Walk through 2024-01-10 "zipmadness" challenge

The Challenge

On 10 January 2024, I posted a large blob of hexadecimal to kick off another challenge. I will put the raw hexadecimal at the end of this blog, as it's too unsightly to paste it here. That hexadecimal decoded to a base64 encoded string. That base64 encoded string decoded to a binary file that appears to be a Portable Network Graphic (PNG).

There's an ASCII string that leads us to believe it likely has the documented magic number for a PNG. Whether we see a string or not, we can always try automated file detection features such as CyberChef's Detect File Type.

I like CyberChef, but I personally am often more comfortable on the command line for stuff like this. One tool I frequently use is the basic program "file". Note: I will never give a random challenge like this that includes malicious code without explicitly saying there's malware in it, but you also are wise enough to not trust that vow, so you perform your analysis on a system intended for untrusted file analysis.

The "file" program/command and other similar tools are looking for the magic bytes of known file formats. In the case of a PNG, we are expecting 89 50 4e 47 0d 0a 1a 0a. If we look at the raw bytes of the file with something like xxd, we find those bytes at the beginning of the file. Here I will pipe to the "less" program/command, instead of dumping the whole file to standard out. If you are not familiar with command line, you can get a lot of value out of a book like The Linux Command Line, 2nd Edition.

xxd imposecost_challenge_embeded.png| less

On a system we deem safe, we decide to open the file and we see it is in fact a PNG that opens.

Numerous participants contacted me wondering if this was the end of the challenge. It was not. In fact, the hexadecimal and base64 encoding was just for kicks, the real challenge begins with the PNG. You either contact me telling me you found the beat down PNG, or you know there's no way I'm letting you get away with a base16 to base64 decode and start digging. Like running "file" on files for a quick and easy triage of an unidentified binary, xxd for dumping the raw hexadecimal, it's common to run "strings" or similar tool to see if there's anything interesting. We're looking for low hanging fruit.

strings imposecost_challenge_embeded.png

We see there's some dates and timestamps. As a side note, these are real artifacts that I didn't scrub, and while not relevant to the challenge, is a core thing that I look for in my analysis. I highly encourage you to use timestamps to build timelines. Timelines matter.

We do not see any webshells or any other glaringly interesting strings. If you are familiar with the PNG format, you might scrutinize the fact that the strings output has seemingly more past the "IEND" string than you may expect. The PNG file format has a header and a trailer that marks the end of the file. The trailer, 49 45 4E 44 AE 42 60 82, is the expected termination of this PNG.

The first four bytes of the trailer 49 45 4E 44 conveniently decodes to "IEND" which you can try to memorize as "image end." The strings that follow IEND may be indicative that there's additional data. However, lets pretend we don't recognize this right away. One tool I am a fan of is binwalk. Binwalk has many uses, but it is decent at identifying files within blobs of data. While the tool "file" will help identify files based on the headers, binwalk goes deeper and identifies characteristics of files further in the binary.

binwalk imposecost_challenge_embeded.png

If you have looked at a lot of PNGs, and you have ran binwalk on them, you likely haven't seen gzip compressed data in them. Not only does binwalk output that it detected gzip at offset 0x1762, it lists metadata including the original file name and the last modified time of the gzip. Again, while not relevant to this challenge, I want to highlight that that gzip compressed data can have valuable metadata. Timestamps matter. It is also interesting that the "original file name" is a space. This metadata could have been scrubbed.

We return to xxd to see what is around the offset 0x1762. The -s switch tells xxd to start at an offset and continue until the end of the binary.

xxd -s "0x1759" imposecost_challenge_embeded.png

As we may have expected, after the IEND trailer, we find there is a lot of extra bytes. It isn't obvious, but 1f 8b 08 are the magic bytes for gzip. At this point we want to extract the bytes from this file. There are lots of tools you can use for this, but here's a quick way with xxd:

xxd -s "0x1762" imposecost_challenge_embeded.png | xxd -r >> extracted.gz
file extracted.gz

We then want to decompress the data using gunzip.

gunzip extracted.gz

We want to understand what file we have now, so we can continue to use the file command.

file extracted

We determine we possibly have a 7-zip archive. We can attempt to use 7-zip to decompress it.

7z e extracted

We are very sad at this point. It is asking us for a password. We enter a wrong password, and we see some additional information. We try the password "surprise" and again, it's wrong. We're increasingly concerned. We run another command to try to learn more about the archive.

7z l extracted

While not helpful in this exercise, I wanted to point out additional timestamps. Timestamps matter, they just aren't relevant to this exercise. At this point we're left with password guessing or cracking the hash. We do some searching and determine that hashcat and john the ripper can be used for password hash cracking; however, first we need to extract the hash. We're feeling lazy and not like tracking down dependencies, so we fire up a Kali Virtual Machine, and use 7z2john to extract the hash.

7z2john extracted

We move this over to our cracking machine, paste it into hash.txt, come up with our wordlist based on what we know about the author and get after it.

$7z$2$19$0$$16$fc9f6801d7dfe293a666c3852f2bfb3d$3116181317$112$109$70c9aada6f0f3d00cad105c92a826af03746d409b623ffccd1de030fb6fb51391882e4db944dd333bc209bab60b87406d70fc9ecff876a545d44f14722ee8227f6655c766c17f5af99737dc7e3739c2a468aa2dbdbd298d114b12445de3a0ba1b7494c317a282811ade282ac014e721b$107$00

# Determine what hash type to use
hashcat --help | grep -i "7-zip"

hashcat -a 0 -m 11600 hash.txt wordlist.txt

If I had to guess, people who solved this challenge likely tried "imposecost" as a password and didn't need to extract the hash and crack it; however, it could have been done. Now that we have the password, we can try it out.

7z x extracted -pimposecost

cat surprise.txt

We have solved the challenge. Thanks for playing and following along!

Appendix

Raw hexadecimal for the challenge:

6956424F5277304B47676F414141414E5355684555674141416277414141465442414D41414143776A4B5337414141414247644254554541414C4750432F7868425141414143426A53464A4E414142364A6741416749514141506F41414143413641414164544141414F7067414141366D41414146334363756C4538414141414431424D56455541414143674D794B684D694B674D79502F2F2F2F73616249464141414141335253546C4D41574B3635657031744141414141574A4C523051456A326A5A5551414141416C76526B5A7A4141414433414141417573414D44434F5467414141416C7753466C7A41414175497741414C694D42654B552F646741414141643053553146422B6742434163734733674D687463414141414A646E42425A7741414358514141416363415050422F4E5541414259435355524256486A613756316E77754F71446F3374445A4234417952737747582F6533747870366869374A6D354C2F6F313877576B637951424E7332507830392B38704F662F4F516E502F6E4A2F344D38503139352F6C756178664A79347979444B613235326A542F4F59496268456E655A56572F4473336C5861646E56786246645A726C556F2B68444F565575306931765A396446574D592B314B7132316A7A48346866677147596B312B70356D4B656B306F39416D4A4B614B34677A5955384A78594951786B6E7436447165396B3149495953346174677A6432743947414D4A634C58497172765A496345723044344B6B797A765A47657730436344683857764A4C444B696631694D705A3162686D65787539396A4951684F5075472F7647793041516A72757463794663664C5A7A6F5454626D2B67316C34456748646664524D3964426F4A30334531395A7A5665426F4A30584A6C48576C62494444725841394361375333306D73744130486C78552B4E724C7750424F4F36656B633964426F4A7833443139792F696E364E307973444D4E354979506D6279347065746B4F73347A507559302F3866703252766F4E5A66356D45763757306147362B697865664658304C502F4E4C3332522B3869656E633874767A6F2F6376306D7639323237754F336E393833507372364C4570644230396578476C7974756677494C494E794E3358465556342F62387A4C7266356D2B68567933727430553276586872364738526941766639355A53782B4C302B54583349466139424D54566B78462B6F63476559786631493238427653376657694F6746376E67464C2B6B6E566E657879634D4D7031794478557842646E4E36582F644E4337546130324F532F2B617A772B49553366704A44784E7A3444706D393357477751396D30456C2F526E6D425262555972363044496A75444C32473074786A37614B6B4B33734768446C446A387A37446F4F553556484D46413369354553356F783158304B5574726F73416B65584A51346A453648472F3568674E4648774F52705963476E496336516D52474E596E503379696A447268782F6E52626E2F533678354533336C36455164506A496558554E5044744C2B6856422B2B42504B6D726E38516661633953772F4E54742B735356787877737971624F4D337355577A387977375044484D7757667A6F5A664A5772633676326274356753746A6D416934657332772F6B6E454A4477395166316676473038623273624253565837486561465A37684A4175594B33393267455643353835666A4B7239626366424B4F796355536E323332303859734B6547493964746C6A424A6A342F654854666D646C764644726E4F6B485A486552575378453452316A453337354848474161732B6D33556B4E5067714E68634D7267516F7A2B3959672F4A6238392F72727A505145504F656244507833474C4E5A447579434E4A7A357255463567526A38314D6F64424A50307442377633767535442B4B51347A386235737245623655584E7A2B5463745A34314A664963337357785034656645385973586F5075416C544A5A69626569552F524C6936544870682F506254563958437776764A443454636D4B3867797053413339484F466767754C48766931625943446359422B366148447A5844642B6C4A71494466636F447659304B79476530686B55587A454279636D3250555950537355485072413277537A43596F58465650457A6D38434C3276504F4D6E487864326C684E5A6661355549306B506D527347446A59563379586C776E46716F75665531674A4330444D674642535158576C36625441554A5053733045634D505943664730645275585053784F4E5530505A6B3573493242443843526F725354755571656847366B4A356F364176445A536F654F44714455487170762B3570644A31415278674A6937796765507A675A6963317035484B526F394B5557344A7371574B45625977394430794F4C73724E6968474742717477535A6D67553038784B382F674A526E46344B4A67796C496C78677533624B775475575333487A456A2F456D626A6C7364674972657569385563387346706E79394349793674572B426F675247714850534D6B467761736A41323173307A494B5569714758394A48596C74653267695A316D674677387A6764386E3274674448674B776569364F2F79447548582B45625143446E643941446F3156452F3668433970436A316B71756848514D35485136615643774F6E376D456E6143334B537A45787344645079757571416A704E5044382F575537515A44724F483375595A636A4D37434855496E6A583743543862756B6B344651506351764D745130632F6A5A79396A467A394F4979304A72382B64324F623558586B7644764D347A6675334A61454C2B46313636302B49446C336F374641466A676250387274324933356B436B73317450464A446835535A61377256435A684836655075456F554947484843396C4C326647503078774F31422B37536F4C66355A647452596D4575376C4446446961335A6255384E546731657A6978326B38466C6750774152767231624C565A61544A6B6F6B49686177417137703262316B4D6A6C32626163795330426E494C7334492F4150365A53496E3558674F796543567A30475469764D7A5A6A664C5466344B58495461536C556A63516E4A63394B5343514552772F52344D444F446570523859336650666455694637314D4B697A43413452424C4C6B386732645367724F5A747862517A7345474378663772364C4D39736F4F6C7173624D3979467846596F6B526947684C55594F68343333694848534278626D614131636637506F6C7A6B32744A6E49504F352B627A2B666E595576535332465261744C512F314C6C5A6C5178352F4B7233344C497A3957744C6C6C6550626B58706864674D447A633172485848586653715A37544D74695153335A6253614E444A724964566846363158547166526B62586C6B374E4562336636623733382F5365337447584F4463465A2B45436F594E4E34327847344D48364A4C306E74764B37426159684163646F644B5742756A472F452F53676C4577536955343347366B6B5935304F4339567A4F36552F796676395351726C306E7653432F594863456556696932336D734C56444B4833342F574D505A5A466A2B4D326571324B5242783346715176517544562F6972723836756A384C6C52505A78496C7468367A364169333251656D2B53464B476E444671716E703132416B6B4F57763979486B30694C4C312F7A656167717A4D574A58766651694342324157776E4C4D64462B6B44356A4657613154575442397751673156466A3730483576446E496F3077796C7A524C656D41747247664F2B756E374478465478513858324D6C4C636830517969354C587A50312F53504F6D6838616E6F53646D487A706770326757374B6463766873686678347854396159624170394D7136596C794D2B7751715A694549774E466233494576696431552F4331484C684D53362B52304F764556554A4855446F4E746546327339684D4D38652B79375430714642345548776847352B34594E4A64516D36614D764D5550644C49627173612F4964427153644569592F49796D4661637275613372707973683837707571556F6A667339437066355258306A6C494C773462332B6F4D7278387043796E5568334762555461384A364958376E723970536B576C6937426B79354B533862316F5466486F39556E2F4D776A7074654D5A415950556A4C726F73524465346C31746E744E4C30414E6E5972543047744C4530746263483645335948413139496A496244326C436D55356575434C6A355965646C5A70482B65552B353139657271614B5159416261326C42376A5947384D4630785134707050306F43355354532F4F7A75504F6B45724E72577A306F504370365158683837685273344A4353473257426B3953496E70366D354D2F52307057384553314E6E716E3661566A517761397838743977756E3862484B463661564D516E715A6437332B4E66533647466B5630477679396C4363414653575872496D5577562F61374D7551745538684648306D7650304C414474694A6762633362346E486C5038394F70414C31346241696964397768705A497A734878365A39794568432B6756304D4F344B5574424F644D6B695068432B67317354396C346B37414D623669417654697357474D463673737A36636776574B4B4E6F6D4764742B455377794B354151592B5952765A76683851716C42695A78704D6C32677155546645716E30364E5870727849704D44315A4941384F77656731674547424E4B57676C476C3849514E333247674267774A70383548456A2F6846736A4E65762F52396C3745683949544C6B315452565035497448723070702B36572B6D6479495476777A39574F4A774232414A576766376B4A5A3964366B74704C7A773871565132454C306D2B6B556F4A3859467746676A4976656D3838594C6E3974545A4970315274504C37773436534A32673370733166666A74694A34627330357A6950774E7869445057354B56513775586148637A34642F4630756253737A6E365073597669376F32705665465565576C4876616735776A36326B7A77412F64726B7137623655315A6F576C363165716A5448593970566849446E6646634251596A704B61707465757061454D4574416A386752424449556264635557767462765A6531444C50587154506843544837536D6C414E566B567947517666766C335739786E68306C537658576B6971756B6C683446554C533875476471334B4B6975485236577A71564A4E586437715363364F30383167305A5458476967486C564E7231354F5147476630664838414B6470522B70574246743472662F6B4D69756E4E2B30726E486632417541544E587A7542464B7859426E6C6741506471477036627237337A6369674B2B6E7079674F704448686B31493136302F61664F5A6B466E745A463479484C434435384E6F4B676148725676446E487969354B566C392F304B726F416155544850576F4850576D7A7841496F61767041666E575561376D7739654D7171593330577348495249645772302F73504346723332615761535A487649316D5153364C746365736F796E7662484945533832595A446F4F51463052786B475255635048647033523164737773542B58656D4E4175694164556239714B76423373656B335546517A52384445666235796C67383950484773744F75767A653852794F46335A79676B6C614358435A4B5361756B317A445A3257716E5756772F483965523948455A394143344E6C444A6D776A734F4F30453774547758432F713832744247575756786B595667484450637241334B6E725469594758456658355843677936446E6F6451345373367454735A75377A6F647358476777713552324F70394836647153325243496D7437722B4F647A73384E436277566C5971487041652B6D794E68674E77536449474B696E45697174594979504C316B36364356684B2F62666D4D644F6E4F78365A3849474A68682F73304C414A763847694B47773964744B466D4C304E4B30364E6C58346F4A59794968586F42616358693170656A5541767348536762624C4777506F48634771515455416C68564E49327036414441416859327256596852556743734A74566F475475727056593036726D6F4254786B3430497065685A5147614147664C316647734F7A6733595741416F545039556B556B535953747650374C646537494A534D6F76554A4F684634774B41314C4332754A43447A512F4A7056723277466C4C306A33314535426E352B6E744A3032686D45615761746B73556E6F7A6A326863414F674A6A4C476157384256447252554F396B447034754E414D693770465937676B62503074763078744E395443345230735956414F5257514539694E4131456A7854782F70366B644365774641614C786744515377766C3055746E415678694D6B346E6F364658787A5653646F4243515277416B635338536D78575842564B346D314C737257445576514131656E445A3169745539474C627A2B527A62616D685352576D375161554B714F2F5656784E546958646F6C794A6A425830747367324143694A6B74696D33333458785935454749724D435639316E6C4676336E6D314276496F7130764C596E386451753946635141564A535953534E782F4E6452794C644C69796F707A6B78364B37386A71563569646F6C434E30624C4C6A69454276693674494B65497567756475793034595139796A614E6D6E4768317464446A7774757A5A6A7236533338417168505676384C30766B4E796446376B50737A3974634C6F4A53416E59726538766969366B6E6D58547966324E584242434D354C7252626E4A6F38657172785A504746356D52654D3066373635632B316A4D63525841453152374D4F2B6974356F784938564A68324F6F466C5878304C5A452F7A6637666C4A347369315430316B7853384E7672426546725053557552624472503369306D66536369743753565752736C51346E3368755077346A547177383835656A78653246557663764C5452755836325136592F55694E53363467306172684A6C4C54377343323637684343703557777949636148796B756B32656C394C48667944655437666B3678666E4A2B6C32514333386370616A394C7264304E484B4850705A64527A4E766C54395972766B2F34734A4E76786262376A6767307678707173446A352F73504537377A2F364B4754544335462B6E31325148632F54435A313647695772704C553252466932566C7237375443313044306B6B717258766544517436757356355730385668796249414250474D385274366D685076704357364F6D652F517161443157457654437838682F6741393658314758344B76754F364F44796A7641647362536936394A7075653473795766783570423438647A396A7536664F44647A383933596D3064327032514F6A31682F716A6C3775626E7661385866524B75322B425355743242352B6A546C724D586B6B763437436B696573624F437757434E37643055764E4B666E68394F592F7431474665364F5831684A496B4A397542646943394B6F6F65415870435636444D382F7844714864447161336F2F494A33456F76785351544C7837624A7067474C4F4D695A39784B4C2F385174764631444B437537674774762B665379356C684131776946433869497A4979324166307A7079713669364933754A396C30335038376C44766A48305346634137347065432B6454567669614657486B333337394537755472587A30316D396F41465579776C664444395832415A362F7A59316569705836537654375A473536327175744932316A33304A6E77314F6278614E486E4D465769446B43306D3838773569305147785350626E30304F6A68613147386650624A475038564C6F477766343475746C307565674E6138757653462F63645556446D722F797362372F2B346B4B4333547951343766583033506A4D696E5536746B46474D333676324E6D64332F747431736541736176707266635939377265355A5A6F586D4538374C662F336D506148506D4C6F2F6333677A326E66536D30316F56636761624672737354646A742B32476252754E72667A36664278456F6453366D31387A6E584B322B347879327674394B72725A456A67446D306D766C394A5A54394F706E6C75504C41795A35533458784141565365726D7A31416939396243576E74364272526463734963414C3063507154657467557A49745051476236413044384C414C4E6A355454484D624872443875306837616A6565535936646E6E514966622F576E722B42376637644B39714B4F674A77467836546C717658542B74704B566E2F477865616850304847492B70566434625833714F536662576E704242634E65684F586748322B675A2B6150593532695A37575844523357382B696C6542423639587247584532764358533359395974625A6654573836596E365458717A2F70673949727653747047744F664A354E7A524A365972364B6E32444C585771794767703752586975787967303741744561704A686F73714559505A4E487A366872305053432F4F2F304E784F636F6165767071566E6737476E332B633344386B4D67785655792F434B6B6C3466444D6C44644135752B5A7268774F34527A615458704E57344B6B70365132676A324E7435664B7152492F6A58306F75367A716C763254514658396C6B4E70326E656A7342765261417734676264524A326E6433787665486F4736493076314C30324963644C543062514F7633765947365134367031564948335069416B394C4666637669646D567279714F583169704F72342F3746674E626E704F7A656E33534C55795A5142395A4E7A45306F314B6978374A4653354B6163396635326E6B57534C4D3865756F6C6C4C6876675177766F584D34384A52653367364F4C714D4F4C58486641714139516F64686141725273786B527036554C4767367766683245446B454F30444D733071794C4A6F41384953587557324B773778534A4C594D303630466376526B77375675385343326869317A5753347A79394C4A43546F66762F667A4557354354395755503678493646395841543564373075554135646E5234567551506632642F7A5A363554764D4C6D4D4138495833314768614A757379495145392B726C7364327131585A656439433362667A397A4D5568626D6B4D3539464C4E425461724274436D7A664C684B392B527139467734497374416E584D71494E45486666713878323238585759543463444A6232636139694578352F49384B58596F72374630614544565141653555426D33486D35436A3034304F36595869484930456E7047543349546B6150376C3136737668336D4B644442794A764A44343458595549504B556C38503269674852516B564141415A66536F392B4C42724B3059554B48666C62365044337A6B4172702F546739342B6357736A4C5941325430453441524D54756D64346E644648696466577146636B6755593661476E46353154464A43776D2F49704B5149574F576C3652367A2B43777048373557777736633033577344543639754851574D594D304E5170327349384242316B534B3243796F356839684D7767317970654570483558423161324239494253557A514A563868675A626251446F30626E6D684F47576E69496C625174313446507836715945614965553535356259464F4639776B44672B7749685A2B477954365645575A4349366B796578664C54686C634B747051655A644C72324F747861457A63307641497368364D4254416E34446D55682B6C354A4E67336D333877684D5538444E46727858527977346538464676536F3433774F34555867703471766E45423459484670306E33687367527139685458447554494E4E67394C5161366969652B674965734B2B5968576F4D52694A447A4C7045586B5176727A62553442567A6A6A313857736558526F36677037756B3279697A2B383135614B484A55497937344A43646D6C6C3142577963614574534D2B4268557A7945346F59414E4E70364B57465155695A39414344532B69655A4C564D656B44684E4E516E32416B2B59722B45376B4E586F785151685146364A69357A35685177505A323068793535486345446F70704E61744C43456F56795358414B516A6371502B43492B794B6C4A316F306C45755343323053756D54646369546641744C53476E71694A562B356B4E706D377442637275354477446939576C44325450536F782F50354E3367534141634D52635171364B566C7A39414463473771746C63665348444145475344467861555055505059506A6F78532B43485143484B4F77455A66505A77563132396670516F64504F446D6B6161692F5164793534754764337353513943655167557A7A7056446979676F66424649586A6B66597470444D452F6B5A786E41716536424F396B6E6F4B48344B4F79783334474A6A4D5A78687863596F553462617050584B377A6F466A682B6E7475486F685A4350337863415845637048636A453347443742387073414D75674C784F474E6B706C2F4D613436664A61766C7A7A5979587949706245344F2B584D5570774D4267537949456D32777170583544696C7673773078444446374D635046746E53552F59565555357A52544E37356A414C636572596259397A7770763370354D444A45536B3958302B756D546B2B456E5A506562463148796E4A704A6B6B62615A59654A764D565A2F4D4B61634846374F6247616F62446461387766347270514A52576C6D71315450643646632B4D6C5066764B546E2F7A6B4A7A2F35562B522F345142644550784E6F4A49414141416C64455659644752686447553659334A6C5958526C414449774D6A51744D4445744D4468554D4463364E4451364D6A63724D4467364D4442797579355A414141414A5852465748526B5958526C4F6D31765A476C6D655141794D4449304C5441784C544134564441334F6A51304F6A49334B7A41344F6A4177412B6157355141414141424A52553545726B4A6767682B4C434167345035396C41414D6741444F7632724E6558596142356462535130594644424251424B566662465139586E427931613138666C75475578645A54326F315A58307764377643755533352F356D4C39356A35742F304F744A526F656E4A376975396C347A304B7331636E374368687538352F3873332F39717951574A6550376B72766D74532F706361553559682F58542B7A75506234342B4935576D356469323766766A546A6F736847466464375674774C7433763647465A70614169756664533068744776534A7152685932426B624F41675A32626B59464A6865306A4F364E514D502B662B526D4D312B382F6D7277733758437276765A765730564652675A47427037636241594F4C6B5A5839623037475268594753555A4751536C47596F5A536F48754C774469544341376C5547506F595368416F675A4743515A524C675947526A2B6368646F756478694647566A5A46426F574E4C49774141416966344C737749424141413D0A