---
# System prepended metadata

title: CyberDefender - GrabThePhisher
tags: [Threat Intel, CyberDefender]

---

# CyberDefender - GrabThePhisher
Challenge: https://cyberdefenders.org/blueteam-ctf-challenges/95

:::spoiler TOC
[TOC]
:::

## Scenario
> An attacker compromised a server and impersonated https://pancakeswap.finance/, a decentralized exchange native to BNB Chain, to host a phishing kit at https://apankewk.soup.xyz/mainpage.php. The attacker set it as an open directory with the file name "pankewk.zip". 
>
>Provided the phishing kit, you as a soc analyst are requested to analyze it and do your threat intel homework.

## ==Q1==
> Which wallet is used for asking the seed phrase? 
### Recon
從scenario就可以知道他大概是一個網站被攻擊後盜用，轉變成用來騙別人的釣魚網站，因此可以看一下整體的資料夾結構會發現他所採用的錢包就是metamask

:::spoiler Flag
Flag: `Metamask`
:::
## ==Q2==
> What is the file name that has the code for the phishing kit? 
### Recon
同上，只要觀察資料夾結構就可以知道有一個file叫做metamask.php

:::spoiler Flag
Flag: `metamask.php`
:::
## ==Q3==
> In which language was the kit written? 
### Recon
同上

:::spoiler Flag
Flag: `php`
:::
## ==Q4==
>What service does the kit use to retrieve the victim's machine information? 
### Recon
這個就比較有趣一點，通常問的應該是哪一個api之類的服務，所以應該要往這個方向想，看了一下`matamask.php`，裡面有提到
```php
$request = file_get_contents("http://api.sypexgeo.net/json/".$_SERVER['REMOTE_ADDR']); 
```
代表他所使用的應該是Sypex Geo這個service，查了一下，可以看一下[github repo](https://github.com/hostbrook/sypex-geo)，的確就像題目敘述一樣是可以藉由IP取得受害者機器的一些相關訊息

:::spoiler Flag
Flag: `Sypex Geo`
:::
## ==Q5==
>How many seed phrases were already collected? 
### Recon
我是直接看`/log/log.txt`的內容發現有三行，且每一行都有固定12個phrase，所以我猜應該已經取得三個受害電腦的seed phrase

:::spoiler Flag
Flag: `3`
:::
## ==Q6==
>Write down the seed phrase of the most recent phishing incident? 
### Exploit
同上，把最後一列的seed phrase貼上就對了

:::spoiler Flag
Flag: `father also recycle embody balance concert mechanic believe owner pair muffin hockey`
:::
## ==Q7==
> Which medium had been used for credential dumping? 
### Recon
如果仔細看`metamask.php`的後半段會發現他還有call到telegram的API，主要用途是拿取seed phrase，再把這些東西append到`/log/log.txt`中

:::spoiler Flag
Flag: `telegram`
:::
## ==Q8==
> What is the token for the channel? 
### Recon
同上

:::spoiler Flag
Flag: `5457463144:AAG8t4k7e2ew3tTi0IBShcWbSia0Irvxm10`
:::
## ==Q9==
> What is the chat ID of the phisher's channel? 
### Exploit
同上

:::spoiler Flag
Flag: `5442785564`
:::
## ==Q10==
> What are the allies of the phish kit developer? 
### Exploit
可以從註解當中看到j1j1b1s@m3r0這個人應該也有提供一些協助

:::spoiler Flag
Flag: `j1j1b1s@m3r0`
:::
## ==Q11==
> What is the full name of the Phish Actor? 
### Exploit
如果把檔案中提供的token/id當作TG的parameter會得到甚麼東西呢?$\to$`https://api.telegram.org/bot5457463144:AAG8t4k7e2ew3tTi0IBShcWbSia0Irvxm10/getChat?chat_id=5442785564`

![](https://hackmd.io/_uploads/HkeL-lHfp.png)

:::spoiler Flag
Flag: `Marcus Aurelius`
:::
## ==Q12==
> What is the username of the Phish Actor? 
### Exploit
同上

:::spoiler Flag
Flag: `pumpkinboii`
:::
## Reference
[A walkthrough of CyberDefenders “GrabThePhisher — Threat intel” CTF](https://medium.com/@eduzorkamsi/a-walkthrough-of-cyberdefenders-grabthephisher-threat-intel-ctf-dfdb4f8ce525)