CTF Write-Up: Hackback

• CTF challenge available at ctf-mystiko.com.
• Category: Forensics

— — — — —

This challenge introduces an scenario of network forensics. We are given an email file:

Provided email file

It can be imported in an email client, like linux’ Evolution.

Opening the email we see:

Contents of the email

This is a phishing email, telling the target to download a resume file protected by a password. It is an exe file (in fact, it’s a meterpreter file created with msfvenom). Running it on windows (with antivirus disabled) or on linux, for instance with

wine Resume.exe

Get Antonio Lara’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

doesn’t seem to do anything. It’s normal, it’s a meterpreter shell trying to connect back to a listener that doesn’t actually exist (for the relief of the CTF players, some of which asked me if it was safe to run the file). But if we inspect with wireshark the destination of the traffic (running wireshark on any interface while we execute Resume.exe), shows the IP and port to which the Resume file is trying to connect:

Captured network traffic when the file is run

Of course in a real scenario this should be done on a sandboxed system, like a VM, just in case we are actually creating a remote connection to our computer by running it.

The IP is 173.212.221.197 and the port is 34000.

Just for the sake of it, we browse that, to see what is on the server where the meterpreter shell Is trying to connect:

It’s a webserver. Fuzzing or guessing the file index.html shows a login page.

Inspection of the source code shows that it’s really not doing anything. The hint is in the comments:

There is a “server” where this login portal should be implemented. Again, fuzzing directories or guessing should find the server.html page:

The flag is hidden in the comments:

Flag