Click Here For Free Bricks — UMass Cybersecurity CTF

Description

Hey! A man was caught with malware on his PC in Lego City. Luckily, we were able to get a packet capture of his device during the download. Help Lego City Police figure out the source of this malicious download.

The flag for this challenge is the name of this virus on VirusTotal under the details tab with the format UMASS{[String]_[Sha256 Hash]}. For example if your hash is 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, there will be a virus name under the details tab with a format similar to ForensicsChallenge_2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, where "ForensicsChallenge" is an arbitrary string.

English summary: the challenge provides a packet capture from a host downloading suspected malware. The goal is to recover the malicious payload, identify the correct sample on VirusTotal, and format the answer as UMASS{family_sha256}.

Summary

The main artifact inside the downloaded archive was thedamage.pcapng. HTTP reconnaissance showed that the infected host fetched several files from 156.234.52.16, including installer.py and launcher.

The important pivot was that installer.py did not merely download malware; it contained the decryption routine for ./launcher. After decrypting the launcher and hashing the plaintext binary, the decrypted SHA256 matched the relevant VirusTotal sample, which exposed the exact string REDACTED.

Reconnaissance

After downloading and extracting the ZIP, the key artifact was thedamage.pcapng.

Useful initial commands:

file thedamage.pcapng
capinfos thedamage.pcapng
tshark -r thedamage.pcapng -Y "http.request" -T fields -e frame.number -e ip.src -e http.host -e http.request.method -e http.request.uri

The HTTP request list showed a single suspicious download server at 156.234.52.16 serving these paths:

• /fungame.jpg
• /cooldog.jpeg
• /installer.py
• /literallyme.jpeg
• /launcher

That made 156.234.52.16 the malware download source/server requested by the challenge.

Extraction

Next, export the HTTP objects and inspect what was actually transferred:

tshark -r thedamage.pcapng --export-objects "http,http_objects"
file http_objects/installer.py http_objects/launcher
shasum -a 256 http_objects/*

The obviously suspicious files were installer.py and launcher. The images looked like decoys, while the Python script and a raw executable payload strongly suggested a staged malware delivery.

Relevant hashes:

• Encrypted launcher SHA256: 695b3eeeb8a4a4d22405d78732f19c6e42527d374ae3b23ba1c4e4b757e10359
• Decrypted launcher.dec SHA256: REDACTED

Decryption

Reading installer.py revealed the entire decryption routine. The script used:

• seed = "38093248092rsjrwedoaw3"
• key = hashlib.sha256(seed.encode()).digest()
• nacl.secret.SecretBox(key)

It then decrypted ./launcher in place. That tells us the downloaded launcher file inside the PCAP is not the final malware sample; it is only the encrypted container. The challenge asks for the VirusTotal name associated with the real virus, so the correct object to hash and submit to VirusTotal is the decrypted payload, not the encrypted blob.

Minimal reproduction:

#!/usr/bin/env python3

import hashlib
import pathlib
import nacl.secret

seed = "38093248092rsjrwedoaw3"
key = hashlib.sha256(seed.encode()).digest()
box = nacl.secret.SecretBox(key)

data = pathlib.Path("launcher").read_bytes()
plaintext = box.decrypt(data)
pathlib.Path("launcher.dec").write_bytes(plaintext)

Equivalent one-liner used during the solve:

python3 -c 'import hashlib,nacl.secret,pathlib; seed="38093248092rsjrwedoaw3"; key=hashlib.sha256(seed.encode()).digest(); box=nacl.secret.SecretBox(key); data=pathlib.Path("launcher").read_bytes(); pathlib.Path("launcher.dec").write_bytes(box.decrypt(data))'

After decryption:

file launcher.dec

The result was identified as:

FreeBSD/i386 compact demand paged dynamically linked executable, not stripped

VirusTotal Identification

The decisive lookup was the SHA256 of the decrypted binary:

REDACTED

Why this hash matters:

1. installer.py explicitly decrypts launcher, so the encrypted file is only a wrapper.
2. VirusTotal classifications and file names should match the actual executable that runs after decryption.
3. The decrypted sample corresponds to the malware the victim would execute, so its SHA256 is the correct reputation pivot.

Looking up that decrypted hash on VirusTotal showed the malware family as Snoopy, and the file names/details included the exact challenge-formatted string:

REDACTED

That string is what the challenge wanted inside UMASS{...}.

Reproduction Steps

1. Download and extract the challenge archive.
2. Inspect thedamage.pcapng and enumerate HTTP requests.
3. Observe that the host downloads files from 156.234.52.16.
4. Export HTTP objects from the PCAP with tshark.
5. Inspect installer.py and recover the hardcoded SecretBox decryption logic.
6. Decrypt launcher into launcher.dec.
7. Hash launcher.dec and use that SHA256 in VirusTotal.
8. Read the matching family/file-name string and wrap it as UMASS{...}.

Final Flag

UMASS{REDACTED}