MAL: Strings WriteUp – TryHackMe

In this article, I tried to prepare a write-up for the “MAL: Strings” room on tryhackme.

---

[Task 1] What are “strings”?

From a programming perspective, “strings” is the term given for data handled by an application. At a broader view, these pieces of data are used to store information such as text to numerical values.

#1 What is the name of the account that had the passcode of “12345678” in the intellian example discussed above?

ANSWER: intellian

#2 What is the CVE entry disclosed by the company “Teradata” in their “Viewpoint” Application that has a password within a string?

ANSWER: CVE-2019-6499

#3 According to OWASP’s list of “Top Ten IoT” vulnerabilities, name the ranking this vulnerability would fall within, represented as text.

ANSWER: one

---

[Task 2] Practical: Extracting “strings” From an Application

#1 What is the correct username required by the “LoginForm”?

ANSWER: cmnatic

#2 What is the required password to authenticate with?

ANSWER: TryHackMeMerchWhen

#3 What is the “hidden” THM{} flag?

ANSWER: THM{Not_So_Hidden_Flag}

---

[Task 3] Strings in the Context of Malware

#1 What is the key term to describe a server that Botnets recieve instructions from?

ANSWER: Command and Control

#2 Name the discussed example malware that uses “strings” to store the bitcoin wallet addresses for payment

ANSWER: Wannacry

---

[Task 4] Practical: Finding Bitcoin Addresses in Ransomware (Deploy!)

#1 List the number of total transactions that the Bitcoin wallet used by the “Wannacry” author(s)

ANSWER: 140

#2 What is the Bitcoin Address stored within “ComplexCalculator.exe”

ANSWER: 1LVB65imeojrgC3JPZGBwWhK1BdVZ2vYNC

---

[Task 5] Summary

#1 What is the name of the toolset provided by Microsoft that allows you to extract the “strings” of an application?

ANSWER: Sysinternals

#2 What operator would you use to “pipe” or store the output of the strings command?

ANSWER: >

#3 What is the name of the currency that ransomware often uses for payment?

ANSWER: bitcoin

---

So far, I have tried to explain the solutions of the questions as detailed as I can. I hope it helped you. See you in my next write-up.