← ./home
root@mayhem:~/thm#
SESSION ACTIVE

thm log

MAYHEMTryHackMe

PLATFORM TryHackMe ROOM Mayhem
thm privesc
▼ scroll to begin
┌──(operator@kali)-[~/writeup] └─$ cat flags.txt

flags captured

flag
THM{HavOc_C2_DeCRypTing_is_Fun_Fun_FUN}
flag
THM{I_Can_SEE_ThE_fiL3_YoU_ToOk}
┌──(operator@kali)-[~/writeup] └─$ cat 01_session.log

session log

image
image

notepad.exe
image

find the md5sum and search on virustotal.com 
image




0800270f20780800271dca5a08004500013fc02e4000800600000a0002260a000225e003005033964057b39a416650182014197c000000000113deadbeef0e9fb7d80000006300000000946cf2f65ac2d2b868328a18dedcc296cc40fa28fab41a0c34dcc010984410ca 8cd00c3e349290565aaa5a8c3aacd430
340cd2bc567802a30e1c2722bb2135dbfe9b76cc0f486e975aaf1f21a6ad13f9ef282131470a0191c974b4f5c2369005227811dcfb9708192e358fe9dfbf4214760291da15237a0f2e5db5b1e718d48ef01af5e724767c95a1b5c136cc744d75edcb1747847d1b6a22df5a23531442b73329c2b2ae46e1ab2506f548bd1b706892c6d4b8c66c206b0a668752ef7203b3e7627cb2fa5677998779347a00d75cadc5e60d67f78e4cbe1318e8d738475d774ae18dbb6ee25e0a3c3255dfe2b0fc3e220e87fd3a5c7bba8ed1df272387b57fd836f0
deadbeef
magic Byte header (4 bytes)  deadbeef
Length Field  (4 bytes) 00000113
AES key    (32 bytes)  946cf2f65ac2d2b868328a18dedcc296cc40fa28fab41a0c34dcc010984410ca
Agent ID   (2 bytes)  b7d8
IV key  8cd00c3e349290565aaa5a8c3aacd430
Ciphertext 
340cd2bc567802a30e1c2722bb2135dbfe9b76cc0f486e975aaf1f21a6ad13f9ef282131470a0191c974b4f5c2369005227811dcfb9708192e358fe9dfbf4214760291da15237a0f2e5db5b1e718d48ef01af5e724767c95a1b5c136cc744d75edcb1747847d1b6a22df5a23531442b73329c2b2ae46e1ab2506f548bd1b706892c6d4b8c66c206b0a668752ef7203b3e7627cb2fa5677998779347a00d75cadc5e60d67f78e4cbe1318e8d738475d774ae18dbb6ee25e0a3c3255dfe2b0fc3e220e87fd3a5c7bba8ed1df272387b57fd836f0
https://cyberchef.io
image
image


used http && frame.len > 300
image


frame.len > 300 && http
image


........8...c.:.\.w.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.c.m.d...e.x.e...`.../.c. .e.c.h.o. .T.H.M.{.H.a.v.O.c._.C.2._.D.e.C.R.y.p.T.i.n.g._.i.s._.F.u.n._.F.u.n._.F.U.N.}.
THM{HavOc_C2_DeCRypTing_is_Fun_Fun_FUN}

image

........8...c.:.\.w.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.c.m.d...e.x.e...V.../.c. .n.e.t. .u.s.e.r. .a.d.m.i.n.i.s.t.r.a.t.o. .W.f.D.3.h.z.3.A.X.Z.4.n. ./.a.d.d...........
administrato:WfD3hz3AXZ4n

image


...ZÖ..^...e...a Volume in drive C has no label.
 Volume Serial Number is D284-F445

 Directory of C:\Users\paco\Desktop\Files

11/14/2023  08:14 PM    <DIR>          .
11/14/2023  08:14 PM    <DIR>          ..
11/14/2023  08:14 PM               555 clients.csv
               1 File(s)            555 bytes
               2 Dir(s)  94,010,060,800 bytes free
....Ö..^........
image


C:\Users\paco\Desktop\Files\clients.csv
...Z¦òç..../...+username,password,email
jchristophle0,gH5#g..mL,acox0@clientserver.thm
arother1,fT4&tf>i'c%4%,efishenden1@clientserver.thm
mstitcher2,mB8#jDp*O$Tv}?,ograal2@clientserver.thm
smcbayne3,cV3&uD9w.,rdeeble3@clientserver.thm
afearby4,zO8.dugy9dq,mhartridge4@clientserver.thm
jrowley5,"mE8#uZV48nU&Mc,5",wcumes5@clientserver.thm
fbillitteri6,"kX7`\@4#+{a5,",asnalham6@clientserver.thm
jpowers7,kK2/ix%2i8U6L$A,awarrack7@clientserver.thm
cpattinson8,wX4\ZmomV78GBRa+,kstickels8@clientserver.thm
wrait9,THM{I_Can_SEE_ThE_fiL3_YoU_ToOk},fgoodall9@clientserver.thm
....¦òç........
image

THM{I_Can_SEE_ThE_fiL3_YoU_ToOk}