TryHackMe: Chrome (post #1)
Tags: dotnet, cybersecurity, google, security
Published: 2024-04-01 20:35:13


Password manager seems a convenient way of storing passwords and retrieving them whenever needed, without doing a workout memory 🤯.

Hey, if you want to have a strong deep dive into Cryptography, File Analysis, Reverse Engineering and Credential Dumping you're in the right place! 💪

[This room](https://tryhackme.com/r/room/chrome) was a complex challenge and a veritable source of learning.

Let's get it started!

I downloaded the task and discovered it's a **pcapng** (PCAP Next Generation) file, which is readable with [Wireshark](https://www.wireshark.org/).


In the protocol hierarchy (_Statistics-> Protocol Hierarchy_), we can observe the presence of SMB protocol. 
![protocol](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ka10io37y4szzrx5o34h.png)

Examples of procedures in which SMB was employed are:


> 
[Fox Kitten (Fox Kitten used valid accounts to access SMB shares)](https://attack.mitre.org/groups/G0117/) 

> [Zox (Zox has the ability to use SMB for communication)](https://attack.mitre.org/software/S0672/)

> [zwShell (zwShell has been copied over network shells to move laterally)](https://attack.mitre.org/software/S0350/)



With that being said, let's continue the investigation. 🧐

We can observe a file called _transfer.exe_. Let's proceed with downloading it.

![transfer](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u4vr7ufynqf4m4s6zeb3.png)




![extract](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mwyplw0zpxe991g9ee5n.png)

Here it can be seen there are multiple files. In our case, _transfer.exe_ and _encrypted_files_ will be useful for us.

![files](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n3gsur9e8ltkv1f4pd5i.png)


The executable is a .Net assembly. On Windows, one can use [dnSpy](https://github.com/dnSpy/dnSpy) in order to reverse the binary. On Linux, it is [ILSpy] (https://github.com/icsharpcode/AvaloniaILSpy/releases) (though, both can be used on Windows 😉).


Where do you need to look? 🤔 Look for the transfer -> 



![ILSpy](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r8i9l1xcteqslpmv6a3i.png) This is the view for ILSpy. 🔝
...and a closer look 😺

![ILSpy](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9dsbjahidrqfrtyz68g7.png)

And this is the view for dnSpy 🔻


![dnSpy](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/n0iawgu3eht4j5l8fjqi.png)


We can observe the presence of AES Key 🔑 and AES IV (Initialization Vector), two crucial elements which make a **pair**👖.

We will use this key in order to decrypt the _encrypted files_.

Curiosity made me want to find out what type of file is this _encrypted files_ . 🦁
![data](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f27x4uu34hmk3k4o4e9u.png) 

Now, we'll go to our friend [CyberChef](https://gchq.github.io/CyberChef/) in order to decrypt the message.

![cyberchef](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/da3ratpiggdldvd1iapc.png)


Let's download the decrypted text- there is extremely important info here. ✨

CyberChef identified the file as being a .zip archive. 💪

It's clear that the presence of AppData is ubiquitous. AppData contains for example the history, bookmarks, **saved passwords** and so on. Today, for us it's important to retrieve the **passwords**. The passwords are AES Encrypted and saved in a sub-folder called Local State.

The AES Encrypted key is protected with function used by Windows, called **DPAPI** (Data Protection Application Programming Interface). 

According to [HackTricks](https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords), 

> 
The Data Protection API (DPAPI) is primarily utilized within the Windows operating system for the symmetric encryption of asymmetric private keys.

 

👀🫵🥈📬 (Can you guess the message?😉)
------------------------
What are your thoughts so far? 🤔