Challenge 5

Return To Sender

• This challenge contains two files - a PCAP file and a PE. The PE on execution asks for an input text file which apparently contains a key. Judging by the PCAP file given, I think the key is somewhere inside it. So let's start with the PCAP file.

• This PCAP has 2 types of protocols in it - HTTP POST and TCP PDUs. The POST packets look interesting. Add the HTTP filter and look at the packets.

• Each of the packets has a 4 byte value. I think these values are part of the required key. So, adding them up gives

55445973314437624e6d6445316f3367356d733156365272594356764f444a46314470784b5478414a3978755a573d3d

• Welp.. it's a start. Altleast it accepts the key data but is having trouble sending it. Let's hack into it.

• Looking at the imports, the binary is indeed trying to connect to some web server using Wininet.dll . Maybe we can patch-out the internet function or something.

• Looking for the text "[!] Error sending key data." in the binary, we come the the function "sub_401100".

• So, this function takes in "key.txt", opens it using CreateFileA winapi and checks the value of esi register to determine it's flow of control. The read key is stored in a buffer and the file handle is closed. Next, the buffer is given to "sub_401250".

• This function takes in the buffer, does a simple key encryption on it using flarebearstare as the key. The calculation appears to be -

for (i = 0; i < buffer; i++) {
    buffer[i] += KEY[i % KEYLENGTH]
}

• Going further down in "sub_4012a0", we see this string being used.

• This means that Base64 is being used to encode the key string. Now looking further, in the internet access function, HttpSendRequestA is being called with 4 as a parameter, which is the reason why the key was distributed as 4 byte strings in the POST requests.

• Based on this, we can write a python script that decodes the key for us -

import sys
import base64
from scapy.all import *

encrypt_key = b'flarebearstare'
my_b64 = b"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/"
std_b64 = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"

def decode(data):
    trans = bytes.maketrans(my_b64, std_b64)
    data = data.translate(trans)
    return base64.b64decode(data)

def decrypt(data):
    key = ""
    for i, b in enumerate(data):
        key += chr(b - encrypt_key[i % len(encrypt_key)])
    return key

if __name__ == '__main__':
    pkts = rdpcap(sys.argv[1])
    print(f"[*] Parsing pcap: {sys.argv[1]}")
    key = b""
    for pkt in pkts:
        if TCP in pkt and Raw in pkt and b'KEY' in pkt[Raw].load:
            headers, body = pkt[Raw].load.split(b"\r\n\r\n", 1)
            key += body
    key_decoded = decode(key)
    key_decrypted = decrypt(key_decoded)
    print(f"[+] KEY: {key_decrypted}")