Click Here For Free Bricks — UMass Cybersecurity CTF

Description

Hey! A man was caught with malware on his PC in Lego City. Luckily, we were able to get a packet capture of his device during the download. Help Lego City Police figure out the source of this malicious download.

The flag for this challenge is the name of this virus on VirusTotal under the details tab with the format UMASS{[String]_[Sha256 Hash]}. For example if your hash is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, there will be a virus name under the details tab with a format similar to ForensicsChallenge_2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, where "ForensicsChallenge" is an arbitrary string.

English summary: the challenge provides a packet capture from a host downloading suspected malware. The goal is to recover the malicious payload, identify the correct sample on VirusTotal, and format the answer as UMASS{family_sha256}.

Summary

The main artifact inside the downloaded archive was thedamage.pcapng. HTTP reconnaissance showed that the infected host fetched several files from 156.234.52.16, including installer.py and launcher.

The important pivot was that installer.py did not merely download malware; it contained the decryption routine for ./launcher. After decrypting the launcher and hashing the plaintext binary, the decrypted SHA256 matched the relevant VirusTotal sample, which exposed the exact string TheZoo_e7a09064fc40dd4e5dd2e14aa8dad89b328ef1b1fdb3288e4ef04b0bd497ccae.

Reconnaissance

After downloading and extracting the ZIP, the key artifact was thedamage.pcapng.

Useful initial commands:

file thedamage.pcapng
capinfos thedamage.pcapng
tshark -r thedamage.pcapng -Y "http.request" -T fields -e frame.number -e ip.src -e http.host -e http.request.method -e http.request.uri

The HTTP request list showed a single suspicious download server at 156.234.52.16 serving these paths:

• /fungame.jpg
• /cooldog.jpeg
• /installer.py
• /literallyme.jpeg
• /launcher

That made 156.234.52.16 the malware download source/server requested by the challenge.

Extraction

Next, export the HTTP objects and inspect what was actually transferred:

...