## Recovery [easy]
### Description
`We are The Profits. During a hacking battle our infrastructure was compromised as were the private keys to our Bitcoin wallet that we kept.We managed to track the hacker and were able to get some SSH credentials into one of his personal cloud instances, can you try to recover my Bitcoins?Username: satoshiPassword: L4mb0Pr0j3ctNOTE: Network is regtest, check connection info in the handler first.`
### Initial AnalysisI was provided with an IP with three ports. For the last port, I connected to the server using Netcat and was provided with additional information.
```bash$ nc 83.136.250.103 42153         Hello fella, help us recover our bitcoins before it's too late.Return our Bitcoins to the following address: bcrt1qd5hv0fh6ddu6nkhzkk8q6v3hj22yg268wytgwjCONNECTION INFO:   - Network: regtest  - Electrum server to connect to blockchain: 0.0.0.0:50002:t
NOTE: These options might be useful while connecting to the wallet, e.g --regtest --oneserver -s 0.0.0.0:50002:tHacker wallet must have 0 balance to earn your flag. We want back them all.
Options:1) Get flag2) Quit ```I need to transfer the stolen Bitcoins contained in the attacker Electrum wallet back to the provided Bitcoin wallet.
### SolutionTo access the attacker wallet, I used the credentials provided in the challenge description to set up a remote port forward for port 50002 from my workstation to the attacker's server with one of the other provided IP and ports.
```bash$ ssh -p 57644 -L 50002:127.0.0.1:50002 [email protected][email protected]'s password: <L4mb0Pr0j3ct>Linux ng-team-18335-blockchainrecoveryca2024-twdo6-665fbf6cb6-dd26f 5.10.0-18-amd64 #1 SMP Debian 5.10.140-1 (2022-09-02) x86_64
The programs included with the Debian GNU/Linux system are free software;the exact distribution terms for each program are described in theindividual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extentpermitted by applicable law.Last login: Thu Mar 14 15:01:40 2024 from 10.30.13.14satoshi@ng-team-18335-blockchainrecoveryca2024-twdo6-665fbf6cb6-dd26f ➜  ~ ```
Looking in the `satoshi` user's home directory, there's a directory called `wallet` with the `electrum-wallet-seed.txt` file which contains the seed phrase for the attacker's Electrum wallet.
```bashsatoshi@ng-team-18335-blockchainrecoveryca2024-twdo6-665fbf6cb6-dd26f ➜  ~ cat wallet/electrum-wallet-seed.txt chapter upper thing jewel merry hammer glass answer machine tag escape fitness```
With this seed phrase, I installed Electrum on my workstation, connected to the the attacker's Electrum server over my SSH tunnel, and created a new default, standard local wallet with the attacker's seed phrase and connected to the attacker's wallet in the Electrum app to transfer the Bitcoins back to the provided wallet.
```bashelectrum --regtest --oneserver -s 127.0.0.1:50002:telectrum --regtest --oneserver -s 127.0.0.1:50002:t```
![Screenshot 2024-03-14 at 11.15.36.png](https://0x1uke.com/content/images/2024/03/Screenshot-2024-03-14-at-11.15.36.png)
![Screenshot 2024-03-14 at 11.16.06.png](https://0x1uke.com/content/images/2024/03/Screenshot-2024-03-14-at-11.16.06.png)
![Screenshot 2024-03-14 at 11.17.08.png](https://0x1uke.com/content/images/2024/03/Screenshot-2024-03-14-at-11.17.08.png)
![Screenshot 2024-03-14 at 11.17.38.png](https://0x1uke.com/content/images/2024/03/Screenshot-2024-03-14-at-11.17.38.png)
The Bitcoins were returned to the provided wallet, the attacker wallet balance was zero, and I could now acquire the flag.
```bash$ nc 83.136.250.103 42153Hello fella, help us recover our bitcoins before it's too late.Return our Bitcoins to the following address: bcrt1qd5hv0fh6ddu6nkhzkk8q6v3hj22yg268wytgwjCONNECTION INFO:   - Network: regtest  - Electrum server to connect to blockchain: 0.0.0.0:50002:t
NOTE: These options might be useful while connecting to the wallet, e.g --regtest --oneserver -s 0.0.0.0:50002:tHacker wallet must have 0 balance to earn your flag. We want back them all.
Options:1) Get flag2) QuitEnter your choice: 1HTB{n0t_y0ur_k3ys_n0t_y0ur_c01n5}```