After Hours

This guide contains the answer and steps necessary to get to them for the After Hours room.

What is the flag?

The files we downloaded from the challenge are related to the WMI Repository of a Windows Host. We can use various tools to go through these files. But since the hint mentions standard autoruns/persistence tools don't find anything, we will start with something easier. strings. See if we cannot find anything usefull in the files. Some of the strings we will look for are: 'powershell, flag, THM {, CommandLineEventConsumer, bypass\downloadstring'.
```
strings -a OBJECTS.DATA > obj_ascii.txt

grep -iE 'flag|thm\{|powershell|CommandLineEventConsumer|bypass\downloadstring' obj_ascii.txt
```
We can see many hits, but a few stand out. Related to powershell. Lets narrow down our search to only list those entries.
```
grep -iE '/C powershell.exe' obj_ascii.txt
```
Looks like we have some base64 encoded payloads. Lets decode these parts.
```
grep -iE '/C powershell.exe' obj_ascii.txt | grep -ioP '(?<=-enc )\S+' > encoded.txt
base64 --decode encoded.txt > decoded.txt
```
Here we can see the decoded commands. These seem to be related to a class called "HardwareTelemetry". Lets see if we can find these in the file as well.
```
grep -iE 'HardwareTelemetry' obj_ascii.txt
```
Not much to work with here, but we can add some context and look at some of the previous and trailing lines of code.
```
grep -C 10 -iE 'HardwareTelemetry' obj_ascii.txt
```
Here we see some more. Namely, the encoded block below the actual class search hit.

Simply decoding this using base64 didn't work.

We need to do something else. Looking at the first powershell command we found earlier, we see some compression is used by deflating the stream. We can inflate it to get readable text.

We can see this is a Windows executable by the magic number (MZ). Further down, we find a command used to add a user to the domain containing an encoded string. Lets decode that.

Click for answer
THM{P4tch_op3ned_th3_BacKd00r}

After Hours

Table of contents

Task 1 - Hacker Holidays: Day 12