8981\u3059\u308b\u306b<code>powershell<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><code>-eP bYpASs ( = -ep bypass)<\/code>\n<ul class=\"wp-block-list\">\n<li><code>-ep<\/code>\u306f<code>-ExecutionPolicy<\/code>\u306e\u7565\u3002<code>Bypass<\/code>\u3067\u4f55\u306e\u5236\u7d04\u3082\u306a\u304f\u5b9f\u884c\u3067\u304d\u308b\u3002<br>\u8a73\u3057\u304f\u306f<a href=\"https:\/\/learn.microsoft.com\/ja-jp\/powershell\/module\/microsoft.powershell.core\/about\/about_execution_policies?view=powershell-5.1\" target=\"_blank\" rel=\"noopener\" title=\"\u5b9f\u884c\u30dd\u30ea\u30b7\u30fc\u306b\u3064\u3044\u3066 - PowerShell | Microsoft Learn\">\u5b9f\u884c\u30dd\u30ea\u30b7\u30fc\u306b\u3064\u3044\u3066 &#8211; PowerShell | Microsoft Learn<\/a>\u3092\u53c2\u7167\u3002<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><code>-e JgAg...<\/code>\n<ul class=\"wp-block-list\">\n<li><code>-e<\/code>\u306f\u4ee5\u964d\u306e\u6587\u5b57\u5217\u3092Base64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u30b3\u30de\u30f3\u30c9\u5217\u3068\u307f\u306a\u3059\u3002\u8981\u3059\u308b\u306b\u5f8c\u308d\u306e\u6587\u5b57\u5217\u3092Base64\u3067\u3067\u30b3\u30fc\u30c9\u3059\u308c\u3070\u5b9f\u884c\u3057\u3088\u3046\u3068\u3057\u3066\u3044\u308b\u30b3\u30de\u30f3\u30c9\u304c\u51fa\u3066\u304f\u308b\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p>\u3068\u3044\u3046\u308f\u3051\u3067Base64\u30c7\u30b3\u30fc\u30c9\u3057\u3066\u307f\u308b\u3002<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><a href=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-2.png\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"606\" src=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-2-1024x606.png\" alt=\"\" class=\"wp-image-787\" srcset=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-2-1024x606.png 1024w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-2-300x178.png 300w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-2-768x455.png 768w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-2-624x370.png 624w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-2.png 1528w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n<\/div>\n\n\n<p><code>$PSHOME<\/code>\u306f\u901a\u5e38\u306e\u74b0\u5883\u3060\u3068<code>'C:\\Windows\\System32\\WindowsPowerShell\\v1.0'<\/code>\u306a\u306e\u3067\u3001<code>$PsHOme[4]+$psHoME[34]+'X'<\/code>\u306f<code>'iex'<\/code>\u306b\u306a\u308b\u3002<br><code>iex<\/code>\u306f<code>Invoke-Expression<\/code>\u306e\u30a8\u30a4\u30ea\u30a2\u30b9\u3067\u3001\u30d1\u30e9\u30e1\u30fc\u30bf\u3068\u3057\u3066\u6e21\u3055\u308c\u305f\u6587\u5b57\u5217\u3092PowerShell\u30b3\u30de\u30f3\u30c9\u3068\u3057\u3066\u5b9f\u884c\u3059\u308b\u30b3\u30de\u30f3\u30c9\u30ec\u30c3\u30c8\u3067\u3042\u308b\u3002<\/p>\n\n\n\n<p>&lt;\u4f59\u8ac7&gt;<br>\u3053\u3053\u3067\u3001\u3053\u306e\u6b21\u306e\u30b9\u30c6\u30c3\u30d7\u306b\u9032\u3080\u305f\u3081\u306biex\u306e\u5f8c\u308d\u306e\u30b3\u30fc\u30c9\u3067\u3084\u3063\u3066\u3044\u308b\u3053\u3068\u3092CyberChef\u3067\u518d\u73fe\u3057\u3088\u3046\u3068&#8221;From Base64&#8243;\u2192&#8221;Raw Deflate&#8221;\u3067\u3084\u308d\u3046\u3068\u3057\u3066\u3082\u3046\u307e\u304f\u3044\u304b\u306a\u304f\u3066\u4e00\u6557\u3002\u6b63\u3057\u304f\u306fDeflate\u3067\u306f\u306a\u304fInflate\u3002Deflate\u3067\u5c55\u958b\u3068\u601d\u3044\u8fbc\u3093\u3067\u3057\u307e\u3063\u3066\u8ca0\u3051\u3002<br>&lt;\/\u4f59\u8ac7&gt;<\/p>\n\n\n\n<p><code>iex<\/code>\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u306f\u6587\u5b57\u5217\u306a\u306e\u3067\u3001<code>iex<\/code>\u306e\u5f8c\u308d\u3092\u5b9f\u884c\u3059\u308c\u3070\u6587\u5b57\u5217\u304c\u51fa\u3066\u304f\u308b\u306f\u305a\u3067\u3042\u308b\u3002\u3068\u3044\u3046\u308f\u3051\u3067PowerShell\u306b\u5165\u308c\u3066\u5b9f\u884c\u3055\u305b\u308c\u3070\u3088\u3044\u3002\u306a\u304a\u3001\u3053\u306e\u30b9\u30c6\u30c3\u30d7\u306e\u307fWindows Defender\u3067\u30d6\u30ed\u30c3\u30af\u3055\u308c\u308b\u306e\u3067\u3001\u3053\u306e\u624b\u6cd5\u3067\u3084\u308a\u305f\u3044\u5834\u5408\u306f\u5229\u3042\u308a\u30bf\u30a4\u30e0\u4fdd\u8b77\u3092\u30aa\u30d5\u306b\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u3002<br>CyberChef\u3067\u3061\u3083\u3093\u3068Inflate\u3092\u9078\u3093\u3067\u3044\u308c\u3070\u305d\u3063\u3061\u3067\u3082\u3088\u3044\u3002<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><a href=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-5.png\"><img loading=\"lazy\" decoding=\"async\" width=\"830\" height=\"1024\" src=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-5-830x1024.png\" alt=\"\" class=\"wp-image-791\" srcset=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-5-830x1024.png 830w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-5-243x300.png 243w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-5-768x947.png 768w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-5-624x770.png 624w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-5.png 925w\" sizes=\"auto, (max-width: 830px) 100vw, 830px\" \/><\/a><\/figure>\n<\/div>\n\n\n<p>\u308f\u304b\u308a\u306b\u304f\u3044\u304c<code>reaDtoEND()<\/code>\u306e\u6b21\u306e\u884c\u304b\u3089\u304c\u51fa\u529b\u3067\u3042\u308b\u3002<br>\u5192\u982d\u306e<code>$vErbOsePrEFeReNcE<\/code>\u306f<code>'SilentlyContinue'<\/code>\u306a\u306e\u3067\u3001<code>$vErbOsePrEFeReNcE.TosTrIng()[1,3]+'X'-jOiN''<\/code>\u306f<code>'iex'<\/code>\u306b\u306a\u308b\u3002<br>\u307e\u305f<code>iex<\/code>\u306a\u306e\u3067\u540c\u3058\u3088\u3046\u306b\u3059\u308b\u3002<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><a href=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-4.png\"><img loading=\"lazy\" decoding=\"async\" width=\"819\" height=\"1024\" src=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-4-819x1024.png\" alt=\"\" class=\"wp-image-790\" srcset=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-4-819x1024.png 819w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-4-240x300.png 240w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-4-768x960.png 768w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-4-624x780.png 624w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-4.png 929w\" sizes=\"auto, (max-width: 819px) 100vw, 819px\" \/><\/a><\/figure>\n<\/div>\n\n\n<p>\u4eca\u5ea6\u306f\u672b\u5c3e\u306b<code>iex<\/code>\u304c\u51fa\u3066\u3044\u308b\u3002\u305d\u306e\u524d\u306b\u30d1\u30a4\u30d7(<code>|<\/code>)\u304c\u3042\u308b\u306e\u3067\u3001\u524d\u534a\u3067\u6587\u5b57\u5217\u3092\u51fa\u529b\u3057\u3066\u305d\u308c\u3092<code>iex<\/code>\u306b\u98df\u308f\u305b\u308b\u3068\u3044\u3046\u3053\u3068\u3067\u69cb\u9020\u306f\u5909\u308f\u3089\u306a\u3044\u3002<br>\u307e\u305f\u3001\u5192\u982d\u306b\u6761\u4ef6\u5206\u5c90\u304c\u3042\u308b\u3002\u7279\u306b\u96e3\u3057\u3044\u3082\u306e\u3067\u306f\u306a\u304f\u300c\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u540d\u304c&#8217;RICSEC&#8217;\u3067\u3042\u308b\u5834\u5408\u306b\u4ee5\u4e0b\u306e\u51e6\u7406\u3092\u3059\u308b\u300d\u3068\u3044\u3046\u3060\u3051\u3067\u3042\u308b\u3002\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u52d5\u7684\u89e3\u6790\u3057\u3088\u3046\u3068\u3059\u308b\u5834\u5408\u306b\u5f15\u3063\u639b\u304b\u308a\u305d\u3046\u306a\u304f\u3089\u3044\u304b\u3002<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-6.png\"><img loading=\"lazy\" decoding=\"async\" width=\"930\" height=\"972\" src=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-6.png\" alt=\"\" class=\"wp-image-792\" srcset=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-6.png 930w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-6-287x300.png 287w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-6-768x803.png 768w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-6-624x652.png 624w\" sizes=\"auto, (max-width: 930px) 100vw, 930px\" \/><\/a><\/figure>\n<\/div>\n\n\n<p>\u4eca\u56de\u3082\u672b\u5c3e\u306b<code>iex<\/code>\u304c\u6765\u3066\u3044\u308b\u3002<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-7.png\"><img loading=\"lazy\" decoding=\"async\" width=\"928\" height=\"781\" src=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-7.png\" alt=\"\" class=\"wp-image-793\" srcset=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-7.png 928w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-7-300x252.png 300w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-7-768x646.png 768w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-7-624x525.png 624w\" sizes=\"auto, (max-width: 928px) 100vw, 928px\" \/><\/a><\/figure>\n<\/div>\n\n\n<p>\u3064\u3044\u306b<code>iex<\/code>\u304c\u306a\u304f\u306a\u3063\u305f\u3002<br>\u5f8c\u306f\u624b\u3067\u96e3\u8aad\u5316\u3092\u89e3\u304f\u304b\u3001\u90e8\u5206\u90e8\u5206\u3092PowerShell\u3067\u5b9f\u884c\u3057\u3066\u5143\u306e\u6587\u5b57\u5217\u306b\u623b\u3057\u3066\u3044\u304d\u3001\u6574\u5f62\u3057\u3066\u3044\u3051\u3070\u3088\u3044\u3002<br>\u6574\u5f62\u3057\u305f\u7d50\u679c\u306f\u4ee5\u4e0b\u306e\u901a\u308a\u3002<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: powershell; title: ; notranslate\" title=\"\">\nif (\n    (Get-Date).Month -eq 4 -and (Get-Date).Day -eq 1\n) {\n    Set-Item &#039;Variable:s9qIk1&#039; (&#x5B;Type]&quot;System.Text.Encoding&quot;);\n    ${B}=(&amp;(&#039;gp&#039;) &quot;HKCU:\\Software\\Microsoft\\CTF&quot;).&quot;fieND&quot;;\n    ${k}=  $s9QIK1::&quot;ASCII&quot;.(&quot;GetBytes&quot;).Invoke(&quot;f1bb3r&quot;);\n    for (${i} = 0; ${i} -lt ${B}.&quot;Length&quot;; ${i}++) {\n        ${B}&#x5B;${i}] = ${b}&#x5B;${i}] -bxor ${k}&#x5B;${i} % ${k}.&quot;Length&quot;]\n    };\n    ${A} = .(&quot;New-Object&quot;) (&quot;System.Security.Cryptography.AesCryptoServiceProvider&quot;);\n    ${Sh} = .(&quot;New-Object&quot;) (&quot;System.Security.Cryptography.SHA256Managed&quot;);\n    ${U} = .(&quot;New-Object&quot;) (&quot;System.Text.UTF8Encoding&quot;);\n    ${H} = ${sh}.&quot;ComputeHash&quot;(${U}.(&quot;GetBytes&quot;).Invoke(${K}));\n    ${A}.&quot;key&quot; = ${H};\n    &#x5B;byte&#x5B;]]${Iv} = 0..15;\n    ${A}.&quot;IV&quot; = ${iV};\n    ${e} = ${a}.(&quot;CreateEncryptor&quot;).Invoke();\n    ${eD} = ${e}.(&quot;TransformFinalBlock&quot;).Invoke(${b}, 0, ${b}.&quot;Length&quot;);\n    ${Ed};\n    &amp;(&#039;sp&#039;) (((&quot;HKCU:\\Software\\Microsoft\\CTF&quot;))) -Name (&quot;fiend&quot;) -Value ${ed};\n    .(&quot;Start-Sleep&quot;) -Seconds 600;\n};\n<\/pre><\/div>\n\n\n<p>\u5192\u982d\u306e<code>if<\/code>\u6587\u306f\u3001\u5b9f\u884c\u3057\u305f\u65e5\u4ed8\u304c4\/1\u306e\u5834\u5408\u306b\u30d6\u30ed\u30c3\u30af\u5185\u306e\u51e6\u7406\u3092\u3059\u308b\u3068\u3044\u3046\u5185\u5bb9\u3002<br>\u30d6\u30ed\u30c3\u30af\u3067\u306f<code>HKCU:\\Software\\Microsoft\\CTF<\/code>\u306e<code>fiend<\/code>\u3068\u3044\u3046\u30ec\u30b8\u30b9\u30c8\u30ea\u5024\u306e\u30c7\u30fc\u30bf\u3092\u8aad\u3093\u3067XOR\u3067\u30de\u30b9\u30af\u3057\u3066AES\u3067\u6697\u53f7\u5316\u3057\u3066\u307e\u305f<code>fiend<\/code>\u306b\u66f8\u304d\u623b\u3059\u3001\u3068\u3044\u3046\u3053\u3068\u3092\u3057\u3066\u3044\u308b\u3002<br>XOR\u306e\u9375\u306f<code>'f1bb3r'<\/code>\u3068\u3044\u3046\u6587\u5b57\u5217\u3001AES\u306e\u9375\u306f<code>'f1bb3r'<\/code>\u3068\u3044\u3046\u6587\u5b57\u5217\u3092\u3053\u306d\u304f\u308a\u56de\u3057\u3066\u4f5c\u308b\u3001\u3068\u3044\u3046\u3053\u3068\u3067\u3053\u306e\u51e6\u7406\u306b\u5fc5\u8981\u306a\u30d1\u30e9\u30e1\u30fc\u30bf\u306f\u3059\u3079\u3066\u308f\u304b\u3063\u3066\u3044\u308b\u3002<\/p>\n\n\n\n<p>\u305d\u3057\u3066\u3001\u5b9f\u884c\u6642\u306e\u30e1\u30e2\u30ea\u30a4\u30e1\u30fc\u30b8\u304c\u3042\u308b\u3053\u3068\u304b\u3089\u3001\u66f8\u304d\u623b\u3057\u5f8c\u306e<code>fiend<\/code>\u306e\u5024\u306f\u30e1\u30e2\u30ea\u5185\u306b\u6b8b\u3063\u3066\u3044\u308b\u306f\u305a\u3002<br>\u3068\u3044\u3046\u3053\u3068\u3067\u30e1\u30e2\u30ea\u30a4\u30e1\u30fc\u30b8\u306b\u623b\u3063\u3066\u30ec\u30b8\u30b9\u30c8\u30ea\u30c7\u30fc\u30bf\u3092\u53d6\u308a\u51fa\u3059\u3002<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n$ vol3 -f memory.raw windows.registry.printkey --key &quot;Software\\Microsoft\\CTF&quot;\nVolatility 3 Framework 2.4.2\nProgress:  100.00               PDB scanning finished\nLast Write Time Hive Offset     Type    Key     Name    Data    Volatile\n\n...snip...\n\n2023-04-01 08:44:57.000000      0x850e6e280000  REG_BINARY      \\??\\C:\\Users\\User\\ntuser.dat\\Software\\Microsoft\\CTF   fiend   &quot;\n39 da 2a 85 c9 5b 42 17 9.*..&#x5B;B.\n84 11 d8 23 3b 0b f2 0e ...#;...\n26 8c 95 89 ff e6 f1 7e &amp;amp;......~\n4b f8 43 42 d0 24 37 70 K.CB.$7p&quot;       False\n\n...snip...\n<\/pre><\/div>\n\n\n<p>32\u30d0\u30a4\u30c8\u306e\u30c7\u30fc\u30bf\u3092\u7372\u5f97\u3067\u304d\u305f\u3002<br>\u3042\u3068\u306f\u3053\u308c\u3092\u4f7f\u3063\u3066\u4e0a\u8a18\u306e\u9006\u306e\u51e6\u7406\u3092\u3057\u3066\u3084\u308c\u3070\u5143\u306e\u30ec\u30b8\u30b9\u30c8\u30ea\u5024\u306e\u30c7\u30fc\u30bf\u304c\u5f97\u3089\u308c\u308b\u3002<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: powershell; title: ; notranslate\" title=\"\">\nSet-Item &#039;Variable:s9qIk1&#039; (&#x5B;Type]&quot;System.Text.Encoding&quot;);\n${k}=  $s9QIK1::&quot;ASCII&quot;.(&quot;GetBytes&quot;).Invoke(&quot;f1bb3r&quot;);\n${A} = .(&quot;New-Object&quot;) (&quot;System.Security.Cryptography.AesCryptoServiceProvider&quot;);\n${Sh} = .(&quot;New-Object&quot;) (&quot;System.Security.Cryptography.SHA256Managed&quot;);\n${U} = .(&quot;New-Object&quot;) (&quot;System.Text.UTF8Encoding&quot;);\n${H} = ${sh}.&quot;ComputeHash&quot;(${U}.(&quot;GetBytes&quot;).Invoke(${K}));\n${A}.&quot;key&quot; = ${H};\n&#x5B;byte&#x5B;]]${Iv} = 0..15;\n${A}.&quot;IV&quot; = ${iV};\n${d} = ${a}.(&quot;CreateDecryptor&quot;).Invoke();\n${c} = &#x5B;byte&#x5B;]]@(0x39, 0xda, 0x2a, 0x85, 0xc9, 0x5b, 0x42, 0x17, 0x84, 0x11, 0xd8, 0x23, 0x3b, 0x0b, 0xf2, 0x0e, 0x26, 0x8c, 0x95, 0x89, 0xff, 0xe6, 0xf1, 0x7e, 0x4b, 0xf8, 0x43, 0x42, 0xd0, 0x24, 0x37, 0x70)\n${p} = ${d}.(&quot;TransformFinalBlock&quot;).Invoke(${c}, 0, ${c}.&quot;Length&quot;);\nfor (${i} = 0; ${i} -lt ${p}.&quot;Length&quot;; ${i}++) {\n    ${p}&#x5B;${i}] = ${p}&#x5B;${i}] -bxor ${k}&#x5B;${i}%${k}.&quot;Length&quot;]\n};\n${U}.GetString(${p})\n<\/pre><\/div>\n\n\n<p>&lt;\u4f59\u8ac7&gt;<br>\u5f53\u521d<code>'f1bb3r'<\/code>\u3092<code>'fibbr3'<\/code>\u3068\u9593\u9055\u3048\u3066\u3057\u307e\u3044\u3001AES\u5fa9\u53f7\u304b\u3089\u3057\u3066\u3046\u307e\u304f\u3044\u304b\u306a\u304f\u3066\u60a9\u307f\u307e\u304f\u3063\u305f\u3002\u4e8c\u6557\u3002<br>&lt;\/\u4f59\u8ac7&gt;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-9.png\"><img loading=\"lazy\" decoding=\"async\" width=\"923\" height=\"366\" src=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-9.png\" alt=\"\" class=\"wp-image-804\" srcset=\"https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-9.png 923w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-9-300x119.png 300w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-9-768x305.png 768w, https:\/\/emeth.jp\/diary\/wp-content\/uploads\/2023\/04\/image-9-624x247.png 624w\" sizes=\"auto, (max-width: 923px) 100vw, 923px\" \/><\/a><\/figure>\n<\/div>\n\n\n<p>\u30d5\u30e9\u30b0\u304c\u51fa\u3066\u304d\u305f\u306e\u3067\u3053\u308c\u304c\u7b54\u3048\u3002<\/p>\n\n\n\n<p><code>Flag: RicSec{6r347_90w3r!}<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u53c2\u52a0\u3057\u30661\u554f\u89e3\u304d\u307e\u3057\u305f\u3002<\/p>\n","protected":false},"author":1,"featured_media":783,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"cybocfi_hide_featured_image":"","footnotes":""},"categories":[14],"tags":[8],"class_list":["post-782","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf","tag-ctf"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts\/782","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/comments?post=782"}],"version-history":[{"count":16,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts\/782\/revisions"}],"predecessor-version":[{"id":809,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts\/782\/revisions\/809"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/media\/783"}],"wp:attachment":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/media?parent=782"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/categories?post=782"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/tags?post=782"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}