---
description: Powershell script deobfuscation
---

# Fur Elise

## Description

Beethoven was really pretty lol (read the section Beethoven Fur Elise: Fun facts): [https://www.chosic.com/why-is-beethoven-fur-elise-so-popular-and-who-was-elise/](https://www.chosic.com/why-is-beethoven-fur-elise-so-popular-and-who-was-elise/)

Attachment: `heartbroken`



## Solution

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FpPs5V9Ipyfm4VQXns4sa%2Fimage.png?alt=media&#x26;token=972c7400-321e-4619-b4e9-1a36fdb72183" alt=""><figcaption></figcaption></figure>

The file is given without any extension. I use `file` command to identify the file type. However, there is nothing useful about the file type. Therefore, I open the file in a text editor to see the contents of the file.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FKpvUHr4owfymi3IkpGps%2Fimage.png?alt=media&#x26;token=6d74025c-59cf-455b-8ee7-68758bac2252" alt=""><figcaption></figcaption></figure>

Upon opening the file, there are large chunks of  repetitive words with some variables being set in the first few lines which immediately catched my attention. You will notice that it is a link as it contains "https://..." if you look closely.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FcCu3rXSUUhI6XMxpUQZI%2Fimage.png?alt=media&#x26;token=30123d3f-d84c-4f59-b56d-ae811f50218f" alt=""><figcaption></figcaption></figure>

By using [CyberChef](https://gchq.github.io/CyberChef/), we can remove the repetitive symbol "&" to see the link clearly. The output shows a pastebin link which gives us half of the flag `ABOH23{d!ff1cU17_s0Ng`.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FcUBT4k7AMj6nTpqt0krt%2Fimage.png?alt=media&#x26;token=d221c7cb-c7aa-4a34-945d-efe9a9cc3ef1" alt=""><figcaption></figcaption></figure>

Scrolling through the `heartbroken` file again will see another suspicious link, which is a github gist link.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FPk63KKFOibxYaIkijCh6%2Fimage.png?alt=media&#x26;token=d5fbcf7a-904c-48b1-8f4c-1e4974bea65e" alt=""><figcaption></figcaption></figure>

The encoded string was run using Powershell, so we can suspect that this is a Powershell script. However, it is encoded, so let's put it back to CyberChef to decode again.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FWg8HqKkDSjhDSxgFnZui%2Fimage.png?alt=media&#x26;token=2ad5a411-171a-45f7-bbfd-b217f4bad107" alt=""><figcaption></figcaption></figure>

The string is encoded by base64. Therefore, using `From Base64` we can decode the string. After that, we can decode UTF-16LE from the string as the default encoding for Powershell is UTF-16LE ([source](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_character_encoding?view=powershell-7.4)).

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2F2vQ84QjZYdGEzZWJ9bpa%2Fimage.png?alt=media&#x26;token=9b7b5bba-84df-4485-bb90-4d566a434063" alt=""><figcaption></figcaption></figure>

After decoding, we can see some strings that are suspectable. However, it seems like the string from the first box is just a string and is taking the characters and joining them together. We can see that there is a `$c2` variable. This normally stores the details of the C2 server and we can try analyzing this to see if there is any juicy info. I used ChatGPT to convert them back to ASCII and I believe there are much better ways to do this. Once decoded, we will get another pastebin link which contains another half of the flag.



## Flag

`ABOH23{d!ff1cU17_s0Ng_FROm_hEaRtBrE4K}`
