Memory Forensics Series 1

文档说明

作者:SwBack
时间:2022-5-5 11:05

Challenge description

• My sister's computer is broken.We were very lucky to recover this memory dump.Your job is to get all her important files from the system.According to our memory,We suddenly saw a black window pop up,There are some things that are being executed on it.when the crash occurred,She is trying to draw something.That's all we remember from the crash.

注意： This challenge is 3 composed of logos.

• My sister’s computer crashed. We were very fortunate to recover this memory dump. Your job is get all her important files from the system. From what we remember, we suddenly saw a black window pop up with some thing being executed. When the crash happened, she was trying to draw something. Thats all we remember from the time of crash.
  Note: This challenge is composed of 3 flags.

解题过程

flag1

Extract key information from the question

黑色窗口 疑似cmd.exe 画一些东西(Suspected drawing tool) Important files exist(Documents need to be scanned)

View memory mirroring

volatility -f MemoryDump_Lab1.raw imageinfo

查看进程 发现cmd.exe

volatility -f MemoryDump_Lab1.raw --profile=Win7SP1x64 pslist

Scan command and output 发现base64编码

volatility -f MemoryDump_Lab1.raw --profile=Win7SP1x64 cmdscan

volatility -f MemoryDump_Lab1.raw --profile=Win7SP1x64 consoles

解码base64 获得第一个flag

echo "ZmxhZ3t0aDFzXzFzX3RoM18xc3Rfc3Q0ZzMhIX0=" |base64 -d

flag2

There is a drawing tool for the processmspaint.exe

提取数据

volatility -f MemoryDump_Lab1.raw --profile=Win7SP1x64 memdump -p 2424 -D ./

使用gimp打开(第三方工具,Images can be restored)

调整宽高

flag2

flag3

进程中存在WinRAR.exe Get the decompressed filename

volatility -f MemoryDump_Lab1.raw --profile=Win7SP1x64 dlllist |grep WinRAR

Get the virtual address of the decompressed file

volatility -f MemoryDump_Lab1.raw --profile=Win7SP1x64 filescan |grep Important

提取压缩包

volatility -f MemoryDump_Lab1.raw --profile=Win7SP1x64 dumpfiles -Q 0x000000003fa3ebc0 -D ./

Get the zip password prompt

获取hash

volatility -f MemoryDump_Lab1.raw --profile=Win7SP1x64 hashdump

得到flag3