Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
12. Bonus: Capture The Flag
SECRET//NOFORN
Capture The Flag
('excerpt' missing)
Setup
On the share (\\FS-01\share\NewDeveloperExercises\CaptureTheFlags) there is a VMVirtual Machine titled "New Developer CTFCapture the Flag Windows 8.1 x64". Copy the VMVirtual Machine folder to your local machine. If VMWare asks, you copied it.
Submitting Answers
Text Here
Challenge 1: Survey
For this challenge you will be collecting information about the target machine (CTFCapture the Flag VMVirtual Machine). This is useful for understanding future deployments against a machine. Surveys can reveal many things about a machine or its network.
Challenge 1: To capture this flag you will need to collect the following information about the CTFCapture the Flag VM.
Machine GUID
- User Name
- Computer Name
Installed Applications
Network Card MACApple Operating System Addresses
- List of all mounted volumes
Process List
Now, have your tool output the survey data (raw) into a file in Desktop\Results\Survey\Survet.txt. Shortly after, you'll have your first flag!
Challenge 2: File Collection
File Collection is also an important part of what we do. Remember the main goal is to enable the collection of FI. In this line of work we run into limitations that aren't always a problem for normal software developers. Unfortunately, we often run into bandwitdth and/or time constraints when trying to retreive information from a target computer. Thus, when designing or configuring a tool, compression, throttling, collection prioritization, and file flattening are things you should consider.
Challenge 2: Collect all of the files from User #?'s user directory (C:\Users\User #?) with the extensions *.doc, *.docx, *.xlsx, and *.pdf. You will then need to reconstruct the collected files in the Results\File Collection folder on the Desktop.
For example, let's say I collected the following files:
C:\Users\User #?\Desktop\Passwords.xlsx
C:\Users\User #?\Pictures\MyContacts.docx
C:\Users\User #?\AppData\Local\Temp\WhereIKeepMyNukes.pdf
Then, the folder structure in the Results\File Collection directory would look like this:
_C
Users
User #?
Desktop
Passwords.xlsx
Pictures
MyContacts.docx
AppData
Local
Temp
WhereIKeepMyNukes.pdf
Do not compress or encrypt any of the collected files. When you are done, signal the watcher that all files are collected by setting an event with the name {DEC334AC-E1E3-4582-9D4D-75A6201F053B} (See MSDN: OpenEvent and SetEvent). After your files are validated, your second flag should then appear!
Challenge 3: Compression and Encryption
Almost all of our tools utilize some combination of compression and encryption. Whenever we're sending data back over the internet, or storing the data for later exfil, it needs to be protected. The type of compression and encryption used is dependent upon many factors and should be decided on a per tool basis. SecureBuffer (or the buffer library) is a library of readily available compression and encryptoion algorithms (there should never be a need to roll your own compression or encryption - these are very signaturable things). So, for this challenge you will need to download the attached files (ImprovedDummy.exe, PubKey.pem).
Challenge 3: Compress and encrypt the dummy payload to retrieve the flag.
- Download the attached files (ImprovedDummy.exe, PubKey.pem)
- Use SecureBuffer/Buffers Library) to compress the binary using ZLIB compression.
- Encrypt the buffer using the supplied public key
- Dump the buffer into a file (raw) named ImprovedDummy.exe.enc in Results\Compression and Encryption
The watcher on the wall will give you the third flag upon completion.
Challenge 4: Payload Deployment
Many of our tools utilize other processes on the machine (sometimes our own).
Challenge 5: System Monitoring & Manipulation
Watch for registry key change, process list, window hooks?
Challenge 6: Persistence
To maintain access to a machine we want to modify the target machine in a way that our code/binary is re-run after it has been stopped (reboot, logoff, possibly even wiped). To do this we can take advantage of mechanisms that Windows itself uses as well as flaws found in the startup process.
Challenge 6: Use the Task Scheduler, a well-known persistence mechanism, to persist ImprovedDummy across logon/logoff.
- See MSDNMicrosoft Developer Network ITaskScheduler
- The ITaskScheduler is a COM interface (a big part of Windows object-oriented design).
- Create a scheduled task that persists C:\Users\User #?\AppData\Roaming\ImprovedDummy.exe
- Create a trigger so that the command is run everytime a logon event occurs for User #?.
- Although not required, try to go through and understand all that is happening with the COM calls that are required.
To retreive the flag, restart the VM.
Challenge 7: Data Transfer
Once we have taken our surveys and collect our files the next step is getting that data back to IOC. There is no common interface for transferring data. Sometimes it's storing data on removable media and sometimes it's mimicking web traffic. In some cases, we can send data to another process so that it can exfil.
Challenge 7: Assume that the watcher process has a cool technique for mimicking web traffic. Anything that it receives over its named pipe it will forward to the LPListening Post (listening post) via the internet to an IOCInformation Operation Center LP.
- Use the survey code from Challenge 1.
- Connect to the named pipe \\.\pipe\{5A426ADB-11B3-4492-8602-380317833226}
- Send the survey data over the named pipe.
Once the data is received by the LP, the first half of the flag will appear.
To obtain the second half of the flag you will use the Windows Sockets APIApplication Programming Interface to send the survey data to a real LP.
- Read throught the Windows Sockets API
- Connect and send data to xx.xx.xx.xx port 7777(UDPUser Datagram Protocol)
- Once verified, the LPListening Post will send you "tasking" the tasking is the second half of the flag.
Challenge 8: PSPPersonal Security Product (Anti-Virus) Evasion
Since our code is malicious in nature, PSPs (personal security products) are looking for us. There are many different types of signatures that PSPs use to try to determine whether a binary is attempting to do something malicious. In many cases, we can evade detection by PSPs by understanding how they catch us and creating workarounds that accomplish the same tasks.
Challenge 8: You will find the source to a piece of malware at \\FS-01\share\CTF\... You will need to modify this executable so it no longer get's caught by Kaspersky
- Copy the source to your machine and compile it Release_Dynamic Win32
- Go to the PSPPersonal Security Product (Anti-Virus) Evasion snapshot on the CTFCapture the Flag VM
- Verify that the executable is blocked by the PSP
- Note the issue the PSPPersonal Security Product (Anti-Virus) raises with the binary
- Modify ____ to defeat the PSP.
Once the executable is able to run, the flag will be presented.
Challenge 9: Execution Vectors
Trojan - take winrar and trojan it, validate resources and application startup
Challenge 10: Privilege Escalation
Describe Artillery UACUser Account Control Bypass, Have them write it to execute ImprovedDummy as Administrator.
Finishing Up
As we go on, we remember, all the time we...
SECRET//NOFORN