LinkedinGithub

KnightCTF 2024 mem challenges

mem dump Download Link : https://drive.google.com/file/d/1-NCGNf8dBIu2LuA3Rl6BWlx2QBp0hmdW/view

Challenge 1 OS :

to view OS related informations we are going to open the memory dmp file in windbg and execute the command !analyze -s

scrolling down the results we will find the OS version

Flag :

Challenge 2 Password :

First i tried the lsadump plugin to dump plain text passowrds from the memoty but it didn't contain any passwords

then i used the plugin hashdump to extract users hashes from the SAM database

and then took the NTLMv2 hashes and crack them at crackstation website, 3 passwords were successfully cracked but one that contains text password which is the siam user password

Flag :

Challenge 3 IP Addr :

we will use the plugin netscan to view all the connections related information and in the local address we can find the system address

Flag :

Challenge 4 Note :

we will use the plugin filescan to enumerate all the system files

and we get a huge list of files

we know that the boss have left a text file so we will use grep to search for files with .txt extension

and we have 2 text files, to read their contents we will use the plugin dumpfiles

using cat command let's read its contents

and we can see a base64 encoded string let's decode it

Flag :

Challenge 5 Execution :

to see what the attacker has done on the infected machine which we have its memory dump we will dump the cmd history. we will use the plugin consoles

so the program executed is windows.bat and the flag is the output of the program executed

Flag :

Challenge 6 Path of the Executable :

the program that outputed the prevoius flag is windows.bat

Flag :

Challenge 7 Malicious :

using the filescan output generated previously we can grep for all exe files

reading through the executables we can find an executable called MadMan.exe

i searched in google for this executable and i found that its a virus

there is another method by using the autoruns plugin from this repository

LogoGitHub - tomchop/volatility-autoruns: Autoruns plugin for the Volatility frameworkGitHub

which enumerates all the registry keys where a malicious program would hide itself to persist

first we have to clone the repository

and then run it with volatility

and we can see Dangerous autorun C:\Users\ezyzip\MadMan.exe by the word Danger in front of it

Flag :

Previousmemory forensicsNextForensics

Last updated

Was this helpful?