Business CTF 2023 - Looking at Forensics Challenges from BizCTF 2022 by 0xdf

·27 min·1 clip

WMI persistence uses a filter, consumer, and binding to execute an encoded PowerShell payload without writing malware to disk.

1. Hack The Box: Stories episode "Business CTF 2023" examines the MB coin and Perseverance forensics challenges from the 2022 Business CTF. 2. 0xdf, the challenge creator for MB coin, leads a Windows and Linux walkthrough using VBA extraction, Wireshark, Python, and .NET tooling. 3. The episode's central workflow combines document analysis, PCAP carving, decoding, and WMI repository inspection to recover challenge flags. 4. MB coin uses a real phishing Word document with lightly obfuscated VBA macros and a VBScript that attempts five DLL downloads. 5. The document prompts users to "enable contents," while its auto-open macro extracts hidden shape text and writes program data pin.vbs. 6. 0xdf uses olevba and oledump on Linux to recover macro streams and reconstruct the PowerShell download-and-decrypt behavior. 7. Because the listed HDB URLs do not exist, the PCAP provides HTTP objects, including a successful cabling-point response and 404 results for other domains. 8. Perseverance presents WMI persistence through three components: a filter, a consumer, and a binding connecting the event to its action. 9. Flare team Python tools reveal an encoded PowerShell payload that reads a base64 value from a Win32 memory array device, inflates it, and loads it in memory. 10. Cybersecurity learners practicing malware triage and Windows persistence.

As heard by us

A practical forensic trail from phishing document and PCAP analysis to malware, flags, and WMI persistence.

OXDF turns malware analysis into a scavenger hunt, following the MB coin challenge from a phishing Word document with lightly obfuscated VBA macros into a dropped VB script, failed DLL downloads, a PCAP, and requests that can be carved, decoded, and traced to a flag inside a…

Read the full review in PlayNext →

Why you'd press play

Want a forensic puzzle that turns failed malware URLs into a trail toward the flag?

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Hack The Box: Stories