Metoubas v1

بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ

Challenge Overview

The challenge is about a RaaS (Ransomware as a Service) product made by صديق البرنامج Ragab Ganbar, authored by 0xreizouko (烈火).

Extracting the challenge archive with the standard malware sample password infected yields three files:

Metoubas.exe
Metoubas.dll
flag.metoubas

1. Basic Static Analysis

Starting with basic static analysis using Detect It Easy (DIE) to inspect the packaging and compiler toolchain:

The .exe file is a native .NET bootstrapper (standard for .NET 5+), while the actual managed bytecode lives inside Metoubas.dll.

2. Dynamic Behavioral Analysis

Running the executable triggers a warning dialog added for players monitoring sample behavior:

Running the sample in a controlled directory with Process Monitor (ProcMon) attached:

Filtering and highlighting the process image activity shows the executable reading files in the working directory, writing out .metoubas encrypted versions, and subsequently deleting the original source files (Delete: True):

3. Advanced Static Analysis (.NET Decompilation)

Opening Metoubas.dll in dnSpy (or ILSpy / dotPeek):

Navigating to the entry point reveals the execution flow:

1. Retrieves the current directory and instantiates a FileProcessor object.
2. Iterates over all files in the directory, skipping the binary itself and any previously encrypted targets.

Inspecting FileProcessor

1. Reads the target file content into memory.
2. Buffers the data (chunk size 256 bytes due to encryption constraints).
3. Executes the cryptographic transformation via the Encryptor class.
4. Prepends the custom 4-byte magic signature M0T0 + 2 bytes padding followed by the ciphertext.
5. Writes the ciphertext to <filename>.metoubas and deletes the original file.

Cryptographic Analysis: Low-Exponent RSA

Inspecting the Encryptor routine:

The encryption utilizes System.Numerics.BigInteger.ModPow:

public static BigInteger ModPow(BigInteger value, BigInteger exponent, BigInteger modulus);

The algorithm reverses the byte arrays for endianness correction and performs modular exponentiation:

$$c \equiv m^e \pmod n$$

From the parameters:

• Public Exponent ($e$): 3
• Modulus ($n$): 2048-bit BigInteger

Because the public exponent $e = 3$ is extremely small and the plaintext message $m$ satisfies $m^3 < n$, the modulus wrap-around never occurs ($c = m^3$). This makes the encryption vulnerable to a direct Cube Root Attack (low public exponent attack).

4. Exploitation & Decryption

To decrypt flag.metoubas:

1. Strip the header magic bytes (M0T0) and padding from the encrypted file using a hex editor (010 Editor / HxD):

1. Run RsaCtfTool with the extracted modulus $n$ and public key $e = 3$:

rsactftool -n <modulus> -e 3 --decryptfile flag.metoubas --attack cube_root

The decrypted plaintext reveals the flag.

📚 References & Further Reading

• Reversing Crypto Functions — GoggleHeadedHacker
• How To Identify Unknown Crypto Functions — OALabs
• Recognizing Common Cryptographic Algorithms - Encryption (PDF)
• Maharahtech — Symmetric vs. Asymmetric Encryption
• Maharahtech — Recognizing Encrypted Data & Entropy
• Maharahtech — Decompiling & Debugging .NET Binaries