【CyberDefenders】BlackEnergy【Walkthrough】

# 初めに
どうも、クソ雑魚のなんちゃてエンジニアです。
本記事は ___[CyberDefenders](https://cyberdefenders.org/)___ （以下リンク参考）の「___BlackEnergy___」にチャレンジした際のWalkthroughになります

https://cyberdefenders.org/blueteam-ctf-challenges/99

※本チャレンジについてはRed側のペネトレというよりはBlue側の分析力を問われるものになります。

# Which volatility profile would be best for this machine?
`imageinfo`で出ます。
```bash
remnux@remnux:~/Downloads$ vol.py -f CYBERDEF-567078-20230213-171333.raw imageinfo
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : WinXPSP2x86, WinXPSP3x86 (Instantiated with WinXPSP2x86)
                     AS Layer1 : IA32PagedMemory (Kernel AS)
                     AS Layer2 : FileAddressSpace (/home/remnux/Downloads/CYBERDEF-567078-20230213-171333.raw)
                      PAE type : No PAE
                           DTB : 0x39000L
                          KDBG : 0x8054cde0L
          Number of Processors : 1
     Image Type (Service Pack) : 3
                KPCR for CPU 0 : 0xffdff000L
             KUSER_SHARED_DATA : 0xffdf0000L
           Image date and time : 2023-02-13 18:29:11 UTC+0000
     Image local date and time : 2023-02-13 10:29:11 -0800
```
どれかが答えでしょうね。

# How many processes were running when the image was acquired?
`pslist`でもいいのですが、このコマンドで出ない隠蔽されているProcessも考慮して`psxview`で確認します。
```bash
remnux@remnux:~/Downloads$ vol.py -f CYBERDEF-567078-20230213-171333.raw --profile=WinXPSP2x86 psxview
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
Offset(P)  Name                    PID pslist psscan thrdproc pspcid csrss session deskthrd ExitTime
---------- -------------------- ------ ------ ------ -------- ------ ----- ------- -------- --------
0x09a88da0 winlogon.exe            616 True   True   True     True   True  True    True     
0x09aa0020 lsass.exe               672 True   True   True     True   True  True    True     
0x0994a020 msmsgs.exe              636 True   True   True     True   True  True    True     
0x097289a8 svchost.exe            1108 True   True   True     True   True  True    True     
0x09982da0 VBoxTray.exe            376 True   True   True     True   True  True    True     
0x09a9f6f8 svchost.exe             968 True   True   True     True   True  True    True     
0x09aab590 svchost.exe             880 True   True   True     True   True  True    True     
0x09aaa3d8 VBoxService.exe         832 True   True   True     True   True  True    True     
0x09694388 wscntfy.exe             480 True   True   True     True   True  True    True     
0x09730da0 svchost.exe            1060 True   True   True     True   True  True    True     
0x097075d0 spoolsv.exe            1608 True   True   True     True   True  True    True     
0x099adda0 svchost.exe            1156 True   True   True     True   True  True    True     
0x09938998 services.exe            660 True   True   True     True   True  True    True     
0x0969d2a0 alg.exe                 540 True   True   True     True   True  True    True     
0x09a0fda0 DumpIt.exe              276 True   True   True     True   True  True    True     
0x09733938 explorer.exe           1484 True   True   True     True   True  True    True     
0x09a0d180 notepad.exe            1432 True   True   False    True   False False   False    2023-02-13 18:28:40 UTC+0000
0x09a18da0 cmd.exe                1960 True   True   False    True   False False   False    2023-02-13 18:25:26 UTC+0000
0x099e6da0 notepad.exe            1444 True   True   False    True   False False   False    2023-02-13 18:28:47 UTC+0000
0x096c5020 notepad.exe             528 True   True   False    True   False False   False    2023-02-13 18:27:46 UTC+0000
0x099dd740 rootkit.exe             964 True   True   False    True   False False   False    2023-02-13 18:25:26 UTC+0000
0x09c037f8 System                    4 True   True   True     True   False False   False    
0x09a98da0 csrss.exe               592 True   True   True     True   False True    True     
0x09a0b2f0 taskmgr.exe            1880 True   True   False    True   False False   False    2023-02-13 18:26:21 UTC+0000
0x09965020 smss.exe                368 True   True   True     True   False False   False    
remnux@remnux:~/Downloads$ 
```
後はExitを考慮するだけですね。

# What is the process ID of cmd.exe?
前の問題のコマンドで確認できます。

# What is the name of the most suspicious process?
1つ怪しいProcessがありますね。

# Which process shows the highest likelihood of code injection?
`malfind`コマンドで確認できます。
```bash
remnux@remnux:~/Downloads$ vol.py -f CYBERDEF-567078-20230213-171333.raw --profile=WinXPSP2x86 malfind
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
Process: csrss.exe Pid: 592 Address: 0x7f6f0000
Vad Tag: Vad  Protection: PAGE_EXECUTE_READWRITE
Flags: Protection: 6

0x000000007f6f0000  c8 00 00 00 84 01 00 00 ff ee ff ee 08 70 00 00   .............p..
0x000000007f6f0010  08 00 00 00 00 fe 00 00 00 00 10 00 00 20 00 00   ................
0x000000007f6f0020  00 02 00 00 00 20 00 00 8d 01 00 00 ff ef fd 7f   ................
0x000000007f6f0030  03 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00   ................



...省略


Process: winlogon.exe Pid: 616 Address: 0x62220000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 4, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x0000000062220000  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x0000000062220010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x0000000062220020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x0000000062220030  00 00 00 00 2a 00 2a 00 01 00 00 00 00 00 00 00   ....*.*.........

0x0000000062220000 0000             ADD [EAX], AL
0x0000000062220002 0000             ADD [EAX], AL
0x0000000062220004 0000             ADD [EAX], AL
0x0000000062220006 0000             ADD [EAX], AL
0x0000000062220008 0000             ADD [EAX], AL
0x000000006222000a 0000             ADD [EAX], AL
0x000000006222000c 0000             ADD [EAX], AL
0x000000006222000e 0000             ADD [EAX], AL
0x0000000062220010 0000             ADD [EAX], AL
0x0000000062220012 0000             ADD [EAX], AL
0x0000000062220014 0000             ADD [EAX], AL
0x0000000062220016 0000             ADD [EAX], AL
0x0000000062220018 0000             ADD [EAX], AL
0x000000006222001a 0000             ADD [EAX], AL
0x000000006222001c 0000             ADD [EAX], AL
0x000000006222001e 0000             ADD [EAX], AL
0x0000000062220020 0000             ADD [EAX], AL
0x0000000062220022 0000             ADD [EAX], AL
0x0000000062220024 0000             ADD [EAX], AL
0x0000000062220026 0000             ADD [EAX], AL
0x0000000062220028 0000             ADD [EAX], AL
0x000000006222002a 0000             ADD [EAX], AL
0x000000006222002c 0000             ADD [EAX], AL
0x000000006222002e 0000             ADD [EAX], AL
0x0000000062220030 0000             ADD [EAX], AL
0x0000000062220032 0000             ADD [EAX], AL
0x0000000062220034 2a00             SUB AL, [EAX]
0x0000000062220036 2a00             SUB AL, [EAX]
0x0000000062220038 0100             ADD [EAX], EAX
0x000000006222003a 0000             ADD [EAX], AL
0x000000006222003c 0000             ADD [EAX], AL
0x000000006222003e 0000             ADD [EAX], AL

Process: svchost.exe Pid: 880 Address: 0x980000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 9, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x0000000000980000  4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00   MZ..............
0x0000000000980010  b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00   ........@.......
0x0000000000980020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x0000000000980030  00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00   ................

0x0000000000980000 4d               DEC EBP
0x0000000000980001 5a               POP EDX
0x0000000000980002 90               NOP
0x0000000000980003 0003             ADD [EBX], AL
0x0000000000980005 0000             ADD [EAX], AL
0x0000000000980007 000400           ADD [EAX+EAX], AL
0x000000000098000a 0000             ADD [EAX], AL
0x000000000098000c ff               DB 0xff
0x000000000098000d ff00             INC DWORD [EAX]
0x000000000098000f 00b800000000     ADD [EAX+0x0], BH
0x0000000000980015 0000             ADD [EAX], AL
0x0000000000980017 004000           ADD [EAX+0x0], AL
0x000000000098001a 0000             ADD [EAX], AL
0x000000000098001c 0000             ADD [EAX], AL
0x000000000098001e 0000             ADD [EAX], AL
0x0000000000980020 0000             ADD [EAX], AL
0x0000000000980022 0000             ADD [EAX], AL
0x0000000000980024 0000             ADD [EAX], AL
0x0000000000980026 0000             ADD [EAX], AL
0x0000000000980028 0000             ADD [EAX], AL
0x000000000098002a 0000             ADD [EAX], AL
0x000000000098002c 0000             ADD [EAX], AL
0x000000000098002e 0000             ADD [EAX], AL
0x0000000000980030 0000             ADD [EAX], AL
0x0000000000980032 0000             ADD [EAX], AL
0x0000000000980034 0000             ADD [EAX], AL
0x0000000000980036 0000             ADD [EAX], AL
0x0000000000980038 0000             ADD [EAX], AL
0x000000000098003a 0000             ADD [EAX], AL
0x000000000098003c f8               CLC
0x000000000098003d 0000             ADD [EAX], AL
0x000000000098003f 00               DB 0x0

remnux@remnux:~/Downloads$ 
```
`4d 5a 90 00`のマジックナンバーはPEの実行ファイルで見られるもので、`PAGE_EXECUTE_READWRITE`のパーミッションからもインジェクトされている可能性が高いことが分かります。
あとはそれを探すだけ！

# There is an odd file referenced in the recent process. Provide the full path of that file.
上記のインジェクトされているプロセスのダンプを取ります。
```bash
remnux@remnux:~/Downloads$ vol.py -f CYBERDEF-567078-20230213-171333.raw --profile=WinXPSP2x86 memdump -p 880 -D out
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
************************************************************************
Writing svchost.exe [   880] to 880.dmp
```
その後はフルパスで正規表現でgrepをかけるだけです。
![6.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/dbb528d9-66d6-4425-bf54-ab0654fbfe2f.png)
どれでしょうか？？？

# What is the name of the injected dll file loaded from the recent process?
`ldrmodules`で確認できます。インジェクトされているProcessの880に対してフィルターかけます。
`InLoad InInit InMem`のどこかにFalseが混じってると怪しいですね。
```bash
remnux@remnux:~/Downloads$ vol.py -f CYBERDEF-567078-20230213-171333.raw --profile=WinXPSP2x86 ldrmodules -p 880
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
Pid      Process              Base       InLoad InInit InMem MappedPath
-------- -------------------- ---------- ------ ------ ----- ----------
     880 svchost.exe          0x6f880000 True   True   True  \WINDOWS\AppPatch\AcGenral.dll
     880 svchost.exe          0x01000000 True   False  True  \WINDOWS\system32\svchost.exe
     880 svchost.exe          0x77f60000 True   True   True  \WINDOWS\system32\shlwapi.dll
     880 svchost.exe          0x74f70000 True   True   True  \WINDOWS\system32\icaapi.dll
     880 svchost.exe          0x76f60000 True   True   True  \WINDOWS\system32\wldap32.dll
     880 svchost.exe          0x77c00000 True   True   True  \WINDOWS\system32\version.dll
     880 svchost.exe          0x5ad70000 True   True   True  \WINDOWS\system32\uxtheme.dll
     880 svchost.exe          0x76e80000 True   True   True  \WINDOWS\system32\rtutils.dll
     880 svchost.exe          0x771b0000 True   True   True  \WINDOWS\system32\wininet.dll
     880 svchost.exe          0x76c90000 True   True   True  \WINDOWS\system32\imagehlp.dll
     880 svchost.exe          0x76bc0000 True   True   True  \WINDOWS\system32\regapi.dll
     880 svchost.exe          0x77dd0000 True   True   True  \WINDOWS\system32\advapi32.dll
     880 svchost.exe          0x76f20000 True   True   True  \WINDOWS\system32\dnsapi.dll
     880 svchost.exe          0x77be0000 True   True   True  \WINDOWS\system32\msacm32.dll
     880 svchost.exe          0x7e1e0000 True   True   True  \WINDOWS\system32\urlmon.dll
     880 svchost.exe          0x68000000 True   True   True  \WINDOWS\system32\rsaenh.dll
     880 svchost.exe          0x722b0000 True   True   True  \WINDOWS\system32\sensapi.dll
     880 svchost.exe          0x76e10000 True   True   True  \WINDOWS\system32\adsldpc.dll
     880 svchost.exe          0x76b40000 True   True   True  \WINDOWS\system32\winmm.dll
     880 svchost.exe          0x773d0000 True   True   True  \WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
     880 svchost.exe          0x71a50000 True   True   True  \WINDOWS\system32\mswsock.dll
     880 svchost.exe          0x5b860000 True   True   True  \WINDOWS\system32\netapi32.dll
     880 svchost.exe          0x00670000 True   True   True  \WINDOWS\system32\xpsp2res.dll
     880 svchost.exe          0x76e90000 True   True   True  \WINDOWS\system32\rasman.dll
     880 svchost.exe          0x77a80000 True   True   True  \WINDOWS\system32\crypt32.dll
     880 svchost.exe          0x71ab0000 True   True   True  \WINDOWS\system32\ws2_32.dll
     880 svchost.exe          0x77cc0000 True   True   True  \WINDOWS\system32\activeds.dll
     880 svchost.exe          0x71ad0000 True   True   True  \WINDOWS\system32\wsock32.dll
     880 svchost.exe          0x774e0000 True   True   True  \WINDOWS\system32\ole32.dll
     880 svchost.exe          0x77920000 True   True   True  \WINDOWS\system32\setupapi.dll
     880 svchost.exe          0x7e410000 True   True   True  \WINDOWS\system32\user32.dll
     880 svchost.exe          0x7c900000 True   True   True  \WINDOWS\system32\ntdll.dll
     880 svchost.exe          0x77f10000 True   True   True  \WINDOWS\system32\gdi32.dll
     880 svchost.exe          0x77120000 True   True   True  \WINDOWS\system32\oleaut32.dll
     880 svchost.exe          0x5cb70000 True   True   True  \WINDOWS\system32\shimeng.dll
     880 svchost.exe          0x74980000 True   True   True  \WINDOWS\system32\msxml3.dll
     880 svchost.exe          0x009a0000 False  False  False \WINDOWS\system32\msxml3r.dll
     880 svchost.exe          0x77e70000 True   True   True  \WINDOWS\system32\rpcrt4.dll
     880 svchost.exe          0x769c0000 True   True   True  \WINDOWS\system32\userenv.dll
     880 svchost.exe          0x7c800000 True   True   True  \WINDOWS\system32\kernel32.dll
     880 svchost.exe          0x76fd0000 True   True   True  \WINDOWS\system32\clbcatq.dll
     880 svchost.exe          0x76b20000 True   True   True  \WINDOWS\system32\atl.dll
     880 svchost.exe          0x71bf0000 True   True   True  \WINDOWS\system32\samlib.dll
     880 svchost.exe          0x77690000 True   True   True  \WINDOWS\system32\ntmarta.dll
     880 svchost.exe          0x77c10000 True   True   True  \WINDOWS\system32\msvcrt.dll
     880 svchost.exe          0x760f0000 True   True   True  \WINDOWS\system32\termsrv.dll
     880 svchost.exe          0x76fc0000 True   True   True  \WINDOWS\system32\rasadhlp.dll
     880 svchost.exe          0x76c30000 True   True   True  \WINDOWS\system32\wintrust.dll
     880 svchost.exe          0x7c9c0000 True   True   True  \WINDOWS\system32\shell32.dll
     880 svchost.exe          0x77050000 True   True   True  \WINDOWS\system32\comres.dll
     880 svchost.exe          0x76eb0000 True   True   True  \WINDOWS\system32\tapi32.dll
     880 svchost.exe          0x76a80000 True   True   True  \WINDOWS\system32\rpcss.dll
     880 svchost.exe          0x5d090000 True   True   True  \WINDOWS\system32\comctl32.dll
     880 svchost.exe          0x71aa0000 True   True   True  \WINDOWS\system32\ws2help.dll
     880 svchost.exe          0x776c0000 True   True   True  \WINDOWS\system32\authz.dll
     880 svchost.exe          0x76ee0000 True   True   True  \WINDOWS\system32\rasapi32.dll
     880 svchost.exe          0x77b20000 True   True   True  \WINDOWS\system32\msasn1.dll
     880 svchost.exe          0x75110000 True   True   True  \WINDOWS\system32\mstlsapi.dll
     880 svchost.exe          0x77fe0000 True   True   True  \WINDOWS\system32\secur32.dll
```

# What is the base address of the injected dll?
アドレスはMalfindでみることが出来ます。
```bash
Process: svchost.exe Pid: 880 Address: 0x980000
Vad Tag: VadS Protection: PAGE_EXECUTE_READWRITE
Flags: CommitCharge: 9, MemCommit: 1, PrivateMemory: 1, Protection: 6

0x0000000000980000  4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00   MZ..............
0x0000000000980010  b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00   ........@.......
0x0000000000980020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0x0000000000980030  00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00   ................
```

# 最後に
dll Injectionのよい勉強になりました。
volatility2はよいなぁ