Powershell malware analysis by @0xdf | Hack The Box
Source: YouTube · Hack The Box · published Mar 22, 2025 · 27:16
This video demonstrates solving a forensics CTF challenge called "fake boost" from the 2024 Cyber Apocalypse CTF, analyzing a pcap file to uncover a Discord token-stealing attack and recover the flag 0:00-0:14.
Key Takeaways:
• The challenge involves analyzing a large pcap file with over 2,000 packets, requiring filtering to exclude encrypted traffic (HTTPS/TLS) and focus on HTTP data 4:30-7:15
• A PowerShell script disguised as a "free Discord Nitro" generator contains malicious code designed to steal Discord tokens from browsers 7:20-10:50
• The script identifies browser profiles, steals tokens, encrypts them with AES, and sends them to a remote server controlled by attackers 12:50-16:35
• The flag is split into two parts: the first half ("free_nitro_nitrogen_exposed") is base64 encoded in the PowerShell script, while the second half requires AES decryption of captured data 16:40-23:10
• The presenter demonstrates two decryption methods: Python code and CyberChef with register operations to extract the IV and perform AES CBC decryption 23:15-26:40
The video showcases practical forensics analysis techniques, packet capture filtering, script deobfuscation, and decryption methods used to solve CTF challenges.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
hey this is xdf and welcome to the 2025 cyber apocalypse CTF workshops uh today I'm going to be working through a forensics Challenge from the 2024 cyber apocalypse CTF uh fake boost and one of the things that's really cool about hack the box is they take last year's uh CTF and they put all the challenges on the hack the Box websites where they can be played um so let's go check that out um I'm actually going to start by going here to the track section on hack the box and uh we can click in the little filter are here and if I type you know there's a ton of stuff here but if I click uh if I start by typing cyber I can get Cyber I get the you know 22 23 and 24 ctfs are there for playing um I'll click on last year's and we're going to be doing the forensics challenge fake boost right here um …