┌──(operator@kali)-[~/writeup]
└─$ cat flags.txt
flags captured
flag
THM{HavOc_C2_DeCRypTing_is_Fun_Fun_FUN}flag
THM{I_Can_SEE_ThE_fiL3_YoU_ToOk}┌──(operator@kali)-[~/writeup]
└─$ cat 01_session.log
session log
notepad.exe
find the md5sum and search on virustotal.com
0800270f20780800271dca5a08004500013fc02e4000800600000a0002260a000225e003005033964057b39a416650182014197c000000000113deadbeef0e9fb7d80000006300000000946cf2f65ac2d2b868328a18dedcc296cc40fa28fab41a0c34dcc010984410ca 8cd00c3e349290565aaa5a8c3aacd430
340cd2bc567802a30e1c2722bb2135dbfe9b76cc0f486e975aaf1f21a6ad13f9ef282131470a0191c974b4f5c2369005227811dcfb9708192e358fe9dfbf4214760291da15237a0f2e5db5b1e718d48ef01af5e724767c95a1b5c136cc744d75edcb1747847d1b6a22df5a23531442b73329c2b2ae46e1ab2506f548bd1b706892c6d4b8c66c206b0a668752ef7203b3e7627cb2fa5677998779347a00d75cadc5e60d67f78e4cbe1318e8d738475d774ae18dbb6ee25e0a3c3255dfe2b0fc3e220e87fd3a5c7bba8ed1df272387b57fd836f0
deadbeef
magic Byte header (4 bytes) deadbeef
Length Field (4 bytes) 00000113
AES key (32 bytes) 946cf2f65ac2d2b868328a18dedcc296cc40fa28fab41a0c34dcc010984410ca
Agent ID (2 bytes) b7d8
IV key 8cd00c3e349290565aaa5a8c3aacd430
Ciphertext
340cd2bc567802a30e1c2722bb2135dbfe9b76cc0f486e975aaf1f21a6ad13f9ef282131470a0191c974b4f5c2369005227811dcfb9708192e358fe9dfbf4214760291da15237a0f2e5db5b1e718d48ef01af5e724767c95a1b5c136cc744d75edcb1747847d1b6a22df5a23531442b73329c2b2ae46e1ab2506f548bd1b706892c6d4b8c66c206b0a668752ef7203b3e7627cb2fa5677998779347a00d75cadc5e60d67f78e4cbe1318e8d738475d774ae18dbb6ee25e0a3c3255dfe2b0fc3e220e87fd3a5c7bba8ed1df272387b57fd836f0
https://cyberchef.io
used http && frame.len > 300
frame.len > 300 && http
........8...c.:.\.w.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.c.m.d...e.x.e...`.../.c. .e.c.h.o. .T.H.M.{.H.a.v.O.c._.C.2._.D.e.C.R.y.p.T.i.n.g._.i.s._.F.u.n._.F.u.n._.F.U.N.}.
THM{HavOc_C2_DeCRypTing_is_Fun_Fun_FUN}
........8...c.:.\.w.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.c.m.d...e.x.e...V.../.c. .n.e.t. .u.s.e.r. .a.d.m.i.n.i.s.t.r.a.t.o. .W.f.D.3.h.z.3.A.X.Z.4.n. ./.a.d.d...........
administrato:WfD3hz3AXZ4n
...ZÖ..^...e...a Volume in drive C has no label.
Volume Serial Number is D284-F445
Directory of C:\Users\paco\Desktop\Files
11/14/2023 08:14 PM <DIR> .
11/14/2023 08:14 PM <DIR> ..
11/14/2023 08:14 PM 555 clients.csv
1 File(s) 555 bytes
2 Dir(s) 94,010,060,800 bytes free
....Ö..^........
C:\Users\paco\Desktop\Files\clients.csv
...Z¦òç..../...+username,password,email
jchristophle0,gH5#g..mL,acox0@clientserver.thm
arother1,fT4&tf>i'c%4%,efishenden1@clientserver.thm
mstitcher2,mB8#jDp*O$Tv}?,ograal2@clientserver.thm
smcbayne3,cV3&uD9w.,rdeeble3@clientserver.thm
afearby4,zO8.dugy9dq,mhartridge4@clientserver.thm
jrowley5,"mE8#uZV48nU&Mc,5",wcumes5@clientserver.thm
fbillitteri6,"kX7`\@4#+{a5,",asnalham6@clientserver.thm
jpowers7,kK2/ix%2i8U6L$A,awarrack7@clientserver.thm
cpattinson8,wX4\ZmomV78GBRa+,kstickels8@clientserver.thm
wrait9,THM{I_Can_SEE_ThE_fiL3_YoU_ToOk},fgoodall9@clientserver.thm
....¦òç........
THM{I_Can_SEE_ThE_fiL3_YoU_ToOk}