Official emo Discussion

It took me 3 days to get the flag. xD
Thank you @0xdf, learned a lot!

1 Like

This was harder than most boxes!

When you find what the evil document is doing, you can pare that down to something that is ALMOST readable, but definately works when you run it.

Inspect all of the things, and donā€™t skip any of them. Assume everything is important.

I just finished doing this challenge but without any static analysis, is there any official writeup regarding this challenge? Appreciate if any of you guys that done through static to share writeup. Thanks!

Same as many here, I got a bunch of urls and some decimal list with PS yet I donā€™t get whatā€™s nextā€¦

dm for any nudges

Finally got it after a couple of days! First time doing malware analysis, so it was quite a learning experience for me :smiley: Thanks for a cool challenge.

Really entertaining challenge! Thanks a lot @0xdf! Finally got the flag but doing dynamic analysis. Iā€™d love to know how to solve it doing static analysis only.
DM me if you need a hint.

Hi, I think Iā€™ve reached the last phase, but I canā€™t decode the output. I donā€™t want to spoil anything so I cannot go any deeper. However some hint about that stage?

Solved. Best advice: donā€™t overthink this one (Thatā€™s what I did). You can go pretty far down the rabbit hole. Just remember, itā€™s an EASY challenge.

Hi @R3v4ng3l I am working on this EMO challenge and not able to solve it. Any hint?

Hey nice seeing ya in my scripts @0xdf :smiley:
Great challenge, thanks a lot!!
Iā€™m surprised that I actually enjoyed browsing vba / powershell!
My static approach was soooo clunky, I couldnā€™t help but find out what that next line was doing ^^ā€™

1 Like

Hello, Iā€™m stuck on this challenge. Like others have said I have got a bunch of non working urls. What else am I missing. Would appreciate a nudge.

Right. I got to the point where I can read the ps, yet no flags. What th. Spent much more time on this, than it deserves, can anyone give me a nudge?

Why canā€™t I decode this long base64 powershell command??? i really need to get some training on decoding.

Do I really have to deobv all the marcos found?

Man, this challenge blew me away. Learned so much (and also banged my head against the wall for about 3 days straight :rofl:).

@antmar904 : No, you were on the right track with the base64

@Thms84 : If you can read the PS, filter out the junk, see what the PS actually does. One thing that helped me : open the console and reproduce it

PS : If someone is willing to discuss this, DM

I have the decoded ps script but iā€™m having issues with it. let me go through it again!

Itā€™s heavily obfuscated which is the issue but Itā€™s a learning curve.

Yes exactly. Look at the PS closely, if itā€™s too obfuscated, find something that can peel off some layers for you, or do it manually.

Yeup, I am getting close. The last for loop is crazy obfuscated.

Iā€™m soooo confused. I still havenā€™t figured out the VBA macro stuff - so far iā€™ve just been trying to convert it to VBS so i can run it (since I donā€™t have Office to run the VBA - and iā€™d rather not buy office).

Iā€™m stuck at an error; It canā€™t create a w*nmg*t object. Iā€™m so lost nowā€¦