Cyberdefenders – FakeGPT Lab writeup

Instructions:

• Uncompress the lab (pass: cyberdefenders.org)

Scenario:

Your cybersecurity team has been alerted to suspicious activity on your organization's network. Several employees reported unusual behavior in their browsers after installing what they believed to be a helpful browser extension named "ChatGPT." However, strange things started happening: accounts were being compromised, and sensitive information appeared to be leaking.

Your task is to perform a thorough analysis of this extension to identify its malicious components.

#1 Answer: base64

Which encoding method does the browser extension use to obscure target URLs, making them more difficult to detect during analysis?

Obtaining the evidence

Analyzing the file app.js, the function was identified encryptPayload, which uses the method .toString(CryptoJS.enc.Base64) to encode data in Base64 format. This method converts the data into a readable, but not secure format, which can make it difficult to detect during superficial analysis.

#2 Answer: www.facebook.com

Which website does the extension monitor for data theft, targeting user accounts to steal sensitive information?

Obtaining the evidence

In file analysis app.js, the following line of code was identified:

const targets = [_0xabc1('d3d3LmZhY2Vib29rLmNvbQ==')];

The chain 'd3d3LmZhY2Vib29rLmNvbQ==' It is Base64 encoded. Using the tool CyberChef with the recipe «From Base64», this string was decoded obtaining the value:

This result confirms that the extension is specifically designed to monitor and perform malicious actions on the domain www.facebook.com.

#3 Answer: <img>

Which type of HTML element is utilized by the extension to send stolen data?

Obtaining the evidence

In the analyzed code, the use of elements was found <img> to send stolen data via hidden GET requests. These elements load images from dynamically generated URLs that contain exfiltrated data encoded in the query string.

#4 Answer: navigator.plugins.length === 0

What is the first specific condition in the code that triggers the extension to deactivate itself?

Obtaining the evidence

File analysis app.js revealed that the extension checks if navigator.plugins.length === 0. This behavior indicates that the extension is designed to be disabled in environments where no plugins are installed, such as headless browsers or automated environments.

#5 Answer: submit 

Which event does the extension capture to track user input submitted through forms?

Obtaining the evidence

The file app.js contains a controller that listens to events submit in HTML forms. This event is intercepted to capture user-entered data before sending it to the legitimate destination server, allowing it to be exfiltrated.

#6 Answer: keydown 

Which API or method does the extension use to capture and monitor user keystrokes?

Obtaining the evidence

Identified a code fragment in which an event is logged keydown. This event is used to monitor and capture keystrokes in real time, allowing the extension to record sensitive information such as passwords or login data.

What is the domain where the extension transmits the exfiltrated data?

#7 Answer: Mo.Elshaheedy.com

Obtaining the evidence

Code analysis revealed that data exfiltration is done by sending requests to the domain Mo.Elshaheedy.com. This domain is explicitly configured in network requests made by the extension.

#8 Answer: exfiltrateCredentials(username, password);

Which function in the code is used to exfiltrate user credentials, including the username and password?


Obtaining the evidence

in the file app.js function found exfiltrateCredentials, which takes the username and password as parameters. This function sends the stolen credentials to the malicious server using a previously identified encryption and exfiltration method.

9 Answer: AES

Which encryption algorithm is applied to secure the data before sending?

Obtaining the evidence

Source code includes library usage CryptoJS to perform AES encryption. This algorithm is used to encrypt the data before encoding it in Base64 and sending it to the server.

10 Answer: cookies

What does the extension access to store or manipulate session-related data and authentication information?

Obtaining the evidence

The file manifest.json The extension explicitly requests access to cookies using the following line in the permissions block:

The cookies They are used by web browsers to store and manage information about the user's session, including authentication data. Accessing cookies gives the extension the ability to read, modify or exfiltrate such information, which could be exploited to access user accounts or manipulate sessions.

Furthermore, the file loader.js, loaded as part of the extension as defined in the manifest.json, configure the environment so that the extension's core code (core/app.js) to run dynamically. This file, when loaded, probably makes use of the requested permissions, including access to cookies, to manipulate and store data related to the user's session.

Fragment of the manifest.json related:

"background": {
  "scripts": ["system/loader.js"],
  "persistent": true
}

:wq!