取证记录：平航杯

题目描述"2025年4月，杭州滨江警方接到辖区内市民刘晓倩(简称：倩倩)报案称：其个人电子设备疑似遭人监控。经初步调查，警方发现倩倩的手机存在可疑后台活动，手机可能存在被木马控制情况；对倩倩计算机进行流量监控，捕获可疑流量包。遂启动电子数据取证程序。警方通过对倩倩手机和恶意流量包的分析，锁定一名化名“起早王”的本地男子。经搜查其住所，警方查扣一台个人电脑和服务器。技术分析显示，该服务器中存有与倩倩设备内同源的特制远控木马，可实时窃取手机摄像头、手机通信记录等相关敏感文件。进一步对服务器溯源，发现“起早王”曾渗透其任职的科技公司购物网站，获得公司服务器权限，非法窃取商业数据并使用公司的服务器搭建Trojan服务并作为跳板机实施远控。请你结合以上案例并根据相关检材，完成下面的勘验工作。"检材：window.e01                            20250415_181118.zip        export-disk0-000002.vmdk   BLE                                     USBPcap

通过网盘分享的文件：平航杯题目链接: https://pan.baidu.com/s/1W_qpPBywESchS2UCovFgYA?pwd=njf7 提取码: njf7 --来自百度网盘超级会员v6的分享MD5: 6F3AE91C3152E8394B2E743FB2C75CCE大小: 75161927680 字节（是一个veracrypt加密，密钥是 早起王的爱恋日记❤   

> nodeWelcome to Node.js v21.7.1.Type ".help" for more information.> new Date(1741607525472)2025-03-10T11:52:05.472Z

搞了个钱包，助记词老是要忘记掉怎么办，要不放在输入法里试试。

function getFlag() {    let AESUtil = Java.use("com.example.puzzlegame.util.AESUtil").$new();    console.log(AESUtil.decryptFlag());  }    function main() {    Java.perform(() => {      getFlag();    })  }    setImmediate(main)

r = open("DATA/浏览器(com.android.browser).bak","rb").read()idx = r.find(b"none\n") + 5r = r[idx:]open("1.tar","wb").write(r)

# Decompiled with PyLingual (https://pylingual.io)# Internal filename: gift_builder.py# Bytecode version: 3.10.0rc2 (3439)# Source timestamp: 1970-01-01 00:00:00 UTC (0)import osimport sysimport shutilimport zipfileimport tempfileimport base64import zlibimport subprocessimport tkinter as tkfrom tkinter import simpledialog, messageboxPASSWORD = '20010811'PACKED_DATA = b'....' # 太大了，这里放不下def extract_and_run(packed_data):    """解压并运行文件"""    try:        data = zlib.decompress(base64.b64decode(packed_data))        extract_dir = os.path.join(tempfile.gettempdir(), 'gift_extracted')        if os.path.exists(extract_dir):            shutil.rmtree(extract_dir)        os.makedirs(extract_dir)        temp_zip = os.path.join(extract_dir, 'packed.zip')        with open(temp_zip, 'wb') as f:            f.write(data)        with zipfile.ZipFile(temp_zip, 'r') as zipf:            zipf.extractall(extract_dir)        for file in os.listdir(extract_dir):            if file.lower().endswith('.exe'):                exe_path = os.path.join(extract_dir, file)                subprocess.Popen([exe_path])        return True    except Exception as e:        messagebox.showerror('错误', '解压或运行出错: {e}')        return Falsedef main():    root = tk.Tk()    root.withdraw()    password = simpledialog.askstring('密码', '我将永远记得你的生日:', show='*')    if password == PASSWORD:        success = extract_and_run(PACKED_DATA)        if success:            messagebox.showinfo('成功', '礼物已解锁！')        else:            messagebox.showerror('失败', '礼物解锁失败')    else:        messagebox.showerror('错误', '密码错误！')if __name__ == '__main__':    main()

> md5sum GIFT.exe5a20b10792126ffa324b91e506f67223  GIFT.exe

python

import pywintypesimport win32apiimport win32conimport winerrorfrom typing import Union, IteratorLOAD_LIBRARY_AS_DATAFILE = 0x02def load_library_as_datafile(library_path: str):    library_handle = win32api.LoadLibraryEx(library_path, 0, LOAD_LIBRARY_AS_DATAFILE)    assert library_handle != 0    return library_handledef enum_resources(library_handle):    # 获取所有资源类型    try:        resource_types = win32api.EnumResourceTypes(library_handle)        for res_type in resource_types:            print(f"\nResource Type: {res_type}")                        # 获取该类型下的所有资源名称            try:                resource_names = win32api.EnumResourceNames(library_handle, res_type)                for res_name in resource_names:                    print(f"  Resource Name: {res_name}")                                        # 获取资源数据                    try:                        resource_info = win32api.LoadResource(library_handle, res_type, res_name)                        print(f"  Resource Size: {len(resource_info)} bytes")                                                # 可以将资源保存到文件                        with open(f"resource_{res_type}_{res_name}.bin", "wb") as f:                            f.write(resource_info)                                            except pywintypes.error as e:                        print(f"  Error loading resource: {e}")            except pywintypes.error as e:                print(f"Error enumerating names: {e}")    except pywintypes.error as e:        print(f"Error enumerating types: {e}")library_handle = load_library_as_datafile("1.exe")enum_resources(library_handle)win32api.FreeLibrary(library_handle)

$ md5sum 1.png733fc4483c0e7db1c034be5246df5ec0  1.png

-----BEGIN PUBLIC KEY-----MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAIzKlacuMz/XDuZv8sNMJr3S86VHOBTZ1IKSidumIpnw7QNXE2WpzZcW5jNuTkz7INkmkVGXauzN6BlHpYJkXRcCAwEAAQ==-----END PUBLIC KEY-----

RSA