> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/tryhackme/2025/pressed.md). # Pressed {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0

](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** A full-scale intrusion was recently detected within the network, raising critical alarms. Fortunately, a packet capture (PCAP) was recorded during the incident, capturing the attacker's initial entry and subsequent actions. Our task is to analyse the traffic, identify how the attacker gained access, and uncover the sequence of malicious activity. We download the PCAP file from the box provided and use Wireshark to analyze it. ``` http://:8000/traffic.pcapng ``` ## Analyzing POP3 Traffic Starting with packet no. `2448`, we see `POP3` packets and how someone is trying unsuccessfully to log in with different emails.

Starting with packet `2886`, we can detect other POP3 traffic; the attacker was able to log in successfully.

We see it was Hazel's account that got compromised. We are also able to extract the password used. ``` aGF6ZWxAcHJlc3NlZC50aG0= ``` ``` cGFzc3dvcmQ= ```

## Analysis Of The Attachment We follow the TCP traffic at packet `2886` and see `hazel` was pressured to open the `sheets.ods` file.

We copy the base64 attachment which is the `sheets.ods` file and decode it. ``` base64 -d attachment.b64 > sheets.ods ```

We open that file, and inspect the macros and are able to spot the download and execution of a file called `client.exe`. Furthermore there is something echoed.

This is the first part of the flag.

## Tracing The File Download Now we know the download and execution of a file. We look for that to find the next part of the flag. We see the download happens at packet no. `2962`.

We follow the TCP stream...

...and swtich from ASCII to RAW!

Next, we save the RAW stream to a file.

## Decompilation Of The Malicious File We remove first lines until the MZ magic bytes. {% hint style="info" %} The following images show the use of Nano. But it seems like Nanos way of removing lines `CTRL+k` behaves differently than the way Vim `dd` does. And the file produced by Nano was not being able to properly processed by Ghidra later. Use Vim instead, please! {% endhint %}

Using Ghidra, we analyze the executable and inspect the main function.

Here we see a connection setup on port `443`, which we will find later in the PCAP.

Furthermore there is some command execution going on that is encrypted by AES:

At the top of the main function we spot the usage of a key variable.

By double clicking on `rhI1YazJLaLVgWv4` we find the values used for the encryption. ``` iv:pEw8P3PU9kCcG4sj ``` ``` key1:rhI1YazJLaLVgWv4 ``` ``` key2:VKf7EQIvl8ps6MJj ``` ## Decryption Of The C2 Traffic Back to our traffic on port 443:

We inpect the packet `6728` and `6729` and copy the value of the TCP payload... ``` fcc44520bbf8344c3c6fff2be387fe59 ```

... and use CyberChef to decrypt the paylaod. We are able to detect the first command issued: `whoami`

And also its corresponding output: ``` 6a45b8f4ecf91e260471f1dd47d82c5925d9e0356b16f4f9f056dcbc6f77aa6d ```

On packet no. `6731` we see the creation of another user. {% code overflow="wrap" %} ``` 1220b16630b84067c78ffb13915e8735bdb43608954e45203bccc5d8f72c7e4707dced8ae4cb01cfd078bc0051b56a196d85a59bff6d4974325c73b5692827ab ``` {% endcode %}

Which happens to be the second part of the flag.

We move on with each command issued: Packet no. `6735`: ``` ba8ffa0eb7d52a61bed3a892d9411076f4842dc910c643aeaac8204a05f170b9f789c6b7e0aef2de42993ac95ce07659182ce016e3befd6660fdec45804f7364 ```

Packet no. `6741`: ``` 5a1e3eeb43af06740acbdbb29a4bec9474cbcda837f96d4e40feb10304e937eb2d4562f7ab9498fa9217da03d5dcb03deb73c51d113dafd215ed6805c4386e4041bc9b64036994e85b10a9aa8a6d376f22b1ce9889acaa4209ddb7459d7155d6cad497fd62ccf465617fea135cf6c905b43a6c1e30c4d0c398f2dc6412093c45aea875d9ca226a938a446f186603d3b0371915b2e3c570891aa677ce6108758087f54f34df1ef78fc9a70412d1c6842bc9e5c3e56ad548c36fe6f4f8966594e3312644da48a65427a45365d1a6ab89a15e1c4e6cd0cf8dfee810a7f1ea0ced12f8b41a85c87809644002cc10a9a7aa6ca5232eb332e74941e8da91c4758f8eb3e5a4cac3d84298b00f96715d4150e01b67f6c285cac26a4afb3858796a61f69ba1d70d47bae714ded2bd9b174344b719921b42c79e4592437825adf0978fb3f1417d206efd3a60f4821811987c4104b514f319d0757961815d5446597c8f077599f9d238bfaeb1fb4643076025c6752eb0b03ce7b225ae8379744fc1c76cf5319a1194a283854318c28146e7401ab9c418a570cef5cd8ae90db476031e142cf8c1841c5fe097e0c7727536a5da5f48e6056f72bcbd9bc6805fadb2c46f12e45eeddbc697ea6d39d6ce3c9fd4c8ae67649f129d63564b78290e2d7b727f537bf5ff50098540903c643112720660b3b22c ```

Packet no. `6743` - reading `clients.csv`: ``` 9b8f6df3bd93c3ab10af70c980e231bfac35c591cd0bd0aba8c9104cd30dfbe56b2542aa70e39191db65a5cd2951bcf4 ```

Packet no. `6744` output of `clients.csv` contains the final part of the flag: ``` d5303d95b5c8ebea7692402db7118e95bfce2f60ec980d0a0ae57ace971035450d9b1f53ecc5f02ef2efa330fc8b1894ce16cfeedb1e9e73284b65e5a99819721d2fe4c538a671f6edc2394be605ff935988b628cc7e08febf002be9442338f59707e588b535f929a84a89f7ec96b4294e135263145ea196420966ba747d7e90576965fd8e4e39b60f08fe466893338e51e88eeef91f527f5ca51fac6021a19cf9ac8025b4c1e6819740ffa19c2b4f0b3c7ae160c6fcaee2ec81ef2332e71a25e4f67d5cefb21e788a034636282ea0dde4b8e5912db955ab253bcd98fd1467056c3f3814900383ef9d96a4d421a1a0caba4323c97952deb2d7a5cc8bb631acdb31dc05a633676563c20e50f08777b16598f8e497389e9e31648b869843c6cb00be915b5c1992f46ebee1dca68980c722a2c9b6d721e6c9cbb072407dc66b914189c917c74e6db230de6d6d0b3393add952bb4d2f30c45fae06aca3899b6800947eb642a275238e51cbbd6a21c501d98a393069f555843a4d42171a144dad683df6a4f924d6151604b9cd1f74483dc5bbafd1fa035a1fe1d89ec387d71e0100cf891075fb8e35c2505493e8f1626d7532884a0a92a4c64dc406280f628103b185fa75c14f7c46cdab71578f10b987fa0d3a6d80def05b6861f46cf8c4e331eff2aca120871689ac4d85599ec5f066b85c00b9d50d72f3ad858e4ba8eb9e52e96b65ab1fc48bf1f1328ae07dcefedc5f392631ff1c0c111d62fd459691d874ce2dde93a5bae5e6cdbcb0b43deb3a64b81e13bfd10a9480b1f058fa2f95077ffd1a3ffdd1313ef862d1b4bb35101d2d5d5b04bf1be55699e90287b09395ef2e8dd52bcf0f3f319924843bb0726da55608e181711563c8d4258bba912a2c086fce72a8d521efd10c230d40941b19d880f0494628489be6713e2e815c63b62151d4632f1d0e1de2fcd74f09539e7306d989567e5fc6c914a9954e66b1b3798ebf2f5822ffa44bc7102a25f54621d6bdffb745ff8cf9b4f17d84e9080068a4a0fb3845525c1b80c1f1f935f03c7294d809356db973602d4425d3fdfea1082cfcdc5639300e1b9834fc8c5ad7da583dacee616746baf691584ea7a5ac78211c6119f3c533d24d7741efabf39ef8d26c8bfc58bb711c0b1e75a73943254947e9cfb3aae7f9511f78d238d75c1afc40be93214a03 ```

For the final flag we put everything together and base64 decode it.