3rd Challenge Write-up
Description :
I decided to protect my passwords and keep them safe. This memory dump was taken during the migration process. Will you be able to reveal the secrets?
Challenge link :
https://www.mediafire.com/file/qn6536yaivdrbjj/FindTheSecret.rar/file
Steps :
As mentioned in the description the file is a memory dump, so we can use volatility (an advanced memory forensics framework) in order to investigate it, first of all we need to identify the operating system from where this dump was taken.
From the result it’s clear that the OS is Win7SP1x64, then the first thing that comes to mind is to dump the notepad process ( generally people save their passwords there).
As shown in the picture, we identified the notepad PID and other juicy information like the use of the KeePass as a password manager, maybe we need this info for the rest of the challenge.
Let’s dump the process :
Finally perform a strings search in the dump using “ACG” as a key, the “-e l” switch is needed because notepad stores text in 16-bit little-endian.
This is the first part it seems that there is a second part of the flag hidden somewhere.
Do you remember the KeePass process ?
The second reflex is simply search files with kdbx extensions or files named flag , and bingo we found a file flag_part2.kdbx (a keepass database to store passwords in a secure manner) protected by a master key.
Ok let’s go through more serious stuff and try to crack the password.
Now we need to extract the master password hash from the file. Thankfully, John the Ripper ships with a useful tool to do just that! The utility is called “keepass2john” and simply needs the KeePass database passed in as a parameter.
Running this utility produces the following hash :
$keepass$*2*60000*0*76cbcbb0a4e550004bbe16926c8eb1bab67b0d3df66f41d96eb94e1d3062adf4*6de4496c2b2ead78e5780d928e858d12208f8a563211c51ca76289de981b0f43*12c06b603739d1b13dcfcaa222700cc6*b5d071a020200c7651b437ea59f31e01694fb17cf47f982ccecb2b3e7fc69e4f*865de424bdf4ab058a30436c5bac1a05d92c1305f0823de6cfd3d04a7b5f2a6f
The next step is to take this hash string (first saved into a file called “keepass.txt”) and pass it through Hashcat.
Hashcat supports typical password cracking attack types, such as dictionary and brute-force, but also includes things like masking, which is filtering down the cracking attempts to certain patterns.
Here we will use the most famous dictionary rockyou.
So our hashcat command is :
hashcat -a 0 -m 13400 keepass.txt rockyou.txt
And voila we found the password “holyw00d”
Now we can see the database content :
Final flag :
ACG{n3v3r_5tor3_Pa$$w0rds_1n_pl41n__73x7_u53_k33p4$$_1n5734d!!!}
Created By Rayen MESSAOUDI
