Tips & Tricks For Forensics Challenges by 0xdf_ | Hacking Workshop

This video features a walkthrough of two forensic CTF challenges: extracting a Zip file hidden within ICMP packets using Wireshark and Python to find a flag in a Firefox profile, and analyzing a malicious Word document macro to decode a PowerShell payload 3:22.

Key Takeaways:
• Wireshark's Protocol Hierarchy tool is used to identify anomalies, such as excessive ICMP traffic, where inspecting packet payloads reveals "PK" magic bytes indicating a hidden Zip file 5:06.
• The presenter uses Python with the Scapy library to filter ICMP echo requests, extract data from specific byte offsets, and reconstruct the Zip file to disk 14:10.
• The extracted Zip contains a Firefox profile, and the tool firepwd.py is utilized to decrypt saved credentials and uncover the challenge flag 21:48.
• Using olevba on a malicious .docm file reveals an auto-open macro that constructs a shell command by decoding hex strings, which the presenter translates into Python for easier decoding 23:42.

David advises examining all parts of malicious code, such as scheduled tasks, rather than just the immediate payloads to locate hidden flags 34:00.

Sources:

• 3:22 Introduction to "Oldest Trick in the Book" challenge
• 5:06 Analyzing ICMP traffic and magic bytes
• 14:10 Using Python and Scapy to extract data
• 21:48 Using firepwd.py to get the flag
• 23:42 Analyzing the malicious Word document macro
• [34