MAL: Strings

    • What is the name of the account that had the passcode of "12345678" in the intellian example discussed above?

    A quick search on google to find the CVE related to this : CVE-2020-8000 :


    Answer : intellian

    • What is the CVE entry disclosed by the company "Teradata" in their "Viewpoint" Application that has a password within a string?

    Per NIST, the CVE related is :


    Answer : CVE-2019-6499

    • According to OWASP's list of "Top Ten IoT" vulnerabilities, name the ranking this vulnerability would fall within, represented as text.

    Checking OWASP top 10 from 2018 :


    Answer : one

    • What is the correct username required by the "LoginForm"?

    If you don't have strings.exe or strings64.exe on windows, download it from sysinternal tools :

    strings64.exe LoginForm.exe > result_string.txt

    result_string.txt
    [...]
    bad allocation
    85@
    Unknown exception
    bad array new length
    bad cast
    cmnatic
    TryHackMeMerchWhen
    THM{Not_So_Hidden_Flag}
    Welcome to the login portal!
    Enter your Username:
    Input your password:
    Access Granted!
    Wrong username or password!
    pause
    string too long
    h5@
    [...]

    Answer : cmnatic

    • What is the required password to authenticate with?

    Answer : TryHackMeMerchWhen

    • What is the "hidden" THM{} flag?

    Answer : THM{Not_So_Hidden_Flag}

    • What is the key term to describe a server that Botnets recieve instructions from?

    Read the text.

    Answer : Command and Control

    • Name the discussed example malware that uses "strings" to store the bitcoin wallet addresses for payment

     Answer : Wannacry

    • List the number of total transactions that the Bitcoin wallet used by the "Wannacry" author(s)

    By the link given in the text :


    Answer : 143

    • What is the Bitcoin Address stored within "ComplexCalculator.exe"

    Using stings.exe on ComplexCalculatorv2.exe :


    Answer : 1LVB65imeojrgC3JPZGBwWhK1BdVZ2vYNC

    TASK 5 : Summary 
    • What is the name of the toolset provided by Microsoft that allows you to extract the "strings" of an application?

    Answer : sysinternals

    • What operator would you use to "pipe" or store the output of the strings command?

    Answer : >

    • What is the name of the currency that ransomware often uses for payment?

    Answer : bitcoin