Seized - HackTheBox Challenge Writeup

Challenge Information

Description

Miyuki and her team are investigating a newly formed ransomware division working for Longhir, targeting critical infrastructure with no intent to restore encrypted files even after ransom payment. This case is top priority. A hard drive has been seized from one of the members, and intelligence suggests it contains credentials for the Ransomware Dashboard hidden within the AppData folder. Your task is to retrieve these credentials from the provided forensic image.

Solution Overview

This forensics challenge requires analyzing a Windows AppData folder to locate and extract credentials for a ransomware dashboard. The solution involves:

1. Extracting and examining the AppData directory structure
2. Identifying credential storage locations in Windows (browser cache, password managers, application config files)
3. Parsing relevant files for plaintext or encoded credentials
4. Recovering the dashboard credentials

Key Steps

Step 1: Examine AppData Structure

# List the AppData directory to identify interesting locations
ls -la AppData/

# Common credential storage locations in Windows:
# - Roaming/Microsoft/Credentials/
# - Local/Google/Chrome/User Data/
# - Roaming/FileZilla/
# - Local/Discord/
# - Browser caches and databases

Step 2: Search for Configuration Files

# Recursively search for configuration files that might contain credentials
find AppData/ -type f \( -name "*.conf" -o -name "*.config" -o -name "*.ini" \)

# Look for credential-related files
grep -r "password\|credential\|dashboard" AppData/ 2>/dev/null

Step 3: Check Browser Data

# Examine Chrome/Chromium user data
ls -la AppData/Local/Google/Chrome/User\ Data/Default/

# Check for stored login data (typically SQLite database)
# Extract from Login Data file
sqlite3 AppData/Local/Google/Chrome/User\ Data/Default/Login\ Data \
  "SELECT origin_url, username_value, password_value FROM logins;"

Step 4: Decode Encrypted Credentials

# Chrome passwords on Windows are encrypted with DPAPI
# Extract the encrypted password blob and decrypt using Windows APIs
# or identify plaintext credentials in other locations

# Check for unencrypted config files
cat AppData/Roaming/*/config.txt
cat AppData/Local/*/credentials.txt

Step 5: Extract the Flag

Once credentials are recovered from the forensic image, the flag will be in the format:

HTB{<redacted>}

Tools Used

• File System Analysis: find, ls, grep
• Database Inspection: sqlite3
• Text Processing: cat, strings, xxd
• Archive Extraction: 7z, unzip (if AppData is compressed)

Key Learnings

1. Windows AppData Structure: Understanding the Windows user profile structure is essential for forensics. The AppData folder contains three main directories:

   • Roaming/ - User profile data synced across machines
   • Local/ - Machine-specific application data
   • LocalLow/ - Low-privilege application data

2. Credential Storage: Attackers often store dashboard credentials in:

   • Browser autofill databases (Login Data)
   • Application config files
   • Unencrypted text files within application directories
   • Temporary files and caches

3. Chrome Password Extraction: Chrome stores passwords in an SQLite database, but they’re encrypted with DPAPI on Windows. However, plaintext credentials or base64-encoded values may exist in other application folders.

4. Forensic Approach: Always start with the most accessible locations before attempting complex encryption breaking. Many system administrators and users store credentials in plaintext in config files, especially in development or testing environments.

5. File Carving: If credentials are deleted, file carving techniques and unallocated space analysis may recover remnants of credential files.