Type: Walkthrough
Difficulty: Medium
Tags: -
Meta Tags: Walkthrough, Walk-through, Write-up, Writeup
Subscription type: Free
Description:
This room aims towards helping everyone learn about the basics of "Malware Reverse Engineering".
Room link: https://tryhackme.com/room/basicmalwarere
These challenges are aimed towards learning about the "Static Analysis" technique used to analyze the malware. The main aim for this room is not to used any types of debuggers neither the executable's/programs should be run on any platform. You are required to answer all the questions without even using the debugger and even not executing the executable's/programs.
Meanwhile all the credits goes to @MalwareTechBlog for creating these awesome challenges.
Note: If you have already solved these challenges - give it a try again while giving enough time to the newbies who want to learn about "Malware Analysis". Also don't try to copy paste stuff from other blogs/walkthroughs as it won't lead you to learn this amazing field. If you are having hard time solving these challenges. Study more about it and the techniques which are involved. Meanwhile you can also join TryHackMe discord and fire up you problems in there.
Password for the ZIP is MalwareTech.
This executable prints an MD5 Hash on the screen when executed. Can you grab the exact flag?
Note: You don't need to run the executable!
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Medium/Basic_Malware_RE]
└─$ 7z x strings1.zip
7-Zip 24.09 (x64) : Copyright (c) 1999-2024 Igor Pavlov : 2024-11-29
64-bit locale=en_US.UTF-8 Threads:32 OPEN_MAX:1024, ASM
Scanning the drive for archives:
1 file, 61498 bytes (61 KiB)
Extracting archive: strings1.zip
--
Path = strings1.zip
Type = zip
Physical Size = 61498
Enter password (will not be echoed):
Everything is Ok
Size: 213504
Compressed: 61498
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Medium/Basic_Malware_RE]
└─$ ls -l
total 269
-rwxrwxrwx 1 root root 213504 Apr 26 2018 strings1.exe_
-rwxrwxrwx 1 root root 61498 Jan 3 09:50 strings1.zip
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Medium/Basic_Malware_RE]
└─$ strings -n 6 strings1.exe_ | head -n 25
!This program cannot be run in DOS mode.
`.rdata
@.data
@.rsrc
@.reloc
FLAG{THE-DEPICTED-THE-IMPORTANT-THE}
FLAG{INCLUDES-COLLECTIVE-AND-SOCIALIST-INQUIRY}
FLAG{LAW-IDEOLOGICAL-INTO-THE-THE}
FLAG{COMPETENCE-ISSUE-PERSONAL-THE-LAW}
FLAG{MATTERS-POLITICAL-DETERMINATION-ITS-SOCIALIST}
FLAG{BODIES-PROMOTE-NATIONWIDE-COLLECTIVE-SOVIET}
FLAG{STATE-THEIR-WITHOUT-THE-REQUIRED}
FLAG{SOVIET-AND-THE-PERFECT-SUPREME}
FLAG{AND-LABOUR-THE-THE-SHALL}
FLAG{VICTORY-STRUGGLE-GENERAL-SOVIET-BROADENING}
FLAG{RIGHTS-RAISED-TRAINING-SHALL-AND}
FLAG{STATE-THE-ATTITUDE-ARMED-ARE}
FLAG{ORGANISATIONS-MORAL-OTHER-ELECTORAL-ARTICLE}
FLAG{THE-TELEGRAPHIC-ARTICLE-ACTIVITY-FRAMED}
FLAG{TERRITORY-CONSUMPTION-RIGHT-THE-USE}
FLAG{AUTONOMOUS-AND-LOCAL-ELECTED-SUBORDINATE}
FLAG{LAWS-REPUBLIC-THE-HAS-ELECTIVENESS}
FLAG{EXPECTANT-CITIZEN-DEBATE-CREATED-PUBLIC}
FLAG{ARE-DEPUTIES-PROCEDURE-AND-CITIZENS}
FLAG{SAFEGUARDING-DUSCUSSION-MINISTERS-AND-STATE}We have a lot of different flags, but which one is it?
Importing the file in Ghidra and analyzing it with the default settings gives us the following decompiled entry function:
void entry(void)
{
char *lpText;
lpText = md5_hash(PTR_s_FLAG{CAN-I-MAKE-IT-ANYMORE-OBVIO_00432294);
MessageBoxA((HWND)0x0,lpText,"We\'ve been compromised!",0x30);
/* WARNING: Subroutine does not return */
ExitProcess(0);Where we have the beginning of the flag.
We can get the full flag with strings
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Medium/Basic_Malware_RE]
└─$ strings -n 6 strings1.exe_ | grep 'FLAG{CAN-I-MAKE-IT'
FLAG{<REDACTED>}Answer: FLAG{<REDACTED>}
This executable prints an MD5 Hash on the screen when executed. Can you grab the exact flag?
Note: You don't need to run the executable!
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Medium/Basic_Malware_RE]
└─$ 7z x strings2.zip
7-Zip 24.09 (x64) : Copyright (c) 1999-2024 Igor Pavlov : 2024-11-29
64-bit locale=en_US.UTF-8 Threads:32 OPEN_MAX:1024, ASM
Scanning the drive for archives:
1 file, 3425 bytes (4 KiB)
Extracting archive: strings2.zip
--
Path = strings2.zip
Type = zip
Physical Size = 3425
Enter password (will not be echoed):
Everything is Ok
Size: 9216
Compressed: 3425
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Medium/Basic_Malware_RE]
└─$ ls -l
total 282
-rwxrwxrwx 1 root root 213504 Apr 26 2018 strings1.exe_
-rwxrwxrwx 1 root root 61498 Jan 3 09:50 strings1.zip
-rwxrwxrwx 1 root root 9216 Apr 26 2018 strings2.exe_
-rwxrwxrwx 1 root root 3425 Jan 3 10:22 strings2.zip
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Medium/Basic_Malware_RE]
└─$ strings -n 6 strings2.exe_
!This program cannot be run in DOS mode.
`.rdata
@.data
@.rsrc
@.reloc
QXRh80@
j0h 0@
We've been compromised!
ExitProcess
KERNEL32.dll
memset
memcpy
sprintf
ntdll.dll
MessageBoxA
USER32.dll
plaintext2.exe
??0MD5@@QAE@XZ
?Decode@MD5@@CAXPAKPAEI@Z
?Encode@MD5@@CAXPAEPAKI@Z
?Final@MD5@@QAEXXZ
?Init@MD5@@QAEXXZ
?MD5Transform@MD5@@CAXQAKQAE@Z
?Update@MD5@@QAEXPAEI@Z
?digestMemory@MD5@@QAEPADPAEH@Z
?digestString@MD5@@QAEPADPAD@Z
?md5_hash@@YAPADPAD@Z
?writeToString@MD5@@QAEXXZ
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
2X3d3l3z3We don't have any obvious FLAG-string here.
Let's turn to Ghidra again.
The decompiled entry function gives us the flag
void entry(void)
{
char local_2c [36];
char *local_8;
builtin_strncpy(local_2c,"FLAG{<REDACTED>}",0x24);
local_8 = md5_hash(local_2c);
MessageBoxA((HWND)0x0,local_8,"We\'ve been compromised!",0x30);
/* WARNING: Subroutine does not return */
ExitProcess(0);
}Answer: FLAG{<REDACTED>}
This executable prints an MD5 Hash on the screen when executed. Can you grab the exact flag?
Note: You don't need to run the executable!
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Medium/Basic_Malware_RE]
└─$ 7z x strings3.zip
7-Zip 24.09 (x64) : Copyright (c) 1999-2024 Igor Pavlov : 2024-11-29
64-bit locale=en_US.UTF-8 Threads:32 OPEN_MAX:1024, ASM
Scanning the drive for archives:
1 file, 11456 bytes (12 KiB)
Extracting archive: strings3.zip
--
Path = strings3.zip
Type = zip
Physical Size = 11456
Enter password (will not be echoed):
Everything is Ok
Size: 52736
Compressed: 11456
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Medium/Basic_Malware_RE]
└─$ ls -l
total 345
-rwxrwxrwx 1 root root 213504 Apr 26 2018 strings1.exe_
-rwxrwxrwx 1 root root 61498 Jan 3 09:50 strings1.zip
-rwxrwxrwx 1 root root 9216 Apr 26 2018 strings2.exe_
-rwxrwxrwx 1 root root 3425 Jan 3 10:22 strings2.zip
-rwxrwxrwx 1 root root 52736 Apr 26 2018 strings3.exe_
-rwxrwxrwx 1 root root 11456 Jan 3 10:29 strings3.zip
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Medium/Basic_Malware_RE]
└─$ strings -n 6 strings3.exe_
!This program cannot be run in DOS mode.
`.rdata
@.data
@.reloc
QXRhH0@
j0h00@
We've been compromised!
ExitProcess
FindResourceA
KERNEL32.dll
memset
memcpy
sprintf
ntdll.dll
MessageBoxA
LoadStringA
USER32.dll
plaintext3.exe
??0MD5@@QAE@XZ
?Decode@MD5@@CAXPAKPAEI@Z
?Encode@MD5@@CAXPAEPAKI@Z
?Final@MD5@@QAEXXZ
?Init@MD5@@QAEXXZ
?MD5Transform@MD5@@CAXQAKQAE@Z
?Update@MD5@@QAEXPAEI@Z
?digestMemory@MD5@@QAEPADPAEH@Z
?digestString@MD5@@QAEPADPAD@Z
?writeToString@MD5@@QAEXXZ
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
3 3/373F3L3R3Again, no obvious FLAG found.
Time for Ghidra once more. The decompiled entry function is as follows:
void entry(void)
{
CHAR local_4a4;
undefined1 local_4a3 [1027];
char *local_a0;
MD5 local_9c [144];
HRSRC local_c;
undefined4 local_8;
MD5::MD5(local_9c);
local_4a4 = '\0';
memset(local_4a3,0,0x3ff);
local_8 = 0;
local_c = FindResourceA((HMODULE)0x0,"rc.rc",(LPCSTR)0x6);
local_8 = 0x110;
LoadStringA((HINSTANCE)0x0,0x110,&local_4a4,0x3ff);
local_a0 = MD5::digestString(local_9c,&local_4a4);
MessageBoxA((HWND)0x0,local_a0,"We\'ve been compromised!",0x30);
/* WARNING: Subroutine does not return */
ExitProcess(0);
}Hhm, this time the FLAG is hidden among the Resources.
Checking the documentation for LoadStringA we find that the resource we are loading has a UID of 0x110 (decimal 272).
We also have the beginning of the flag in the disassembly view
004022ff ff 15 0c CALL dword ptr [->USER32.DLL::LoadStringA] = u"FLAG{RESOURCES-ARE-POPULAR-F
30 40 00 = 0000312a
Searching for strings a bit more thoroughly this time (-a to search the entire file, and -e l for UTF-16 encoded Windows strings) we can find the full flag with grep
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Medium/Basic_Malware_RE]
└─$ strings -n 6 -a -e l strings3.exe_ | grep 'FLAG{RESOURCES-ARE'
'FLAG{<REDACTED>}Answer: FLAG{<REDACTED>}
For additional information, please see the references below.