reverseProhard

Secret of Maxim

hackerlab

Task: analyze a PE64 executable sent to Maxim's coworkers that hides its behavior behind fake metadata, dynamic API resolution, and host-bound decryption. Solution: derive the RC4 key from MD5(\"DEV-BUILD-01\"), decrypt the remote Codeby payload, and evaluate the generated C code to recover the flag.

pe64 rc4 md5 malware_analysis windows_pe anti_debug api_hashing dynamic_api_resolution resource_analysis png_decoy wininet host_gating stager

red_herring_eliminationdynamic_import_recoveryapi_hash_resolver_reversalhostname_bound_rc4_decryptionremote_stage_extractionarithmetic_flag_reconstruction

$ ls tags/ techniques/

pe64 rc4 md5 malware_analysis windows_pe anti_debug api_hashing dynamic_api_resolution resource_analysis png_decoy wininet host_gating stager

red_herring_eliminationdynamic_import_recoveryapi_hash_resolver_reversalhostname_bound_rc4_decryptionremote_stage_extractionarithmetic_flag_reconstruction

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ cat writeup.md…

Sign in to access full writeups

Sign in to access full writeups

Similar writeups