ctf-malware

Name: ctf-malware
Author: ljagiello

5.6kinstalls330forks

How to install ctf-malware?

ljagiello/ctf-skills/ctf-malware

$npx -y skills add ljagiello/ctf-skills --skill ctf-malware

Installs into the current project.

Summary

Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for ma

Files · 1

View on GitHub

SKILL.md

1	# CTF Malware & Network Analysis
2
3	Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.
4
5	## Prerequisites
6
7	Python packages (all platforms):
8	```bash
9	pip install yara-python pefile capstone oletools unicorn pycryptodome \
10	volatility3 dissect.cobaltstrike
11	```
12
13	Linux (apt):
14	```bash
15	apt install strace ltrace tshark binwalk binutils
16	```
17
18	macOS (Homebrew):
19	```bash
20	brew install wireshark binwalk binutils ghidra
21	```
22
23	Manual install:
24	- dnSpy — [GitHub](https://github.com/dnSpy/dnSpy), .NET decompiler (Windows)
25
26	## Additional Resources
27
28	- [scripts-and-obfuscation.md](scripts-and-obfuscation.md) - JavaScript deobfuscation, PowerShell analysis, eval/base64 decoding, junk code detection, hex payloads, Debian package analysis, dynamic analysis techniques (strace/ltrace, network monitoring, memory string extraction, automated sandbox execution), YARA rules for malware detection, shellcode analysis (Unicorn Engine, Capstone), memory forensics for malware (Volatility 3 malfind, process injection detection), anti-analysis techniques (VM detection, timing evasion, API hashing, process injection), trojanized plugin analysis with custom alphabet C2 decoding
29	- [c2-and-protocols.md](c2-and-protocols.md) - C2 traffic patterns, custom crypto protocols, RC4 WebSocket, DNS-based C2, network indicators, PCAP analysis, AES-CBC, encryption ID, Telegram bot recovery, Poison Ivy RAT Camellia decryption
30	- [pe-and-dotnet.md](pe-and-dotnet.md) - PE analysis (peframe, pe-sieve, pestudio), .NET analysis (dnSpy, AsmResolver), LimeRAT extraction, sandbox evasion, malware config extraction, PyInstaller+PyArmor
31
32	---
33
34	## When to Pivot
35
36	- If the sample is really just a normal crackme, packed challenge binary, or custom VM with no malware behavior, switch to `/ctf-reverse`.
37	- If the main job is network reconstruction, disk carving, or host artifact recovery, switch to `/ctf-forensics`.
38	- If the challenge turns into public attribution or infrastructure tracing, switch to `/ctf-osint`.
39
40	## Quick Start Commands
41
42	```bash
43	# Static analysis
44	file suspicious_file
45	strings -n 8 suspicious_file \| head -50
46	xxd suspicious_file \| head -20
47
48	# PE analysis
49	python3 -c "import pefile; pe=pefile.PE('mal.exe'); print(pe.dump_info())" \| head
50	peframe mal.exe
51
52	# Dynamic analysis (sandboxed!)
53	strace -f -s 200 ./suspicious 2>&1 \| head -100
54	ltrace ./suspicious 2>&1 \| head -50
55
56	# Network indicators
57	strings suspicious_file \| grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
58	strings suspicious_file \| grep -iE 'http\|ftp\|ws://'
59
60	# YARA scan
61	yara -r rules.yar suspicious_file
62	```
63
64	## Obfuscated Scripts
65
66	- Replace `eval`/`bash` with `echo` to print underlying code; extract base64/hex blobs and analyze with `file`. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md).
67
68	## JavaScript & PowerShell Deobfuscation
69
70	- JS: Replace `eval` with `console.log`, decode `unescape()`, `atob()`, `String.fromCharCode()`.
71	- PowerShell: Decode `-enc` base64, replace `IEX` with output. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md).
72
73	## Junk Code Detection
74
75	- NOP sleds, push/pop pairs, dead writes, unconditional jumps to next instruction. Filter to extract real `call` targets. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md).
76
77	## PCAP & Network Analysis
78
79	```bash
80	tshark -r file.pcap -Y "tcp.stream eq X" -T fields -e tcp.payload
81	```
82
83	Look for C2 on unusual ports. Extract IPs/domains with `strings \| grep`. See [c2-and-protocols.md](c2-and-protocols.md).
84
85	## Custom Crypto Protocols
86
87	- Stream ciphers share keystream state for both directions; concatenate ALL payloads chronologically.
88	- ChaCha20 keystream extraction: send nullbytes (0 XOR anything = anything). See [c2-and-protocols.md](c2-and-protocols.md).
89
90	## C2 Traffic Patterns
91
92	- Beaconing, DGA, DNS tunneling, HTTP(S) with custom headers, encoded payloads. See [c2-and-protocols.md](c2-and-protocols.md).
93
94	## RC4-Encrypted WebSocket C2
95
96	- Remap port with `tcprewrite`, add RSA key for TLS decryption, find RC4 key in binary. See [c2-and-protocols.md](c2-and-protocols.md).
97
98	## Identifying Encryption Algorithms
99
100	- AES: `0

People who liked this also viewed

6 picks

Type

ctf-malware

5.6kinstalls330forks

View on GitHub

How to install ctf-malware?

ljagiello/ctf-skills/ctf-malware

$npx -y skills add ljagiello/ctf-skills --skill ctf-malware

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# CTF Malware & Network Analysis
2
3	Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.
4
5	## Prerequisites
6
7	Python packages (all platforms):
8	```bash
9	pip install yara-python pefile capstone oletools unicorn pycryptodome \
10	volatility3 dissect.cobaltstrike
11	```
12
13	Linux (apt):
14	```bash
15	apt install strace ltrace tshark binwalk binutils
16	```
17
18	macOS (Homebrew):
19	```bash
20	brew install wireshark binwalk binutils ghidra
21	```
22
23	Manual install:
24	- dnSpy — [GitHub](https://github.com/dnSpy/dnSpy), .NET decompiler (Windows)
25
26	## Additional Resources
27
28	- [scripts-and-obfuscation.md](scripts-and-obfuscation.md) - JavaScript deobfuscation, PowerShell analysis, eval/base64 decoding, junk code detection, hex payloads, Debian package analysis, dynamic analysis techniques (strace/ltrace, network monitoring, memory string extraction, automated sandbox execution), YARA rules for malware detection, shellcode analysis (Unicorn Engine, Capstone), memory forensics for malware (Volatility 3 malfind, process injection detection), anti-analysis techniques (VM detection, timing evasion, API hashing, process injection), trojanized plugin analysis with custom alphabet C2 decoding
29	- [c2-and-protocols.md](c2-and-protocols.md) - C2 traffic patterns, custom crypto protocols, RC4 WebSocket, DNS-based C2, network indicators, PCAP analysis, AES-CBC, encryption ID, Telegram bot recovery, Poison Ivy RAT Camellia decryption
30	- [pe-and-dotnet.md](pe-and-dotnet.md) - PE analysis (peframe, pe-sieve, pestudio), .NET analysis (dnSpy, AsmResolver), LimeRAT extraction, sandbox evasion, malware config extraction, PyInstaller+PyArmor
31
32	---
33
34	## When to Pivot
35
36	- If the sample is really just a normal crackme, packed challenge binary, or custom VM with no malware behavior, switch to `/ctf-reverse`.
37	- If the main job is network reconstruction, disk carving, or host artifact recovery, switch to `/ctf-forensics`.
38	- If the challenge turns into public attribution or infrastructure tracing, switch to `/ctf-osint`.
39
40	## Quick Start Commands
41
42	```bash
43	# Static analysis
44	file suspicious_file
45	strings -n 8 suspicious_file \| head -50
46	xxd suspicious_file \| head -20
47
48	# PE analysis
49	python3 -c "import pefile; pe=pefile.PE('mal.exe'); print(pe.dump_info())" \| head
50	peframe mal.exe
51
52	# Dynamic analysis (sandboxed!)
53	strace -f -s 200 ./suspicious 2>&1 \| head -100
54	ltrace ./suspicious 2>&1 \| head -50
55
56	# Network indicators
57	strings suspicious_file \| grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
58	strings suspicious_file \| grep -iE 'http\|ftp\|ws://'
59
60	# YARA scan
61	yara -r rules.yar suspicious_file
62	```
63
64	## Obfuscated Scripts
65
66	- Replace `eval`/`bash` with `echo` to print underlying code; extract base64/hex blobs and analyze with `file`. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md).
67
68	## JavaScript & PowerShell Deobfuscation
69
70	- JS: Replace `eval` with `console.log`, decode `unescape()`, `atob()`, `String.fromCharCode()`.
71	- PowerShell: Decode `-enc` base64, replace `IEX` with output. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md).
72
73	## Junk Code Detection
74
75	- NOP sleds, push/pop pairs, dead writes, unconditional jumps to next instruction. Filter to extract real `call` targets. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md).
76
77	## PCAP & Network Analysis
78
79	```bash
80	tshark -r file.pcap -Y "tcp.stream eq X" -T fields -e tcp.payload
81	```
82
83	Look for C2 on unusual ports. Extract IPs/domains with `strings \| grep`. See [c2-and-protocols.md](c2-and-protocols.md).
84
85	## Custom Crypto Protocols
86
87	- Stream ciphers share keystream state for both directions; concatenate ALL payloads chronologically.
88	- ChaCha20 keystream extraction: send nullbytes (0 XOR anything = anything). See [c2-and-protocols.md](c2-and-protocols.md).
89
90	## C2 Traffic Patterns
91
92	- Beaconing, DGA, DNS tunneling, HTTP(S) with custom headers, encoded payloads. See [c2-and-protocols.md](c2-and-protocols.md).
93
94	## RC4-Encrypted WebSocket C2
95
96	- Remap port with `tcprewrite`, add RSA key for TLS decryption, find RC4 key in binary. See [c2-and-protocols.md](c2-and-protocols.md).
97
98	## Identifying Encryption Algorithms
99
100	- AES: `0

People who liked this also viewed

6 picks

Type