#!/bin/bash
# Rogue Commit — DFIR reproducer (THM Token City, Task 2)
#
# Suspicious Electron app (app.asar) encrypts %USERPROFILE%\Documents\*
# with AES-CBC. Key is fetched at runtime via DNS TXT of
# free-ai-assistant.xyz. IV is hardcoded in main.js.
#
# Pcap shows the TXT answer; with key + IV we decrypt the .bin set.
# Flag is embedded as PDF /Author metadata in ai_research_division.bin.

set -u
ROOT="$(cd "$(dirname "$0")" && pwd)"
ART="$ROOT/attachments-1777315926968-1778253980958"
PCAP="$ART/traffic.pcapng"
BIN="$ART/users_artifacts/developer/Documents"
ASAR="$ART/users_artifacts/developer/Downloads/app.asar"
OUT="$ROOT/decrypted"
mkdir -p "$OUT" "$ROOT/asar-extracted"

hr() { printf '\n=== %s ===\n' "$*"; }

hr "1) Extract app.asar (Electron archive)"
python3 - <<PY
import struct, json, os
src="$ASAR"
dst="$ROOT/asar-extracted"
data=open(src,'rb').read()
js_size=struct.unpack('<I', data[12:16])[0]
hdr=json.loads(data[16:16+js_size].decode())
payload=16 + ((js_size + 3) & ~3)
for name,info in hdr['files'].items():
    off=int(info['offset']); sz=info['size']
    open(f'{dst}/{name}','wb').write(data[payload+off:payload+off+sz])
    print(f'  extracted {name} ({sz} B)')
PY

hr "2) main.js — IV + DNS-key lookup domain"
grep -nE 'IV|FLAG_DOMAIN|aes-|createCipheriv|resolveTxt' "$ROOT/asar-extracted/main.js"

hr "3) Recover AES key from pcap (DNS TXT for free-ai-assistant.xyz)"
KEY_HEX=$(tshark -r "$PCAP" \
  -Y 'dns.qry.name contains "free-ai-assistant" and dns.flags.response==1' \
  -T fields -e dns.txt | tr -d '[:space:]')
echo "  key (hex from TXT): $KEY_HEX  (${#KEY_HEX} hex chars = $((${#KEY_HEX}/2)) bytes)"
IV_HEX='4b7a9c2e1f8d3a6b4b7a9c2e1f8d3a6b'
echo "  iv  (hardcoded)   : $IV_HEX"

hr "3b) Same lookup via dig (live; will only resolve if domain is up)"
echo "    $ dig +short TXT free-ai-assistant.xyz"
echo "    $ nslookup -type=TXT free-ai-assistant.xyz"

hr "4) Decrypt every .bin (AES-128-CBC: TXT delivers 16-byte key)"
for f in "$BIN"/*.bin; do
  base=$(basename "$f" .bin)
  openssl enc -d -aes-128-cbc -K "$KEY_HEX" -iv "$IV_HEX" \
    -in "$f" -out "$OUT/$base"
  echo "  $base : $(file -b "$OUT/$base")"
done

hr "5) Hunt for flag across decrypted files (incl. PDF metadata)"
grep -aoE 'THM\{[^}]+\}' "$OUT"/* 2>/dev/null || true
pdftotext "$OUT/ai_research_division" - 2>/dev/null | grep -oE 'THM\{[^}]+\}' || true