Lure

Name	Lure
Hint	The finance team received an important looking email containing an attached Word document. Can you take a look and confirm if it's malicious?
Base Points	Easy - Retired [0]
Rated Difficulty
	HTB-Bot
Creator	egre55

Download and unzip the challenge archive. The supplied file is UrgentPayment.doc.

This document contains macros. To inspect the package, copy it with a .zip extension instead of .doc, then unzip it to review the XML files and embedded script content.

Extracted contents of the UrgentPayment Word document — Reviewing the document package contents.

The extracted files do not immediately reveal anything useful, so I upload the original document to VirusTotal. It lights up like a Christmas tree. The Community tab includes a reference exposing the command and code.

VirusTotal detections for the malicious Word document — VirusTotal detections for the supplied document.

VirusTotal community analysis showing suspicious command data — Community analysis reveals the suspicious command.

Encoded PowerShell content extracted from the malicious document — The encoded and obfuscated PowerShell content.

After Base64 decoding the string in CyberChef, we get another string that resembles a PowerShell command, but the additional characters make it difficult to read. A short Python script removes the periods and quotes, splits the elements, and reconstructs them in the required order.

CyberChef output containing the obfuscated PowerShell string — The decoded but still-obfuscated command.

string = ‘.".B.".,.".U.".,.".4.".,.".B.".,.".%.7.D.".,.".h.t.".,.".R._.d.".,."//.o.w...l.y/.H.T.".,.".p:.".,.".T.".,.".0.".,."._.".,.".N.".,.".M.".,.".%.7.".,.".E.".,.".f.".,.".1.T.".,.".u.".,.".e.".,.".5.".,.".k.".,.".R.".,.".h.".,.".0.".,.".t.".,.".w.".,."._.".,.".l.".,.".Y.".,.".C.".,.".U.".).).).’
string = string.replace(".", "")
string = string.replace('"', "")
bad_chars = string.split(",")
final_string = bad_chars[5]+bad_chars[25]+bad_chars[8]+bad_chars[7]+bad_chars[0]+bad_chars[14]+bad_chars[3]+bad_chars[21]+bad_chars[2]+bad_chars[22]+bad_chars[15]+bad_chars[16]+bad_chars[31]+bad_chars[28]+bad_chars[11]+bad_chars[26]+bad_chars[17]+bad_chars[23]+bad_chars[27]+bad_chars[29]+bad_chars[10]+bad_chars[1]+bad_chars[6]+bad_chars[24]+bad_chars[30]+bad_chars[18]+bad_chars[13]+bad_chars[19]+bad_chars[12]+bad_chars[9]+bad_chars[20]+bad_chars[4]
print(final_string)

Running the script produces:

┌──(kali㉿kali)-[~/Desktop/HTB/Lure]
└─$ python3 bad_chars.py
http://owly/HTB%7Bk4REfU)))l_w1Th_Y0UR_d0CuMeNT5%7D

That gives us a partial flag. URL decoding it reveals the remaining text.

Partial Lure flag before URL decoding — The reconstructed URL containing the encoded flag.

URL-decoded Lure challenge flag — URL decoding the recovered text.

It is safe to remove the extraneous ))), producing the final flag:

HTB{k4REfUl_w1Th_Y0UR_d0CuMeNT5}

Congrats! Another challenge completed. Pat yourself on the back.