CyberDefender - BlackEnergy

:::spoiler TOC [TOC] ::: Challenge: https://cyberdefenders.org/blueteam-ctf-challenges/99

Scenario

A multinational corporation has been hit by a cyber attack that has led to the theft of sensitive data. The attack was carried out using a variant of the BlackEnergy v2 malware that has never been seen before. The company’s security team has acquired a memory dump of the infected machine, and they want you, as a soc analyst, to analyze the dump to understand the attack scope and impact.

==Q1==

Which volatility profile would be best for this machine?

Exploit

就是起手式:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

$ ./volatility_2.6_win64_standalone.exe -f CYBERDEF-567078-20230213-171333.raw imageinfo Volatility Foundation Volatility Framework 2.6 INFO : volatility.debug : Determining profile based on KDBG search... Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86) AS Layer1 : IA32PagedMemory (Kernel AS) AS Layer2 : FileAddressSpace (D:\NTU\CTF\CyberDefenders\BlackEnergy\CYBERDEF-567078-20230213-171333.raw) PAE type : No PAE DTB : 0x39000L KDBG : 0x8054cde0L Number of Processors : 1 Image Type (Service Pack) : 3 KPCR for CPU 0 : 0xffdff000L KUSER_SHARED_DATA : 0xffdf0000L Image date and time : 2023-02-13 18:29:11 UTC+0000 Image local date and time : 2023-02-13 10:29:11 -0800

:::spoiler Flag Flag: WinXPSP2x86 :::

==Q2==

How many processes were running when the image was acquired?

Exploit

直覺是pslist，然後扣掉exit的那些process，就是答案

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

$ ./volatility_2.6_win64_standalone.exe -f CYBERDEF-567078-20230213-171333.raw pslist Volatility Foundation Volatility Framework 2.6 Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit ---------- -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------ 0x89c037f8 System 4 0 55 245 ------ 0 0x89965020 smss.exe 368 4 3 19 ------ 0 2023-02-14 04:54:15 UTC+0000 0x89a98da0 csrss.exe 592 368 11 321 0 0 2023-02-14 04:54:15 UTC+0000 0x89a88da0 winlogon.exe 616 368 18 508 0 0 2023-02-14 04:54:15 UTC+0000 0x89938998 services.exe 660 616 15 240 0 0 2023-02-14 04:54:15 UTC+0000 0x89aa0020 lsass.exe 672 616 21 335 0 0 2023-02-14 04:54:15 UTC+0000 0x89aaa3d8 VBoxService.exe 832 660 9 115 0 0 2023-02-14 04:54:15 UTC+0000 0x89aab590 svchost.exe 880 660 21 295 0 0 2023-02-13 17:54:16 UTC+0000 0x89a9f6f8 svchost.exe 968 660 10 244 0 0 2023-02-13 17:54:17 UTC+0000 0x89730da0 svchost.exe 1060 660 51 1072 0 0 2023-02-13 17:54:17 UTC+0000 0x897289a8 svchost.exe 1108 660 5 78 0 0 2023-02-13 17:54:17 UTC+0000 0x899adda0 svchost.exe 1156 660 13 192 0 0 2023-02-13 17:54:17 UTC+0000 0x89733938 explorer.exe 1484 1440 14 489 0 0 2023-02-13 17:54:18 UTC+0000 0x897075d0 spoolsv.exe 1608 660 10 106 0 0 2023-02-13 17:54:18 UTC+0000 0x89694388 wscntfy.exe 480 1060 1 28 0 0 2023-02-13 17:54:30 UTC+0000 0x8969d2a0 alg.exe 540 660 5 102 0 0 2023-02-13 17:54:30 UTC+0000 0x89982da0 VBoxTray.exe 376 1484 13 125 0 0 2023-02-13 17:54:30 UTC+0000 0x8994a020 msmsgs.exe 636 1484 2 157 0 0 2023-02-13 17:54:30 UTC+0000 0x89a0b2f0 taskmgr.exe 1880 1484 0 -------- 0 0 2023-02-13 18:25:15 UTC+0000 2023-02-13 18:26:21 UTC+0000 0x899dd740 rootkit.exe 964 1484 0 -------- 0 0 2023-02-13 18:25:26 UTC+0000 2023-02-13 18:25:26 UTC+0000 0x89a18da0 cmd.exe 1960 964 0 -------- 0 0 2023-02-13 18:25:26 UTC+0000 2023-02-13 18:25:26 UTC+0000 0x896c5020 notepad.exe 528 1484 0 -------- 0 0 2023-02-13 18:26:55 UTC+0000 2023-02-13 18:27:46 UTC+0000 0x89a0d180 notepad.exe 1432 1484 0 -------- 0 0 2023-02-13 18:28:25 UTC+0000 2023-02-13 18:28:40 UTC+0000 0x899e6da0 notepad.exe 1444 1484 0 -------- 0 0 2023-02-13 18:28:42 UTC+0000 2023-02-13 18:28:47 UTC+0000 0x89a0fda0 DumpIt.exe 276 1484 1 25 0 0 2023-02-13 18:29:08 UTC+0000

:::spoiler Flag Flag: 19 :::

==Q3==

What is the process ID of cmd.exe?

Exploit

呈上題

:::spoiler Flag Flag: 1960 :::

==Q4==

What is the name of the most suspicious process?

Exploit

呈第3題，感覺這個process應該就是提權的工具

:::spoiler Flag Flag: rootkit.exe :::

==Q5==

Which process shows the highest likelihood of code injection?

Exploit

直覺會看malfind，然後找相關的process :::spoiler malfind result

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461

$ ./volatility_2.6_win64_standalone.exe -f CYBERDEF-567078-20230213-171333.raw malfind Volatility Foundation Volatility Framework 2.6 Process: csrss.exe Pid: 592 Address: 0x7f6f0000 Vad Tag: Vad Protection: PAGE_EXECUTE_READWRITE Flags: Protection: 6 0x7f6f0000 c8 00 00 00 84 01 00 00 ff ee ff ee 08 70 00 00 .............p.. 0x7f6f0010 08 00 00 00 00 fe 00 00 00 00 10 00 00 20 00 00 ................ 0x7f6f0020 00 02 00 00 00 20 00 00 8d 01 00 00 ff ef fd 7f ................ 0x7f6f0030 03 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x7f6f0000 c8000000 ENTER 0x0, 0x0 0x7f6f0004 8401 TEST [ECX], AL 0x7f6f0006 0000 ADD [EAX], AL 0x7f6f0008 ff DB 0xff 0x7f6f0009 ee OUT DX, AL 0x7f6f000a ff DB 0xff 0x7f6f000b ee OUT DX, AL 0x7f6f000c 087000 OR [EAX+0x0], DH 0x7f6f000f 0008 ADD [EAX], CL 0x7f6f0011 0000 ADD [EAX], AL 0x7f6f0013 0000 ADD [EAX], AL 0x7f6f0015 fe00 INC BYTE [EAX] 0x7f6f0017 0000 ADD [EAX], AL 0x7f6f0019 0010 ADD [EAX], DL 0x7f6f001b 0000 ADD [EAX], AL 0x7f6f001d 2000 AND [EAX], AL 0x7f6f001f 0000 ADD [EAX], AL 0x7f6f0021 0200 ADD AL, [EAX] 0x7f6f0023 0000 ADD [EAX], AL 0x7f6f0025 2000 AND [EAX], AL 0x7f6f0027 008d010000ff ADD [EBP-0xffffff], CL 0x7f6f002d ef OUT DX, EAX 0x7f6f002e fd STD 0x7f6f002f 7f03 JG 0x7f6f0034 0x7f6f0031 0008 ADD [EAX], CL 0x7f6f0033 06 PUSH ES 0x7f6f0034 0000 ADD [EAX], AL 0x7f6f0036 0000 ADD [EAX], AL 0x7f6f0038 0000 ADD [EAX], AL 0x7f6f003a 0000 ADD [EAX], AL 0x7f6f003c 0000 ADD [EAX], AL 0x7f6f003e 0000 ADD [EAX], AL Process: winlogon.exe Pid: 616 Address: 0x4a5e0000 Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE Flags: CommitCharge: 4, MemCommit: 1, PrivateMemory: 1, Protection: 6 0x4a5e0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x4a5e0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x4a5e0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x4a5e0030 00 00 00 00 25 00 25 00 01 00 00 00 00 00 00 00 ....%.%......... 0x4a5e0000 0000 ADD [EAX], AL 0x4a5e0002 0000 ADD [EAX], AL 0x4a5e0004 0000 ADD [EAX], AL 0x4a5e0006 0000 ADD [EAX], AL 0x4a5e0008 0000 ADD [EAX], AL 0x4a5e000a 0000 ADD [EAX], AL 0x4a5e000c 0000 ADD [EAX], AL 0x4a5e000e 0000 ADD [EAX], AL 0x4a5e0010 0000 ADD [EAX], AL 0x4a5e0012 0000 ADD [EAX], AL 0x4a5e0014 0000 ADD [EAX], AL 0x4a5e0016 0000 ADD [EAX], AL 0x4a5e0018 0000 ADD [EAX], AL 0x4a5e001a 0000 ADD [EAX], AL 0x4a5e001c 0000 ADD [EAX], AL 0x4a5e001e 0000 ADD [EAX], AL 0x4a5e0020 0000 ADD [EAX], AL 0x4a5e0022 0000 ADD [EAX], AL 0x4a5e0024 0000 ADD [EAX], AL 0x4a5e0026 0000 ADD [EAX], AL 0x4a5e0028 0000 ADD [EAX], AL 0x4a5e002a 0000 ADD [EAX], AL 0x4a5e002c 0000 ADD [EAX], AL 0x4a5e002e 0000 ADD [EAX], AL 0x4a5e0030 0000 ADD [EAX], AL 0x4a5e0032 0000 ADD [EAX], AL 0x4a5e0034 2500250001 AND EAX, 0x1002500 0x4a5e0039 0000 ADD [EAX], AL 0x4a5e003b 0000 ADD [EAX], AL 0x4a5e003d 0000 ADD [EAX], AL 0x4a5e003f 00 DB 0x0 Process: winlogon.exe Pid: 616 Address: 0x2afc0000 Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE Flags: CommitCharge: 4, MemCommit: 1, PrivateMemory: 1, Protection: 6 0x2afc0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x2afc0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x2afc0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x2afc0030 00 00 00 00 23 00 23 00 01 00 00 00 00 00 00 00 ....#.#......... 0x2afc0000 0000 ADD [EAX], AL 0x2afc0002 0000 ADD [EAX], AL 0x2afc0004 0000 ADD [EAX], AL 0x2afc0006 0000 ADD [EAX], AL 0x2afc0008 0000 ADD [EAX], AL 0x2afc000a 0000 ADD [EAX], AL 0x2afc000c 0000 ADD [EAX], AL 0x2afc000e 0000 ADD [EAX], AL 0x2afc0010 0000 ADD [EAX], AL 0x2afc0012 0000 ADD [EAX], AL 0x2afc0014 0000 ADD [EAX], AL 0x2afc0016 0000 ADD [EAX], AL 0x2afc0018 0000 ADD [EAX], AL 0x2afc001a 0000 ADD [EAX], AL 0x2afc001c 0000 ADD [EAX], AL 0x2afc001e 0000 ADD [EAX], AL 0x2afc0020 0000 ADD [EAX], AL 0x2afc0022 0000 ADD [EAX], AL 0x2afc0024 0000 ADD [EAX], AL 0x2afc0026 0000 ADD [EAX], AL 0x2afc0028 0000 ADD [EAX], AL 0x2afc002a 0000 ADD [EAX], AL 0x2afc002c 0000 ADD [EAX], AL 0x2afc002e 0000 ADD [EAX], AL 0x2afc0030 0000 ADD [EAX], AL 0x2afc0032 0000 ADD [EAX], AL 0x2afc0034 2300 AND EAX, [EAX] 0x2afc0036 2300 AND EAX, [EAX] 0x2afc0038 0100 ADD [EAX], EAX 0x2afc003a 0000 ADD [EAX], AL 0x2afc003c 0000 ADD [EAX], AL 0x2afc003e 0000 ADD [EAX], AL Process: winlogon.exe Pid: 616 Address: 0xe880000 Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE Flags: CommitCharge: 4, MemCommit: 1, PrivateMemory: 1, Protection: 6 0x0e880000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x0e880010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x0e880020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x0e880030 00 00 00 00 25 00 25 00 01 00 00 00 00 00 00 00 ....%.%......... 0x0e880000 0000 ADD [EAX], AL 0x0e880002 0000 ADD [EAX], AL 0x0e880004 0000 ADD [EAX], AL 0x0e880006 0000 ADD [EAX], AL 0x0e880008 0000 ADD [EAX], AL 0x0e88000a 0000 ADD [EAX], AL 0x0e88000c 0000 ADD [EAX], AL 0x0e88000e 0000 ADD [EAX], AL 0x0e880010 0000 ADD [EAX], AL 0x0e880012 0000 ADD [EAX], AL 0x0e880014 0000 ADD [EAX], AL 0x0e880016 0000 ADD [EAX], AL 0x0e880018 0000 ADD [EAX], AL 0x0e88001a 0000 ADD [EAX], AL 0x0e88001c 0000 ADD [EAX], AL 0x0e88001e 0000 ADD [EAX], AL 0x0e880020 0000 ADD [EAX], AL 0x0e880022 0000 ADD [EAX], AL 0x0e880024 0000 ADD [EAX], AL 0x0e880026 0000 ADD [EAX], AL 0x0e880028 0000 ADD [EAX], AL 0x0e88002a 0000 ADD [EAX], AL 0x0e88002c 0000 ADD [EAX], AL 0x0e88002e 0000 ADD [EAX], AL 0x0e880030 0000 ADD [EAX], AL 0x0e880032 0000 ADD [EAX], AL 0x0e880034 2500250001 AND EAX, 0x1002500 0x0e880039 0000 ADD [EAX], AL 0x0e88003b 0000 ADD [EAX], AL 0x0e88003d 0000 ADD [EAX], AL 0x0e88003f 00 DB 0x0 Process: winlogon.exe Pid: 616 Address: 0x16be0000 Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE Flags: CommitCharge: 4, MemCommit: 1, PrivateMemory: 1, Protection: 6 0x16be0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x16be0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x16be0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x16be0030 00 00 00 00 28 00 28 00 01 00 00 00 00 00 00 00 ....(.(......... 0x16be0000 0000 ADD [EAX], AL 0x16be0002 0000 ADD [EAX], AL 0x16be0004 0000 ADD [EAX], AL 0x16be0006 0000 ADD [EAX], AL 0x16be0008 0000 ADD [EAX], AL 0x16be000a 0000 ADD [EAX], AL 0x16be000c 0000 ADD [EAX], AL 0x16be000e 0000 ADD [EAX], AL 0x16be0010 0000 ADD [EAX], AL 0x16be0012 0000 ADD [EAX], AL 0x16be0014 0000 ADD [EAX], AL 0x16be0016 0000 ADD [EAX], AL 0x16be0018 0000 ADD [EAX], AL 0x16be001a 0000 ADD [EAX], AL 0x16be001c 0000 ADD [EAX], AL 0x16be001e 0000 ADD [EAX], AL 0x16be0020 0000 ADD [EAX], AL 0x16be0022 0000 ADD [EAX], AL 0x16be0024 0000 ADD [EAX], AL 0x16be0026 0000 ADD [EAX], AL 0x16be0028 0000 ADD [EAX], AL 0x16be002a 0000 ADD [EAX], AL 0x16be002c 0000 ADD [EAX], AL 0x16be002e 0000 ADD [EAX], AL 0x16be0030 0000 ADD [EAX], AL 0x16be0032 0000 ADD [EAX], AL 0x16be0034 2800 SUB [EAX], AL 0x16be0036 2800 SUB [EAX], AL 0x16be0038 0100 ADD [EAX], EAX 0x16be003a 0000 ADD [EAX], AL 0x16be003c 0000 ADD [EAX], AL 0x16be003e 0000 ADD [EAX], AL Process: winlogon.exe Pid: 616 Address: 0x2b010000 Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE Flags: CommitCharge: 4, MemCommit: 1, PrivateMemory: 1, Protection: 6 0x2b010000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x2b010010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x2b010020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x2b010030 00 00 00 00 2c 00 2c 00 01 00 00 00 00 00 00 00 ....,.,......... 0x2b010000 0000 ADD [EAX], AL 0x2b010002 0000 ADD [EAX], AL 0x2b010004 0000 ADD [EAX], AL 0x2b010006 0000 ADD [EAX], AL 0x2b010008 0000 ADD [EAX], AL 0x2b01000a 0000 ADD [EAX], AL 0x2b01000c 0000 ADD [EAX], AL 0x2b01000e 0000 ADD [EAX], AL 0x2b010010 0000 ADD [EAX], AL 0x2b010012 0000 ADD [EAX], AL 0x2b010014 0000 ADD [EAX], AL 0x2b010016 0000 ADD [EAX], AL 0x2b010018 0000 ADD [EAX], AL 0x2b01001a 0000 ADD [EAX], AL 0x2b01001c 0000 ADD [EAX], AL 0x2b01001e 0000 ADD [EAX], AL 0x2b010020 0000 ADD [EAX], AL 0x2b010022 0000 ADD [EAX], AL 0x2b010024 0000 ADD [EAX], AL 0x2b010026 0000 ADD [EAX], AL 0x2b010028 0000 ADD [EAX], AL 0x2b01002a 0000 ADD [EAX], AL 0x2b01002c 0000 ADD [EAX], AL 0x2b01002e 0000 ADD [EAX], AL 0x2b010030 0000 ADD [EAX], AL 0x2b010032 0000 ADD [EAX], AL 0x2b010034 2c00 SUB AL, 0x0 0x2b010036 2c00 SUB AL, 0x0 0x2b010038 0100 ADD [EAX], EAX 0x2b01003a 0000 ADD [EAX], AL 0x2b01003c 0000 ADD [EAX], AL 0x2b01003e 0000 ADD [EAX], AL Process: winlogon.exe Pid: 616 Address: 0x3ad10000 Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE Flags: CommitCharge: 4, MemCommit: 1, PrivateMemory: 1, Protection: 6 0x3ad10000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x3ad10010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x3ad10020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x3ad10030 00 00 00 00 25 00 25 00 01 00 00 00 00 00 00 00 ....%.%......... 0x3ad10000 0000 ADD [EAX], AL 0x3ad10002 0000 ADD [EAX], AL 0x3ad10004 0000 ADD [EAX], AL 0x3ad10006 0000 ADD [EAX], AL 0x3ad10008 0000 ADD [EAX], AL 0x3ad1000a 0000 ADD [EAX], AL 0x3ad1000c 0000 ADD [EAX], AL 0x3ad1000e 0000 ADD [EAX], AL 0x3ad10010 0000 ADD [EAX], AL 0x3ad10012 0000 ADD [EAX], AL 0x3ad10014 0000 ADD [EAX], AL 0x3ad10016 0000 ADD [EAX], AL 0x3ad10018 0000 ADD [EAX], AL 0x3ad1001a 0000 ADD [EAX], AL 0x3ad1001c 0000 ADD [EAX], AL 0x3ad1001e 0000 ADD [EAX], AL 0x3ad10020 0000 ADD [EAX], AL 0x3ad10022 0000 ADD [EAX], AL 0x3ad10024 0000 ADD [EAX], AL 0x3ad10026 0000 ADD [EAX], AL 0x3ad10028 0000 ADD [EAX], AL 0x3ad1002a 0000 ADD [EAX], AL 0x3ad1002c 0000 ADD [EAX], AL 0x3ad1002e 0000 ADD [EAX], AL 0x3ad10030 0000 ADD [EAX], AL 0x3ad10032 0000 ADD [EAX], AL 0x3ad10034 2500250001 AND EAX, 0x1002500 0x3ad10039 0000 ADD [EAX], AL 0x3ad1003b 0000 ADD [EAX], AL 0x3ad1003d 0000 ADD [EAX], AL 0x3ad1003f 00 DB 0x0 Process: winlogon.exe Pid: 616 Address: 0x3f750000 Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE Flags: CommitCharge: 4, MemCommit: 1, PrivateMemory: 1, Protection: 6 0x3f750000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x3f750010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x3f750020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x3f750030 00 00 00 00 27 00 27 00 01 00 00 00 00 00 00 00 ....'.'......... 0x3f750000 0000 ADD [EAX], AL 0x3f750002 0000 ADD [EAX], AL 0x3f750004 0000 ADD [EAX], AL 0x3f750006 0000 ADD [EAX], AL 0x3f750008 0000 ADD [EAX], AL 0x3f75000a 0000 ADD [EAX], AL 0x3f75000c 0000 ADD [EAX], AL 0x3f75000e 0000 ADD [EAX], AL 0x3f750010 0000 ADD [EAX], AL 0x3f750012 0000 ADD [EAX], AL 0x3f750014 0000 ADD [EAX], AL 0x3f750016 0000 ADD [EAX], AL 0x3f750018 0000 ADD [EAX], AL 0x3f75001a 0000 ADD [EAX], AL 0x3f75001c 0000 ADD [EAX], AL 0x3f75001e 0000 ADD [EAX], AL 0x3f750020 0000 ADD [EAX], AL 0x3f750022 0000 ADD [EAX], AL 0x3f750024 0000 ADD [EAX], AL 0x3f750026 0000 ADD [EAX], AL 0x3f750028 0000 ADD [EAX], AL 0x3f75002a 0000 ADD [EAX], AL 0x3f75002c 0000 ADD [EAX], AL 0x3f75002e 0000 ADD [EAX], AL 0x3f750030 0000 ADD [EAX], AL 0x3f750032 0000 ADD [EAX], AL 0x3f750034 27 DAA 0x3f750035 0027 ADD [EDI], AH 0x3f750037 0001 ADD [ECX], AL 0x3f750039 0000 ADD [EAX], AL 0x3f75003b 0000 ADD [EAX], AL 0x3f75003d 0000 ADD [EAX], AL 0x3f75003f 00 DB 0x0 Process: winlogon.exe Pid: 616 Address: 0x5d080000 Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE Flags: CommitCharge: 4, MemCommit: 1, PrivateMemory: 1, Protection: 6 0x5d080000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x5d080010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x5d080020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x5d080030 00 00 00 00 28 00 28 00 01 00 00 00 00 00 00 00 ....(.(......... 0x5d080000 0000 ADD [EAX], AL 0x5d080002 0000 ADD [EAX], AL 0x5d080004 0000 ADD [EAX], AL 0x5d080006 0000 ADD [EAX], AL 0x5d080008 0000 ADD [EAX], AL 0x5d08000a 0000 ADD [EAX], AL 0x5d08000c 0000 ADD [EAX], AL 0x5d08000e 0000 ADD [EAX], AL 0x5d080010 0000 ADD [EAX], AL 0x5d080012 0000 ADD [EAX], AL 0x5d080014 0000 ADD [EAX], AL 0x5d080016 0000 ADD [EAX], AL 0x5d080018 0000 ADD [EAX], AL 0x5d08001a 0000 ADD [EAX], AL 0x5d08001c 0000 ADD [EAX], AL 0x5d08001e 0000 ADD [EAX], AL 0x5d080020 0000 ADD [EAX], AL 0x5d080022 0000 ADD [EAX], AL 0x5d080024 0000 ADD [EAX], AL 0x5d080026 0000 ADD [EAX], AL 0x5d080028 0000 ADD [EAX], AL 0x5d08002a 0000 ADD [EAX], AL 0x5d08002c 0000 ADD [EAX], AL 0x5d08002e 0000 ADD [EAX], AL 0x5d080030 0000 ADD [EAX], AL 0x5d080032 0000 ADD [EAX], AL 0x5d080034 2800 SUB [EAX], AL 0x5d080036 2800 SUB [EAX], AL 0x5d080038 0100 ADD [EAX], EAX 0x5d08003a 0000 ADD [EAX], AL 0x5d08003c 0000 ADD [EAX], AL 0x5d08003e 0000 ADD [EAX], AL Process: winlogon.exe Pid: 616 Address: 0x62220000 Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE Flags: CommitCharge: 4, MemCommit: 1, PrivateMemory: 1, Protection: 6 0x62220000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x62220010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x62220020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x62220030 00 00 00 00 2a 00 2a 00 01 00 00 00 00 00 00 00 ....*.*......... 0x62220000 0000 ADD [EAX], AL 0x62220002 0000 ADD [EAX], AL 0x62220004 0000 ADD [EAX], AL 0x62220006 0000 ADD [EAX], AL 0x62220008 0000 ADD [EAX], AL 0x6222000a 0000 ADD [EAX], AL 0x6222000c 0000 ADD [EAX], AL 0x6222000e 0000 ADD [EAX], AL 0x62220010 0000 ADD [EAX], AL 0x62220012 0000 ADD [EAX], AL 0x62220014 0000 ADD [EAX], AL 0x62220016 0000 ADD [EAX], AL 0x62220018 0000 ADD [EAX], AL 0x6222001a 0000 ADD [EAX], AL 0x6222001c 0000 ADD [EAX], AL 0x6222001e 0000 ADD [EAX], AL 0x62220020 0000 ADD [EAX], AL 0x62220022 0000 ADD [EAX], AL 0x62220024 0000 ADD [EAX], AL 0x62220026 0000 ADD [EAX], AL 0x62220028 0000 ADD [EAX], AL 0x6222002a 0000 ADD [EAX], AL 0x6222002c 0000 ADD [EAX], AL 0x6222002e 0000 ADD [EAX], AL 0x62220030 0000 ADD [EAX], AL 0x62220032 0000 ADD [EAX], AL 0x62220034 2a00 SUB AL, [EAX] 0x62220036 2a00 SUB AL, [EAX] 0x62220038 0100 ADD [EAX], EAX 0x6222003a 0000 ADD [EAX], AL 0x6222003c 0000 ADD [EAX], AL 0x6222003e 0000 ADD [EAX], AL Process: svchost.exe Pid: 880 Address: 0x980000 Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE Flags: CommitCharge: 9, MemCommit: 1, PrivateMemory: 1, Protection: 6 0x00980000 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 MZ.............. 0x00980010 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@....... 0x00980020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x00980030 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 ................ 0x00980000 4d DEC EBP 0x00980001 5a POP EDX 0x00980002 90 NOP 0x00980003 0003 ADD [EBX], AL 0x00980005 0000 ADD [EAX], AL 0x00980007 000400 ADD [EAX+EAX], AL 0x0098000a 0000 ADD [EAX], AL 0x0098000c ff DB 0xff 0x0098000d ff00 INC DWORD [EAX] 0x0098000f 00b800000000 ADD [EAX+0x0], BH 0x00980015 0000 ADD [EAX], AL 0x00980017 004000 ADD [EAX+0x0], AL 0x0098001a 0000 ADD [EAX], AL 0x0098001c 0000 ADD [EAX], AL 0x0098001e 0000 ADD [EAX], AL 0x00980020 0000 ADD [EAX], AL 0x00980022 0000 ADD [EAX], AL 0x00980024 0000 ADD [EAX], AL 0x00980026 0000 ADD [EAX], AL 0x00980028 0000 ADD [EAX], AL 0x0098002a 0000 ADD [EAX], AL 0x0098002c 0000 ADD [EAX], AL 0x0098002e 0000 ADD [EAX], AL 0x00980030 0000 ADD [EAX], AL 0x00980032 0000 ADD [EAX], AL 0x00980034 0000 ADD [EAX], AL 0x00980036 0000 ADD [EAX], AL 0x00980038 0000 ADD [EAX], AL 0x0098003a 0000 ADD [EAX], AL 0x0098003c f8 CLC 0x0098003d 0000 ADD [EAX], AL 0x0098003f 00 DB 0x0

:::

:::spoiler Flag Flag: svchost.exe :::

==Q6==

There is an odd file referenced in the recent process. Provide the full path of that file.

Exploit

這一題是靠賽出來的，所以還是參考¹比較正常的解法，從上一題已經知道svchost.exe是已經被注入的process，所以我們可以把已經注入過的process dump出來，因為已經很久沒有做相關的題目所以有點卡，如果直接procdump的話是直接把沒有注入過且完整的process dump下來，放到virustotal只會一堆綠，所以要做的應該是malfind搭配dump才對，接著再去分析裡面的strings

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

$ ./volatility_2.6_win64_standalone.exe -f CYBERDEF-567078-20230213-171333.raw --profile WinXPSP2x86 malfind --pid 880 --dump-dir="./Exported Files/" $ strings ./Exported\ Files/process.0x89aab590.0x980000.dmp -n 15 !This program cannot be run in DOS mode. {3D5A1694-CC2C-4ee7-A3D5-A879A9E3A623} ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Content-Type: application/x-www-form-urlencoded DispatchCommand GetCurrentProcessId CoCreateInstance InterlockedExchange ConfAllocGetTextByNameA ConfAllocGetTextByNameW ConfGetListNodeByName ConfGetNodeByName ConfGetNodeTextA ConfGetNodeTextW ConfGetRootNode RkLoadKernelImage RkProtectObject SrvAddRequestBinaryData SrvAddRequestStringData @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@ !"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@q xCYBERDEF-567078_40BF25D3 C:\WINDOWS\system32\drivers\str.sys </=(>@>G>O>T>X> $ ./volatility_2.6_win64_standalone.exe -f CYBERDEF-567078-20230213-171333.raw --profile WinXPSP2x86 malfind --pid 880 --dump-dir="./Exported Files/" $ strings ./Exported\ Files/process.0x89aab590.0x980000.dmp -n 15 !This program cannot be run in DOS mode. {3D5A1694-CC2C-4ee7-A3D5-A879A9E3A623} ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Content-Type: application/x-www-form-urlencoded DispatchCommand GetCurrentProcessId CoCreateInstance InterlockedExchange ConfAllocGetTextByNameA ConfAllocGetTextByNameW ConfGetListNodeByName ConfGetNodeByName ConfGetNodeTextA ConfGetNodeTextW ConfGetRootNode RkLoadKernelImage RkProtectObject SrvAddRequestBinaryData SrvAddRequestStringData @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>@@@?456789:;<=@@@@@@@ !"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@q xCYBERDEF-567078_40BF25D3 C:\WINDOWS\system32\drivers\str.sys </=(>@>G>O>T>X>\> 030e0l0p0t0x0|0 gt; 030e0l0p0t0x0|0

:::spoiler Flag Flag: C:\WINDOWS\system32\drivers\str.sys :::

==Q7==

What is the name of the injected dll file loaded from the recent process?

Recon

這一題完全沒有想法，同樣是參考¹，學到一個新東西，不過思路差不多，我是想如果可以利用dlllist直接看pid 880 load進甚麼樣的dll就可以篩選出正確的答案，不過有一個新的plugin更強，叫做==ldrmodules==

The ldrmodules plugin can be used to list the loaded modules (DLLs) in a process, and it can also be used to detect unlinked/hidden DLLs. We can use this plugin to examine the malicious svchost.exe process, which has a PID of 880.

如果比對我的方法和¹的方法會發現就是只有差在答案的那一個dll沒有顯示出來而已

Exploit

:::spoiler dlllist (我的方法)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66

$ ./volatility_2.6_win64_standalone.exe -f CYBERDEF-567078-20230213-171333.raw --profile WinXPSP2x86 dlllist --pid 880 ************************************************************************ svchost.exe pid: 880 Command line : C:\WINDOWS\system32\svchost -k DcomLaunch Service Pack 3 Base Size LoadCount Path ---------- ---------- ---------- ---- 0x01000000 0x6000 0xffff C:\WINDOWS\system32\svchost.exe 0x7c900000 0xaf000 0xffff C:\WINDOWS\system32\ntdll.dll 0x7c800000 0xf6000 0xffff C:\WINDOWS\system32\Kernel32.dll 0x77dd0000 0x9b000 0xffff C:\WINDOWS\system32\ADVAPI32.dll 0x77e70000 0x92000 0xffff C:\WINDOWS\system32\RPCRT4.dll 0x77fe0000 0x11000 0xffff C:\WINDOWS\system32\Secur32.dll 0x5cb70000 0x26000 0x1 C:\WINDOWS\system32\ShimEng.dll 0x6f880000 0x1ca000 0x1 C:\WINDOWS\AppPatch\AcGenral.DLL 0x7e410000 0x91000 0x34c C:\WINDOWS\system32\USER32.dll 0x77f10000 0x49000 0x1f6 C:\WINDOWS\system32\GDI32.dll 0x76b40000 0x2d000 0x4 C:\WINDOWS\system32\WINMM.dll 0x774e0000 0x13d000 0x7e C:\WINDOWS\system32\ole32.dll 0x77c10000 0x58000 0x2ee C:\WINDOWS\system32\msvcrt.dll 0x77120000 0x8b000 0x74 C:\WINDOWS\system32\OLEAUT32.dll 0x77be0000 0x15000 0x1 C:\WINDOWS\system32\MSACM32.dll 0x77c00000 0x8000 0x7 C:\WINDOWS\system32\VERSION.dll 0x7c9c0000 0x817000 0x3 C:\WINDOWS\system32\SHELL32.dll 0x77f60000 0x76000 0x76 C:\WINDOWS\system32\SHLWAPI.dll 0x769c0000 0xb4000 0x4 C:\WINDOWS\system32\USERENV.dll 0x5ad70000 0x38000 0x1 C:\WINDOWS\system32\UxTheme.dll 0x773d0000 0x103000 0x4 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll 0x5d090000 0x9a000 0x1 C:\WINDOWS\system32\comctl32.dll 0x77690000 0x21000 0x1 C:\WINDOWS\system32\NTMARTA.DLL 0x71bf0000 0x13000 0x1 C:\WINDOWS\system32\SAMLIB.dll 0x76f60000 0x2c000 0x2 C:\WINDOWS\system32\WLDAP32.dll 0x76a80000 0x64000 0x1 c:\windows\system32\rpcss.dll 0x71ab0000 0x17000 0x23 c:\windows\system32\WS2_32.dll 0x71aa0000 0x8000 0x24 c:\windows\system32\WS2HELP.dll 0x00670000 0x2c5000 0x1 C:\WINDOWS\system32\xpsp2res.dll 0x76fd0000 0x7f000 0x4 C:\WINDOWS\system32\CLBCATQ.DLL 0x77050000 0xc5000 0x4 C:\WINDOWS\system32\COMRes.dll 0x760f0000 0x53000 0x1 c:\windows\system32\termsrv.dll 0x74f70000 0x6000 0x1 c:\windows\system32\ICAAPI.dll 0x77920000 0xf3000 0x1 c:\windows\system32\SETUPAPI.dll 0x76c30000 0x2e000 0x1 C:\WINDOWS\system32\WINTRUST.dll 0x77a80000 0x95000 0x6c C:\WINDOWS\system32\CRYPT32.dll 0x77b20000 0x12000 0x6b C:\WINDOWS\system32\MSASN1.dll 0x76c90000 0x28000 0x1 C:\WINDOWS\system32\IMAGEHLP.dll 0x776c0000 0x12000 0x1 c:\windows\system32\AUTHZ.dll 0x75110000 0x1f000 0x1 c:\windows\system32\mstlsapi.dll 0x77cc0000 0x32000 0x1 c:\windows\system32\ACTIVEDS.dll 0x76e10000 0x25000 0x1 c:\windows\system32\adsldpc.dll 0x5b860000 0x55000 0x5 C:\WINDOWS\system32\NETAPI32.dll 0x76b20000 0x11000 0x1 c:\windows\system32\ATL.DLL 0x76bc0000 0xf000 0x1 C:\WINDOWS\system32\REGAPI.dll 0x68000000 0x36000 0x1 C:\WINDOWS\system32\rsaenh.dll 0x74980000 0x113000 0x1 C:\WINDOWS\system32\msxml3.dll 0x771b0000 0xaa000 0x69 C:\WINDOWS\system32\wininet.dll 0x71ad0000 0x9000 0x1 C:\WINDOWS\system32\wsock32.dll 0x76ee0000 0x3c000 0x2 C:\WINDOWS\system32\RASAPI32.DLL 0x76e90000 0x12000 0x2 C:\WINDOWS\system32\rasman.dll 0x76eb0000 0x2f000 0x2 C:\WINDOWS\system32\TAPI32.dll 0x76e80000 0xe000 0x3 C:\WINDOWS\system32\rtutils.dll 0x722b0000 0x5000 0x1 C:\WINDOWS\system32\sensapi.dll 0x7e1e0000 0xa2000 0x1 C:\WINDOWS\system32\urlmon.dll 0x71a50000 0x3f000 0x1 C:\WINDOWS\System32\mswsock.dll 0x76f20000 0x27000 0x1 C:\WINDOWS\system32\DNSAPI.dll 0x76fc0000 0x6000 0x1 C:\WINDOWS\system32\rasadhlp.dll

:::

:::spoiler ldrmodules (¹的方法)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62

$ ./volatility_2.6_win64_standalone.exe -f CYBERDEF-567078-20230213-171333.raw --profile WinXPSP2x86 ldrmodules --pid 880 Pid Process Base InLoad InInit InMem MappedPath -------- -------------------- ---------- ------ ------ ----- ---------- 880 svchost.exe 0x6f880000 True True True \WINDOWS\AppPatch\AcGenral.dll 880 svchost.exe 0x01000000 True False True \WINDOWS\system32\svchost.exe 880 svchost.exe 0x77f60000 True True True \WINDOWS\system32\shlwapi.dll 880 svchost.exe 0x74f70000 True True True \WINDOWS\system32\icaapi.dll 880 svchost.exe 0x76f60000 True True True \WINDOWS\system32\wldap32.dll 880 svchost.exe 0x77c00000 True True True \WINDOWS\system32\version.dll 880 svchost.exe 0x5ad70000 True True True \WINDOWS\system32\uxtheme.dll 880 svchost.exe 0x76e80000 True True True \WINDOWS\system32\rtutils.dll 880 svchost.exe 0x771b0000 True True True \WINDOWS\system32\wininet.dll 880 svchost.exe 0x76c90000 True True True \WINDOWS\system32\imagehlp.dll 880 svchost.exe 0x76bc0000 True True True \WINDOWS\system32\regapi.dll 880 svchost.exe 0x77dd0000 True True True \WINDOWS\system32\advapi32.dll 880 svchost.exe 0x76f20000 True True True \WINDOWS\system32\dnsapi.dll 880 svchost.exe 0x77be0000 True True True \WINDOWS\system32\msacm32.dll 880 svchost.exe 0x7e1e0000 True True True \WINDOWS\system32\urlmon.dll 880 svchost.exe 0x68000000 True True True \WINDOWS\system32\rsaenh.dll 880 svchost.exe 0x722b0000 True True True \WINDOWS\system32\sensapi.dll 880 svchost.exe 0x76e10000 True True True \WINDOWS\system32\adsldpc.dll 880 svchost.exe 0x76b40000 True True True \WINDOWS\system32\winmm.dll 880 svchost.exe 0x773d0000 True True True \WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll 880 svchost.exe 0x71a50000 True True True \WINDOWS\system32\mswsock.dll 880 svchost.exe 0x5b860000 True True True \WINDOWS\system32\netapi32.dll 880 svchost.exe 0x00670000 True True True \WINDOWS\system32\xpsp2res.dll 880 svchost.exe 0x76e90000 True True True \WINDOWS\system32\rasman.dll 880 svchost.exe 0x77a80000 True True True \WINDOWS\system32\crypt32.dll 880 svchost.exe 0x71ab0000 True True True \WINDOWS\system32\ws2_32.dll 880 svchost.exe 0x77cc0000 True True True \WINDOWS\system32\activeds.dll 880 svchost.exe 0x71ad0000 True True True \WINDOWS\system32\wsock32.dll 880 svchost.exe 0x774e0000 True True True \WINDOWS\system32\ole32.dll 880 svchost.exe 0x77920000 True True True \WINDOWS\system32\setupapi.dll 880 svchost.exe 0x7e410000 True True True \WINDOWS\system32\user32.dll 880 svchost.exe 0x7c900000 True True True \WINDOWS\system32\ntdll.dll 880 svchost.exe 0x77f10000 True True True \WINDOWS\system32\gdi32.dll 880 svchost.exe 0x77120000 True True True \WINDOWS\system32\oleaut32.dll 880 svchost.exe 0x5cb70000 True True True \WINDOWS\system32\shimeng.dll 880 svchost.exe 0x74980000 True True True \WINDOWS\system32\msxml3.dll 880 svchost.exe 0x009a0000 False False False \WINDOWS\system32\msxml3r.dll 880 svchost.exe 0x77e70000 True True True \WINDOWS\system32\rpcrt4.dll 880 svchost.exe 0x769c0000 True True True \WINDOWS\system32\userenv.dll 880 svchost.exe 0x7c800000 True True True \WINDOWS\system32\Kernel32.dll 880 svchost.exe 0x76fd0000 True True True \WINDOWS\system32\clbcatq.dll 880 svchost.exe 0x76b20000 True True True \WINDOWS\system32\atl.dll 880 svchost.exe 0x71bf0000 True True True \WINDOWS\system32\samlib.dll 880 svchost.exe 0x77690000 True True True \WINDOWS\system32\ntmarta.dll 880 svchost.exe 0x77c10000 True True True \WINDOWS\system32\msvcrt.dll 880 svchost.exe 0x760f0000 True True True \WINDOWS\system32\termsrv.dll 880 svchost.exe 0x76fc0000 True True True \WINDOWS\system32\rasadhlp.dll 880 svchost.exe 0x76c30000 True True True \WINDOWS\system32\wintrust.dll 880 svchost.exe 0x7c9c0000 True True True \WINDOWS\system32\shell32.dll 880 svchost.exe 0x77050000 True True True \WINDOWS\system32\comres.dll 880 svchost.exe 0x76eb0000 True True True \WINDOWS\system32\tapi32.dll 880 svchost.exe 0x76a80000 True True True \WINDOWS\system32\rpcss.dll 880 svchost.exe 0x5d090000 True True True \WINDOWS\system32\comctl32.dll 880 svchost.exe 0x71aa0000 True True True \WINDOWS\system32\ws2help.dll 880 svchost.exe 0x776c0000 True True True \WINDOWS\system32\authz.dll 880 svchost.exe 0x76ee0000 True True True \WINDOWS\system32\rasapi32.dll 880 svchost.exe 0x77b20000 True True True \WINDOWS\system32\msasn1.dll 880 svchost.exe 0x75110000 True True True \WINDOWS\system32\mstlsapi.dll 880 svchost.exe 0x77fe0000 True True True \WINDOWS\system32\secur32.dll

::: 可以看到==msxml3r.dll==的三種狀態都是False，代表這個dll不在已經load的memory中，也不在初始化的階段，更不在目前的process memory中，意味著別的工具試圖隱藏該dll

:::spoiler Flag Flag: msxml3r.dll :::

==Q8==

What is the base address of the injected dll?

Exploit

承接第六題，知道malfind之後，他會顯示base address

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44

$ ./volatility_2.6_win64_standalone.exe -f CYBERDEF-567078-20230213-171333.raw --profile WinXPSP2x86 malfind --pid 880 --dump-dir=" ./Exported Files/" Volatility Foundation Volatility Framework 2.6 Process: svchost.exe Pid: 880 Address: 0x980000 Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE Flags: CommitCharge: 9, MemCommit: 1, PrivateMemory: 1, Protection: 6 0x00980000 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 MZ.............. 0x00980010 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@....... 0x00980020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x00980030 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 ................ 0x00980000 4d DEC EBP 0x00980001 5a POP EDX 0x00980002 90 NOP 0x00980003 0003 ADD [EBX], AL 0x00980005 0000 ADD [EAX], AL 0x00980007 000400 ADD [EAX+EAX], AL 0x0098000a 0000 ADD [EAX], AL 0x0098000c ff DB 0xff 0x0098000d ff00 INC DWORD [EAX] 0x0098000f 00b800000000 ADD [EAX+0x0], BH 0x00980015 0000 ADD [EAX], AL 0x00980017 004000 ADD [EAX+0x0], AL 0x0098001a 0000 ADD [EAX], AL 0x0098001c 0000 ADD [EAX], AL 0x0098001e 0000 ADD [EAX], AL 0x00980020 0000 ADD [EAX], AL 0x00980022 0000 ADD [EAX], AL 0x00980024 0000 ADD [EAX], AL 0x00980026 0000 ADD [EAX], AL 0x00980028 0000 ADD [EAX], AL 0x0098002a 0000 ADD [EAX], AL 0x0098002c 0000 ADD [EAX], AL 0x0098002e 0000 ADD [EAX], AL 0x00980030 0000 ADD [EAX], AL 0x00980032 0000 ADD [EAX], AL 0x00980034 0000 ADD [EAX], AL 0x00980036 0000 ADD [EAX], AL 0x00980038 0000 ADD [EAX], AL 0x0098003a 0000 ADD [EAX], AL 0x0098003c f8 CLC 0x0098003d 0000 ADD [EAX], AL 0x0098003f 00 DB 0x0

:::spoiler Flag Flag: 0x980000 :::

Reference

1. BlackEnergy Walkthrough — Cyberdefenders ↩ ↩² ↩³ ↩⁴