# Trend Micro CTF 2015: Analysis - Defensive 300
----------## Challenge details| Contest        | Challenge     | Category  | Points ||:---------------|:--------------|:----------|-------:|| Trend Micro CTF 2015 | Analysis - Defensive 300 | Reversing |    300 |
**Description:**>*Category: Analysis-defensive*>>*Points: 300*>>*This is a REAL backdoor network traffic!*>>*Tracing hacker's footprint to find the key!*>>*Hint:*>>*Poison Ivy / admin*>>*Zip Password: trace_hacker*
----------## Write-up
We are given an [archive](challenge/net.zip) which contains a PCAP file with traffic from the [Poison Ivy](https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf) backdoor. Poison Ivy encrypts its traffic using the [Camellia](https://en.wikipedia.org/wiki/Camellia_(cipher)) block cipher (in a very [flawed manner](samvartaka.github.io/malware/2015/09/07/poison-ivy-reliable-exploitation/)) and deriving the encryption key directly from an attacker-supplied password (by padding it with null bytes). The default password for Poison Ivy is 'admin' which will allow us to decrypt the traffic in the PCAP.
Luckily MITRE's [ChopShop framework](https://github.com/MITRECND/chopshop) allows us to easily process the PCAP using [FireEye's Poison Ivy 2.3.x module](https://github.com/MITRECND/chopshop/blob/master/modules/poisonivy_23x.py) and extract whatever contents the malware traffic holds.
We use ChopShop in the following manner to decrypt and dump the traffic and extract any transmitted files from it:
```bash$ ./chopshop -f net.pcap -s ./ "poisonivy_23x -c -w admin"Warning Legacy Module poisonivy_23x!Starting ChopShop (Created by MITRE)Initializing Modules ...  Initializing module 'poisonivy_23x'Running Modules ...[2015-09-04 04:43:44 EDT]  Poison Ivy Version: 2.32[2015-09-04 04:43:44 EDT]  *** Host Information ***PI profile ID: ctfIP address: 192.168.0.100Hostname: ADMIN-PCWindows User: AdministratorWindows Version: Windows XPWindows Build: 2600Service Pack: Service Pack 3[2015-09-04 04:43:58 EDT]  *** Directory Listing Initiated ***Directory: C:\WINDOWS\[2015-09-04 04:43:58 EDT]  *** Directory Listing Sent ***[2015-09-04 04:44:57 EDT]  *** Service Listing Sent ***[2015-09-04 04:45:06 EDT]  *** Screen Capture Sent ***PI-extracted-file-1-screenshot.bmp saved..Shutting Down Modules ...  Shutting Down poisonivy_23xModule Shutdown Complete ...ChopShop Complete```
The extracted screenshot file provides us with the flag:
![alt screenshot](PI-extracted-file-1-screenshot.bmp)