THM - DarkMatter

A writeup for the room “DarkMatter” on TryHackMe

Practice how to exploit a weak RSA implementation to recover the private key and decrypt a ransomware-encrypted files.

DarkMatter

Analysis

The challenge involves a machine infected with a ransomware.

Once booted, a window appears informing us that the files have been encrypted and asking us to pay the ransom in exchange for the key.

Inside the room description we can see how to move the first steps.

The ransomware saves this data to the tmp directory.

Looking inside the tmp folder, we can see that the ransomware has left behind a couple of interesting files.

Inside the file public_key.txt, we can see two numbers, n and e, which are usually used in the RSA cryptosystem.