May-FlowerShell
Creator's Cut
Scenario:
Take the following code and find the flag. (This code will not harm your pc)
Tip - I would create a Windows VM with Defender Turned off as some of these challenges will get flagged for their behavior.
Challenge creation
- All levels were created with invoke-obfuscation
- https://github.com/danielbohannon/Invoke-Obfuscation
- This tool can be used by APTs as a way to bypass av/detection
- Being able to reverse engineer these in some way to understand what is being done is critical to DCO
Key Take Away For This Scenario:
All of these were created by a tool called invoke-obfuscation
This tool takes valid PowerShell code blocks and allows the write to obfuscate this in any number of ways in a matter of under a minute.
These are being used by script kiddies to APTs today in order to evade detection
Only some of these obfuscation techniques are captured by AV based on their behavior alone
As a Hunter/Defender we have one tool that they cannot hide from us at.
PowerShell Script Block Logging and Module Logging
In order to enable this, edit the Local Group Policy for Computer and Users @ Administrative Templates -> Windows Components -> Windows PowerShell
Enable Script Block Logging and under Module Logging set the modules to * to get every module that gets called.
With these 4 settings all the PowerShell that runs on a box should show up.
Make sure you run gpupdate /force to implement these settings after setting.
All logs should be in the event viewer under Application and Service Logs -> Microsoft -> Windows -> PowerShell -> Operational
The Questions:
This is to show how easy it is to solves these with the de-obfuscation done as the code is ran.
***if you do this with live malware make sure your sandboxed and isolated***
Level 1:
We see this in the 4103 event
fivectf{turkeys_go_gobble_gobble}
Endcoded Message:
Obfuscation Technique:
String Concatenate x1
Level 2:
This obfuscation created 6 events:
The 4104 Shows the de-obfuscated code:
$baste="fivectf{lets_get_basted}"
fivectf{lets_get_basted}
Endcoded Message:
$baste="fivectf{lets_get_basted}"
Obfuscation Technique:
Reorder x1
Level 3:
Level 4:
Level 5:
Level 6:
Level 7:
Level 8:
Level 9:
Level 10:
Level 11:
Last updated