Cyber Learnings

Introduction

This series of posts provides a writeup of the tools and methods I used to crack the Malware RE samples listed in the following THM Room – https://tryhackme.com/r/room/basicmalwarere.

In this writeup, we look at the 3rd challenge (Strings3).

I am a malware RE newbie and these methods are by no means the best way to crack the samples and find the flag. Comments and suggestions are welcome.

WARNING: Always analyze malware in a safe environment. Please see the Resources for a guide on setting up such an environment.

TOOLS: I used a Flare VM setup with an Internal Network configuration to analyze the samples. For this sample, I specifically used Mandiant Floss the python pefile module.

Strings::Challenge 3

Sample Name: strings3.exe_

Let us rename this to strings3.exe and detonate it. We see the following MessageBox.

Let us copy the hash as we need this for future analysis.

1011cafbd736cdf2ae90964613c911fe

Where are the strings ?

Now that we have the target hash, let us do a strings analysis of the sample to look for the flags.

C:\SAMPLES\THM\strings3
λ FLOSS.exe  strings3.exe_  > allstrings
λ type allstrings

FLOSS was able to retrieve the FLAG strings.

 +-------------------------------------+
| FLOSS STATIC STRINGS: UTF-16LE (50) |
+-------------------------------------+

2FLAG{WHATSOEVER-PRODUCT-INCIDENTAL-APPLICABLE-NOT}'FLAG{COPY-YOU-PROVISION-DISCLAIMER-ARE}&FLAG{THE-LICENSED-WITHIN-SERVICES-LAW} ....
......

This provides us a clue as to where these strings(flags) might be stored in the binary. We could use 2 approaches in finding the flag.

1. Clean up and save all flags in a file and use the Python program from Challenge 1 to find the target flag. This has been done before and will surely find the flag.
2. Dig deeper to find how these strings are stored in the PE binary, extract them and compare them against the target above.

Since RE/MA is a journey of learning and discovery, we will use approach 2.

Let’s first open the sample in PE-bear. We discover these flags inside the .rsrc section of the PE image. This section is used to store resources used by an application, such as icons, images, menus, and strings.

I came across an interesting Python library, named pefile which provides programmatic access to the various parts of a PE image. Let’s see if we can use this to find this flag.

Incidentally, there was this readily available sample (see Resources) which I modified slightly to give us the flag. This code parses the PE file, and extracts the flags from the resource section to a list that we use to extract the flag.

Look for “Modified” for changes made to the original code,.

#python

import pefile
import hashlib

pe =  pefile.PE('strings3.exe_')

# TARGET is seen by executing the binary. It can also be extracted by debugging using x32Dbg.

# MODIFIED
TARGET = "1011cafbd736cdf2ae90964613c911fe"

entries = [entry.id for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries]

# storage for extracted strings.
strings = list()

rt_string_idx = [entry.id for entry in   pe.DIRECTORY_ENTRY_RESOURCE.entries].index(pefile.RESOURCE_TYPE['RT_STRING'])

# Get the directory entry
#
rt_string_directory = pe.DIRECTORY_ENTRY_RESOURCE.entries[rt_string_idx]

# For each of the entries (which will each contain a block of 16 strings)
#
for entry in rt_string_directory.directory.entries:

  # Get the RVA of the string data and
  # size of the string data
  #
  data_rva = entry.directory.entries[0].data.struct.OffsetToData
  size = entry.directory.entries[0].data.struct.Size
  #print ('Directory entry at RVA', hex(data_rva), 'of size', hex(size))

  # Retrieve the actual data and start processing the strings
  #
  data = pe.get_memory_mapped_image()[data_rva:data_rva+size]
  offset = 0
  while True:
    # Exit once there's no more data to read
    if offset>=size:
      break
    # Fetch the length of the unicode string
    #
    ustr_length = pe.get_word_from_data(data[offset:offset+2], 0)
    offset += 2

    # If the string is empty, skip it
    if ustr_length==0:
      continue

    # Get the Unicode string
    #
    ustr = pe.get_string_u_at_rva(data_rva+offset, max_length=ustr_length)
    offset += ustr_length*2
    strings.append(ustr)
    #print ('String of length', ustr_length, 'at offset', offset)

# MODIFIED CODE - iterate, convert to MD5, compare against # TARGET
for line in strings:
    line = line.decode('utf_8','strict')
    h = hashlib.md5(line.encode('utf-8')).hexdigest()
    if h == TARGET:
        print ("FOUND:" ,line, h)

Executing the code on the Flare VM, we can see the flag.

Conclusion

This sample stores the flags inside the PE binary in the .rsrc (resources) section.

Resources

• Internal Network Vs Host-Only https://notes.huskyhacks.dev/blog/malware-analysis-labs-internal-network-vs-host-only
• Samples Files and Challenge: https://tryhackme.com/r/room/basicmalwarere
• Mandiant FLOSS: https://github.com/mandiant/flare-floss/blob/master/doc/usage.md
• Python PE module (Reading Resource Strings) – https://github.com/erocarrera/pefile/blob/wiki/ReadingResourceStrings.md
• PE File Resource section – https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-rsrc-section
• Hasherezade’s PE-bear https://github.com/hasherezade/pe-bear

Introduction

This series of posts provides a writeup of the tools and methods I used to crack the Malware RE samples listed in the following THM Room – https://tryhackme.com/r/room/basicmalwarere. In this writeup, we look at the 2nd challenge (Strings2).

I am a malware RE newbie and these methods are by no means the best way to crack the samples and find the flag. Comments and suggestions are welcome.

WARNING: Always analyze malware in a safe environment. Please see the Resources for a guide on setting up such an environment.

TOOLS: I used a Flare VM setup with an Internal Network configuration to analyze the samples. For this sample, I specifically used Mandiant Floss and x32dbg.

Strings::Challenge 2

Sample Name: strings2.exe_

Let us rename this to strings2.exe and detonate it. We see the following MessageBox.

Let us copy the hash as we need this for future analysis.

e41509c99d1462fa384ee99f350593fc

Where are the strings ?

Now that we have the target hash, let us do a strings analysis of the sample to look for the flags.

C:\SAMPLES\THM\strings2
λ FLOSS.exe  strings2.exe_  > allstrings
λ type allstrings

Though the strings are not directly visible as with the first challenge, we do see that FLOSS was able to retrieve the FLAG. This was expected since FLOSS analyzes files and looks for the following:

• strings encrypted in global memory or deobfuscated onto the heap
• strings manually created on the stack (stackstrings)
• strings created on the stack and then further modified (tight strings)

 ───────────────────────── 
  FLOSS STACK STRINGS (1)  
 ───────────────────────── 

FLAG{xxxx-xxxx-xxxx-xxxx-xxxx}

This provides us a clue as to where these strings(flags) might be stored in the binary. The purpose of RE / MA is not just to get flags but understand what is happening underneath. Let’s dig in some more.

There are a few interesting strings that we can use for further analysis.

We've been compromised!
MessageBoxA

Let’s open this binary in x32dbg. Press F9 to hit the first breakpoint. Now we want to set a breakpoint that allows us to see the string as it is constructed prior to being set an an argument to the MessageBox function call.

Right Click => Search For => All Modules => String references.

Look for the familiar string that we saw in the message box when the binary was executed and set a breakpoint on it.

Continue debugging by pressing F9 until we hit the breakpoint.

Backing up a couple of instructions, we notice that EAX is being populated with the contents of the stack string.

lea eax, dword ptr ss:[ebp-28]

Let’s set a breakpoint here and restart the debugging.

We can see the complete flag transferred over from the stack to the EAX register.

Conclusion

This sample stores the flag using the stack string technique – using a series of MOV instructions transferring constant values into adjacent locations on the stack. x32dbg is a great tool to watch this technique unfold in real time.

In our next writeup, we will look at a sample that stores flags inside a binary in another interesting way.

Resources

• Internal Network Vs Host-Only https://notes.huskyhacks.dev/blog/malware-analysis-labs-internal-network-vs-host-only
• Samples Files and Challenge: https://tryhackme.com/r/room/basicmalwarere
• Mandiant FLOSS: https://github.com/mandiant/flare-floss/blob/master/doc/usage.md
• Stack Strings – https://www.tripwire.com/state-of-security/ghidra-101-decoding-stack-strings

Introduction

This series of posts provides a walkthru of the tools and methods I used to crack the Malware RE samples listed in the following THM Room – https://tryhackme.com/r/room/basicmalwarere.

I am a malware RE newbie and these methods are by no means the best way to crack the samples and find the flag. Comments and suggestions are welcome.

WARNING: Always analyze malware in a safe environment. Please see the Resources for a guide on setting up such an environment.

TOOLS: I used a Flare VM setup with an Internal Network configuration to analyze the samples. Specifically Floss and x32dbg and a bit of Python scripting where applicable.

All the challenges listed have the following common theme.

• The malware, when executed, prints an MD5 checksum in a MessageBox.
• There are a bunch of strings (flags) hidden inside the binary at some location.
• The final string that is printed out is created by MD5 encoding one of the above mentioned strings (flags).
• Our goal is to find the flag that produced the output that we see when we execute the sample.

Strings::Challenge 1

Sample Name: strings1.exe_

Let us rename this to strings1.exe and detonate it. We see the following MessageBox.

Let us copy the hash as we need this for future analysis.

4c827c4ca62781d707cd049da13539ee

Where are the strings ?

Now that we have the target hash, let us do a strings analysis of the sample to look for the flags.

C:\SAMPLES\THM\strings1
λ FLOSS.exe  strings2.exe_  > allstrings
λ type allstrings

We see a bunch of strings looking like flags.

Let’s look at how many strings look like flags.

C:\SAMPLES\THM\strings1
λ grep FLAG allstrings  | wc -l
4195

That’s a lot of strings to go through manually. Lets isolate these FLAGS in a separate file.

strings strings1.exe_ | grep FLAG > FLAGS

A simple Python script can automate this process for us. Save the following code in a file e.g. find_flag.py

# USAGE: python find_flag.py <flag_file_name>

import hashlib 
import sys

crackme = sys.argv[1]
with open(crackme, "r") as f:
    lines = f.readlines()  

TARGET = '4c827c4ca62781d707cd049da13539ee'

for line in lines:     
    line = line.strip()
    h = hashlib.md5(line.encode('utf-8')).hexdigest()
    if h == TARGET :
        print ("FOUND:" ,line, h)
        break
print("DONE")

Run this program passing in the FLAGS file as a parameter.

Conclusion

This sample was a really simple one to crack as the strings were also stored in the program without any obfuscation. The key takeaway is that a simple script in a language such as python can make this process less tedious and repeatable.

In our next article, we will look at a sample that stores samples in a more sophisticated manner.

Resources

• Internal Network Vs Host-Only https://notes.huskyhacks.dev/blog/malware-analysis-labs-internal-network-vs-host-only
• Samples Files and Challenge: https://tryhackme.com/r/room/basicmalwarere