(October 26, 2022, 08:35 PM)HTBContestant Wrote:
(October 26, 2022, 05:33 PM)11231123 Wrote:
(October 26, 2022, 05:09 PM)HTBContestant Wrote:
(October 26, 2022, 02:33 PM)11231123 Wrote: For reversing:

You're awesome, but how did you find the key and iv? The encrypted message I can see, but are the other values hidden inside the "securetransfer" file, and if so, how do you make that visible?

First find the function that does the encryption, you will see something like this:
  local_38 = 's';
  local_2f = 0x65;
  local_2e = 0x74;
  local_2d = 0x6b;
  local_1d = 0x74;
  local_1c = 0x69;
  local_37 = 0x75;
  local_36 = 0x70;
  local_22 = 0x6e;
  local_21 = 99;
  local_1b = 0x6f;
  local_32 = 0x65;
  local_31 = 99;
  local_33 = 0x73;
  local_20 = 0x72;
  local_1f = 0x79;
  local_30 = 0x72;
  local_26 = 0x66;
  local_25 = 0x6f;
  local_24 = 0x72;
  local_1a = 0x6e;
  local_2c = 0x65;
  local_2b = 0x79;
  local_2a = 0x75;
  local_29 = 0x73;
  local_28 = 0x65;
  local_27 = 100;
  local_23 = 0x65;
  local_35 = 0x65;
  local_34 = 0x72;
  local_1e = 0x70;
  local_19 = 0x21;
  local_48 = "someinitialvalue";
  local_40 = EVP_CIPHER_CTX_new();
  if (local_40 == (EVP_CIPHER_CTX *)0x0) {
    iVar1 = 0;
  }
  else {
    cipher = EVP_aes_256_cbc();
    iVar1 = EVP_EncryptInit_ex(local_40,cipher,(ENGINE *)0x0,&local_38,(uchar *)local_48)
Function definition for EVP_EncryptInit_ex from https://www.openssl.org/docs/man1.1.1/man3/EVP_EncryptInit_ex.html:
int EVP_EncryptInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
                        ENGINE *impl, const unsigned char *key, const unsigned char *iv);
So, we see that key is local_38 and iv is local_48.
Aye, perfect, I found the implementation of the encryption before but didn't know how to find the reference to that, but now I kind of get the hang of it. Like others said, I should really learn to use Ghidra it seems :D

(October 26, 2022, 08:24 PM)CrackItPwnIt Wrote:
(October 26, 2022, 01:59 PM)bowl Wrote: Which event log contains information about logon and logoff events? (for example: Setup)
> security
[+] Correct!

What is the event id for logs for a successful logon to a local computer? (for example: 1337)
> 4624
[+] Correct!

Which is the default Active Directory authentication protocol? (for example: http)
> kerberos
[+] Correct!

Looking at all the logon events, what is the AuthPackage that stands out as different from all the rest? (for example: http)
> ntlm
[+] Correct!

What is the timestamp of the suspicious login (yyyy-MM-ddTHH:mm:ss) UTC? (for example, 2021-10-10T08:23:12)

> 2022-09-28T13:10:57
[+] Correct!

How did you get the last one?

If you filtered for the NTLM AuthPackages only, that should leave about 50 Events I think. One of them has a "kali" workstation name, which is a bit suspicious. Not sure if that's how you're supposed to get there, but I basically did it manually.

Thanks, I got the correct one but apparently the timestamp I had was messed up!