{"id":2413,"date":"2018-04-01T15:22:45","date_gmt":"2018-04-01T13:22:45","guid":{"rendered":"https:\/\/www.asafety.fr\/?p=2413"},"modified":"2018-04-01T15:40:37","modified_gmt":"2018-04-01T13:40:37","slug":"ctf-ndh-2018-quals-write-up-forensic-where-is-my-purse","status":"publish","type":"post","link":"https:\/\/www.asafety.fr\/en\/events\/ctf-ndh-2018-quals-write-up-forensic-where-is-my-purse\/","title":{"rendered":"[CTF NDH 2018 Quals] Write-Up \u2013 Forensic : Where Is My Purse ?"},"content":{"rendered":"<p><\/p>\n<p style=\"text-align: center;\"><strong>Write-up of the challenge \u201cForensic \u2013 Where Is My Purse?\u201d of Nuit du\u00a0Hack 2018 CTF qualifications.<\/strong><\/p>\n<p>The weekend of 03\/31\/2018 is pre-qualification for the <strong><a href=\"https:\/\/nuitduhack.com\/fr\/\" target=\"_blank\" rel=\"noopener\">Nuit du Hack 2018<\/a><\/strong>\u00a0as a <strong>Jeopardy CTF<\/strong>. Having had the opportunity and the time to participate with some colleagues and friends, here\u2019s a write-up resolution of the challenges which we could participate.<\/p>\n<ul>\n<li>Category: <strong>Forensic<\/strong><\/li>\n<li>Name: <strong>Where Is My Purse?<\/strong><\/li>\n<li>Description : <em>Helps an important person to find the content of his numeric purse.<\/em><\/li>\n<li>File : <strong>whereismypurse.7z<\/strong>\u00a0(2.74GB &#8211; 83cf33c0cb86457c929237a1b1d8763fad1a28734b987c0f69b9d9f6b66e85db)<\/li>\n<li>Points : <strong>200<\/strong><\/li>\n<\/ul>\n<p>The challenge\u2019s goal is to access to a wallet content from a virtual machine and a memory dump provided in fournis dans l\u2019archive 7z.<\/p>\n<p>To run VM, we create a new machine in VirtualBox and we attache the disk file <strong>whereismypurse.vdi<\/strong> to it. Once run, we see a Windows 7 system protected with a password\u00a0:<\/p>\n<div id=\"attachment_2414\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w01.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2414\" class=\"size-medium wp-image-2414\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w01-300x249.png\" alt=\"Win7 authentication\" width=\"300\" height=\"249\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w01-300x249.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/w01-768x638.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/w01.png 799w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2414\" class=\"wp-caption-text\">Win7 authentication<\/p><\/div>\n<p>One possible option is to use a tool such as <a href=\"http:\/\/piotrbania.com\/all\/kon-boot\/\" target=\"_blank\" rel=\"noopener\">konboot<\/a>\u00a0to bypass Windows authentication. A loading of the tool\u2019s ISO at system startup allows us to log in as user SatNak without password.<\/p>\n<p>On the desktop, we can see an executable named <strong>dcrinstall-windows-amd64-v1.1.2.exe<\/strong>. A quick search on the web tells us it is a tool related to the crypto currency \u00ab\u00a0<strong>Decred<\/strong>\u00a0\u00bb. The executable deploy the tool in the directroy <strong>%USERPROFILE%\\decred\\<\/strong>\u00a0:<\/p>\n<p>&nbsp;<\/p>\n<div id=\"attachment_2415\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w02.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2415\" class=\"size-medium wp-image-2415\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w02-300x249.png\" alt=\"Binary in USERPROFILE\" width=\"300\" height=\"249\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w02-300x249.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/w02-768x638.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/w02.png 799w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2415\" class=\"wp-caption-text\">Binary in USERPROFILE<\/p><\/div>\n<p>The tool\u2019s binaries are likely to provide access to the wallet mentioned in the description of the challenge. After playing a little with these executables, we note that a secret is necessary to continue the challenge.<\/p>\n<p>It is assumed that this secret can be retrieved from the memory dump provided in the 7z archive. Let&#8217;s use Volatility to analyze this one:<\/p>\n<div id=\"attachment_2416\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w03.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2416\" class=\"size-medium wp-image-2416\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w03-300x114.png\" alt=\"Volatility identification\" width=\"300\" height=\"114\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w03-300x114.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/w03-768x293.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/w03.png 976w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2416\" class=\"wp-caption-text\">Volatility identification<\/p><\/div>\n<p>The list of running programs or commands tells us that a <strong>KeePass<\/strong> vault is launched:<\/p>\n<div id=\"attachment_2417\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w04.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2417\" class=\"size-medium wp-image-2417\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w04-300x86.png\" alt=\"Keepass detection\" width=\"300\" height=\"86\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w04-300x86.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/w04-768x220.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/w04-680x196.png 680w, https:\/\/www.asafety.fr\/wp-content\/uploads\/w04.png 962w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2417\" class=\"wp-caption-text\">Keepass detection<\/p><\/div>\n<p>This process can be extracted using the following command:<\/p>\n<pre>$ volatility -f whereismypurse.raw --profile=Win7SP1x64 --dump-dir=dump memdump -p 2212<\/pre>\n<p>A simple search for strings in the contents of this dump allows us to find the password contained in the <strong>Keepass<\/strong> vault:<\/p>\n<div id=\"attachment_2418\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w05.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2418\" class=\"size-medium wp-image-2418\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w05-300x131.png\" alt=\"Keepass password\" width=\"300\" height=\"131\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w05-300x131.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/w05-768x335.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/w05.png 962w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2418\" class=\"wp-caption-text\">Keepass password<\/p><\/div>\n<p>Back in the VM, we run the executables <strong>dcrd.exe<\/strong> and <strong>drcwallet.exe<\/strong> and enter the password found previously when prompted:<\/p>\n<div id=\"attachment_2419\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w06.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2419\" class=\"size-medium wp-image-2419\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w06-300x148.png\" alt=\"Run binaries wallet\" width=\"300\" height=\"148\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w06-300x148.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/w06.png 705w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2419\" class=\"wp-caption-text\">Run binaries wallet<\/p><\/div>\n<p>Once the password is validated, <strong>dcrctl.exe<\/strong> allows us to access the content of the Wallet and find the flag:<\/p>\n<div id=\"attachment_2420\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w07.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2420\" class=\"size-medium wp-image-2420\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w07-300x136.png\" alt=\"Flag in wallet\" width=\"300\" height=\"136\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/w07-300x136.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/w07.png 670w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2420\" class=\"wp-caption-text\">Flag in wallet<\/p><\/div>\n<p>Thanks to Timoth\u00e9e MENOCHET for the write-up ! \ud83d\ude42<\/p>\n<p>Greeting to the whole team ! :)<\/p>","protected":false},"excerpt":{"rendered":"<p>Write-up of the challenge \u201cForensic \u2013 Where Is My Purse?\u201d of Nuit du\u00a0Hack 2018 CTF qualifications. The weekend of 03\/31\/2018 [&hellip;]<\/p>\n","protected":false},"author":1337,"featured_media":1963,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[524,523,532,526,531],"tags":[],"class_list":["post-2413","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf","category-events","category-forensic","category-ndh","category-ndh2k18"],"_links":{"self":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts\/2413","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/users\/1337"}],"replies":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/comments?post=2413"}],"version-history":[{"count":2,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts\/2413\/revisions"}],"predecessor-version":[{"id":2424,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts\/2413\/revisions\/2424"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/media\/1963"}],"wp:attachment":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/media?parent=2413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/categories?post=2413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/tags?post=2413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}