HackConRD CTF 2024: Forensics Instructions

This challenge provides us with a docm document, which we have to analyze to look for any malicious code in it.

We tried to open the document to see its content. It only has two pages, which don’t provide us with anything interesting.

The document opened, showing two pages with nothing useful

Researching on Google, we found that we could analyze the macros and memory leak using a Python package: oletools.

oletools is a package of Python tools to analyze Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging.

We use the command olevba without any options to see all the macro information.

bash

olevba vpn_instructions.docm

Here we find a piece of code that literally gives us a URL with our flag, information that we’ll have to decode to obtain the flag in plaintext.

olevba output revealing the VBA macro with the flag URL

Reviewing the code, we see that the type of obfuscation it uses is changing the letters to their ASCII format.

Using the table of all the Chr() codes, we changed the code for the corresponding letter and obtained:

HTB{n3w_VPN_n3w_b4ck

We obtained the other part from the next line of the code, which changes the letter o to 0, and concatenated it to the end of the previous text.

Completing our flag with the information we got:

HTB{n3w_VPN_##########}

Thanks for reading.