Skip to content
This repository has been archived by the owner on Jun 11, 2024. It is now read-only.

Commit

Permalink
Complete chall
Browse files Browse the repository at this point in the history
  • Loading branch information
ItzSwirlz committed Dec 21, 2023
1 parent 50a91f0 commit a7f15a2
Show file tree
Hide file tree
Showing 4 changed files with 1 addition and 2 deletions.
1 change: 0 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -458,7 +458,6 @@ gradle-app.setting
.mtj.tmp/

# Package Files #
*.jar
*.war
*.nar
*.ear
Expand Down
Binary file added flagtureiser/flagtureiser-4.2.0.6.9.jar
Binary file not shown.
Binary file added flagtureiser/gradle/wrapper/gradle-wrapper.jar
Binary file not shown.
2 changes: 1 addition & 1 deletion flagtureiser/solve.txt
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ This challenge is a reference to the Fractureiser Minecraft Modded Malware from

An entire writeup can be found here (https://github.com/fractureiser-investigation/fractureiser/blob/main/docs/tech.md) but essentially the part I'm referencing is how the mods actually secretly downloaded the malware.

This bad actor uploaded modified versions of the mod JAR files to Curseforge accounts of popular mods. These jars were the same; the mod was still there, but the bad actor (who was able to do this since most mods are open source and java is decompilable) added an operation to, once the mod was loaded, download the actual malware files to the victim's computer from a server. There were different IPs for each mod (yeah, whoever wrote this was on crack or something). The IP of this server was obfuscated by array bytes.
This bad actor uploaded modified versions of the mod JAR files to Curseforge accounts of popular mods. These jars were the same; the mod was still there, but the bad actor (who was able to do this since most mods are open source and java is decompilable) added an operation to, once the mod was loaded, download the actual malware files to the victim's computer from a server. There were different IPs for each mod (yeah, pretty wild). The IP of this server was obfuscated by array bytes.

The flag is like the server IP - hidden in these bytes, and the rest of the mod is just referencing history.

Expand Down

0 comments on commit a7f15a2

Please sign in to comment.