Bronze IIPractical Malware Analysis: .NET Encryption and Encoding
I have completed all of the questions except decrypting the configuration string.
I have the correct AES key (question 7 is correct - first 5 chars of the AES key)
Although it seems that the instructions in part 6 - "Take the first 16 bytes of the hash and add it to the full hash. Your key should be: MD5 hash of password + first 16 bytes of MD5 hash of password" give a different key to the python snippet in the briefing section:
import hashlib
value = ''
key_hash = hashlib.md5(value.encode('utf-8')).hexdigest()
aes_key = key_hash[:30] + key_hash + '00'
print(aes_key)
So I have two differing keys:
A = full md5 hash + full md5 hash (as the md5 hash is 16 bytes)
B = first 30 chars of md5 hash + full md5 hash + 00
I have tried using both of these AES keys to decrypt the configuration string found in StubAdmin.bin > StubAdmin.bin.exe > Resources > System_Configuration.Resources.resoures > A
I have tried both decoding the string from base64 before decrypting and without decoding and CyberChef tells me it is "unable to decrypt input with these parameters" every time.
Hi KieranRowley,
I pointed out in a support ticket and will mention it here that there are a couple of errors in the lab instructions:
- In point 6 the instructions state: "Your key should be:MD5 hash of password + first 16 bytes of MD5 hash of password"
This is the opposite way round from the format support provided (which is correct when using the python snippet provided in the briefing section. - In addition, I believe it is not the first 16 bytes of the md5 hash that should be used. The complete md5 hash is in total 16 bytes as each char is 4 bits so as the md5 hash is 32 chars; 32 x 4 = 128 bits and 8 bits in a byte means 128 / 8 = 16 bytes.
As you are using the first 30 chars of the md5 hash this would mean that 30 * 4 (bits) = 120 bits / 8 (bytes) = 15 bytes.
This should be corrected to read:
"Your key should be:
The first 15 bytes of MD5 hash of password + the full MD5 hash of password + 00
i.e. XXXXX62a7591b26eda8b011394a0b8 + XXXXX62a7591b26eda8b011394a0b88b + 00
- In point 6 the instructions state: "Your key should be:MD5 hash of password + first 16 bytes of MD5 hash of password"
