📝 TryHackMe. Walkthrough: Mr. Phisher

The Site: TryHackMe
Name room: Mr. Phisher
Difficulty: Easy

We need to examine a file with the extension .docm which was received in a phishing email. The file contains macros that can be dangerous when the file is opened.

This is a task we have to do in Ubuntu with the MATE shell. For me this is not very convenient, so the first thing I did was to download the file to my local machine by going to the directory /home/ubuntu/mrphisher/ in the terminal:

$ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

After that, from your local machine you can open http://machine_ip:8000/ and download the file MrPhisher.docm.

To analyze the file I used oletools.

$ olevba MrPhisher.docm
...
VBA MACRO NewMacros.bas
in file: word/vbaProject.bin - OLE stream: 'VBA/NewMacros'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Sub Format()
Dim a()
Dim b As String
a = Array(102, 109, 99, 100, 127, 100, 53, 62, 105, 57, 61, 106, 62, 62, 55, 110, 113, 114, 118, 39, 36, 118, 47, 35
, 32, 125, 34, 46, 46, 124, 43, 124, 25, 71, 26, 71, 21, 88)
For i = 0 To UBound(a)
b = b & Chr(a(i) Xor i)
Next
End Sub

Extract the Visual Basic code from the file and try to rewrite it in Python.

a = [102, 109, 99, 100, 127, 100, 53, 62, 105, 57, 61, 106, 62, 62, 55, 110, 113, 114, 118, 39, 36, 118,
47, 35, 32, 125, 34, 46, 46, 124, 43, 124, 25, 71, 26, 71, 21, 88]

for i in enumerate(a):
  print(chr(i[1] ^ i[0]), end='')

Execute the script and get the flag.

Answer: f**g{*******a239aacd40c948d852a5c*****}