取证记录：平航杯

题目描述
"2025年4月，杭州滨江警方接到辖区内市民刘晓倩(简称：倩倩)报案称：其个人电子设备疑似遭人监控。经初步调查，警方发现倩倩的手机存在可疑后台活动，手机可能存在被木马控制情况；对倩倩计算机进行流量监控，捕获可疑流量包。遂启动电子数据取证程序。

警方通过对倩倩手机和恶意流量包的分析，锁定一名化名“起早王”的本地男子。经搜查其住所，警方查扣一台个人电脑和服务器。技术分析显示，该服务器中存有与倩倩设备内同源的特制远控木马，可实时窃取手机摄像头、手机通信记录等相关敏感文件。进一步对服务器溯源，发现“起早王”曾渗透其任职的科技公司购物网站，获得公司服务器权限，非法窃取商业数据并使用公司的服务器搭建Trojan服务并作为跳板机实施远控。
请你结合以上案例并根据相关检材，完成下面的勘验工作。"

检材：
window.e01                            
20250415_181118.zip        
export-disk0-000002.vmdk   
BLE                                     
USBPcap

通过网盘分享的文件：平航杯题目
链接: https://pan.baidu.com/s/1W_qpPBywESchS2UCovFgYA?pwd=njf7 提取码: njf7 
--来自百度网盘超级会员v6的分享
MD5: 6F3AE91C3152E8394B2E743FB2C75CCE
大小: 75161927680 字节
（是一个veracrypt加密，密钥是 早起王的爱恋日记❤   

> node
Welcome to Node.js v21.7.1.
Type ".help" for more information.
> new Date(1741607525472)
2025-03-10T11:52:05.472Z

搞了个钱包，助记词老是要忘记掉怎么办，要不放在输入法里试试。

function getFlag() {
    let AESUtil = Java.use("com.example.puzzlegame.util.AESUtil").$new();
    console.log(AESUtil.decryptFlag());
  }
  
  function main() {
    Java.perform(() => {
      getFlag();
    })
  }
  
  setImmediate(main)

r = open("DATA/浏览器(com.android.browser).bak","rb").read()
idx = r.find(b"none\n") + 5
r = r[idx:]
open("1.tar","wb").write(r)

# Decompiled with PyLingual (https://pylingual.io)
# Internal filename: gift_builder.py
# Bytecode version: 3.10.0rc2 (3439)
# Source timestamp: 1970-01-01 00:00:00 UTC (0)

import os
import sys
import shutil
import zipfile
import tempfile
import base64
import zlib
import subprocess
import tkinter as tk
from tkinter import simpledialog, messagebox
PASSWORD = '20010811'
PACKED_DATA = b'....' # 太大了，这里放不下
def extract_and_run(packed_data):
    """解压并运行文件"""
    try:
        data = zlib.decompress(base64.b64decode(packed_data))
        extract_dir = os.path.join(tempfile.gettempdir(), 'gift_extracted')
        if os.path.exists(extract_dir):
            shutil.rmtree(extract_dir)
        os.makedirs(extract_dir)
        temp_zip = os.path.join(extract_dir, 'packed.zip')
        with open(temp_zip, 'wb') as f:
            f.write(data)
        with zipfile.ZipFile(temp_zip, 'r') as zipf:
            zipf.extractall(extract_dir)
        for file in os.listdir(extract_dir):
            if file.lower().endswith('.exe'):
                exe_path = os.path.join(extract_dir, file)
                subprocess.Popen([exe_path])
        return True
    except Exception as e:
        messagebox.showerror('错误', '解压或运行出错: {e}')
        return False

def main():
    root = tk.Tk()
    root.withdraw()
    password = simpledialog.askstring('密码', '我将永远记得你的生日:', show='*')
    if password == PASSWORD:
        success = extract_and_run(PACKED_DATA)
        if success:
            messagebox.showinfo('成功', '礼物已解锁！')
        else:
            messagebox.showerror('失败', '礼物解锁失败')
    else:
        messagebox.showerror('错误', '密码错误！')
if __name__ == '__main__':
    main()

> md5sum GIFT.exe
5a20b10792126ffa324b91e506f67223  GIFT.exe

python

import pywintypes
import win32api
import win32con
import winerror
from typing import Union, Iterator

LOAD_LIBRARY_AS_DATAFILE = 0x02

def load_library_as_datafile(library_path: str):
    library_handle = win32api.LoadLibraryEx(library_path, 0, LOAD_LIBRARY_AS_DATAFILE)
    assert library_handle != 0
    return library_handle

def enum_resources(library_handle):
    # 获取所有资源类型
    try:
        resource_types = win32api.EnumResourceTypes(library_handle)

        for res_type in resource_types:
            print(f"\nResource Type: {res_type}")
            
            # 获取该类型下的所有资源名称
            try:
                resource_names = win32api.EnumResourceNames(library_handle, res_type)
                for res_name in resource_names:
                    print(f"  Resource Name: {res_name}")
                    
                    # 获取资源数据
                    try:
                        resource_info = win32api.LoadResource(library_handle, res_type, res_name)
                        print(f"  Resource Size: {len(resource_info)} bytes")
                        
                        # 可以将资源保存到文件
                        with open(f"resource_{res_type}_{res_name}.bin", "wb") as f:
                            f.write(resource_info)
                        
                    except pywintypes.error as e:
                        print(f"  Error loading resource: {e}")
            except pywintypes.error as e:
                print(f"Error enumerating names: {e}")
    except pywintypes.error as e:
        print(f"Error enumerating types: {e}")
library_handle = load_library_as_datafile("1.exe")
enum_resources(library_handle)
win32api.FreeLibrary(library_handle)

$ md5sum 1.png
733fc4483c0e7db1c034be5246df5ec0  1.png

-----BEGIN PUBLIC KEY-----
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAIzKlacuMz/XDuZv8sNMJr3S86VHOBTZ
1IKSidumIpnw7QNXE2WpzZcW5jNuTkz7INkmkVGXauzN6BlHpYJkXRcCAwEAAQ==
-----END PUBLIC KEY-----

RSA