STDiO 2023 Capture The Flag: 25 - Check Mem
1st flag can be found in somewhere that every-windows have it.
File Challenge : https://drive.google.com/file/d/1jb9Cwgqo5nbki90SlIGgOtHCCo07cIpJ/view?usp=sharing
MD5 Checksum : ce6d372454020c34dfe3462063c0d09e
เมื่อพบคำตอบ จะบอกว่า flag เป็นค่าอะไร นำมาตอบด้วย Format ว่า STDIO23_25{flag} ตัวอย่างเช่น ถ้าเจอว่า flag คือ ce6d372454020c34dfe3462063c0d09e ตอบว่า STDIO23_25{ce6d372454020c34dfe3462063c0d09e}
author: Mirthz
เมื่อดาวน์โหลดไฟล์มาแล้วก็แตกไฟล์ออกมา
unrar x -kb STDiO_memdump.rar
จะได้ไฟล์ STDiO_memdump ซึ่งเป็น memmory dump ซึ่ง tools ที่จะใช้ scan หาก็คือ volatility3 https://github.com/volatilityfoundation/volatility3
$ ./vol.py --help
Volatility 3 Framework 2.5.2
usage: volatility [-h] [-c CONFIG] [--parallelism [{processes,threads,off}]] [-e EXTEND] [-p PLUGIN_DIRS] [-s SYMBOL_DIRS] [-v] [-l LOG] [-o OUTPUT_DIR] [-q] [-r RENDERER] [-f FILE] [--write-config]
[--save-config SAVE_CONFIG] [--clear-cache] [--cache-path CACHE_PATH] [--offline] [--single-location SINGLE_LOCATION] [--stackers [STACKERS ...]]
[--single-swap-locations [SINGLE_SWAP_LOCATIONS ...]]
plugin ...
An open-source memory forensics framework
options:
-h, --help Show this help message and exit, for specific plugin options use 'volatility <pluginname> --help'
-c CONFIG, --config CONFIG
Load the configuration from a json file
--parallelism [{processes,threads,off}]
Enables parallelism (defaults to off if no argument given)
-e EXTEND, --extend EXTEND
Extend the configuration with a new (or changed) setting
-p PLUGIN_DIRS, --plugin-dirs PLUGIN_DIRS
Semi-colon separated list of paths to find plugins
-s SYMBOL_DIRS, --symbol-dirs SYMBOL_DIRS
Semi-colon separated list of paths to find symbols
-v, --verbosity Increase output verbosity
-l LOG, --log LOG Log output to a file as well as the console
-o OUTPUT_DIR, --output-dir OUTPUT_DIR
Directory in which to output any generated files
-q, --quiet Remove progress feedback
-r RENDERER, --renderer RENDERER
...
Plugins:
For plugin specific options, run 'volatility <plugin> --help'
plugin
banners.Banners Attempts to identify potential linux banners in an image
configwriter.ConfigWriter
Runs the automagics and both prints and outputs configuration in the output directory.
frameworkinfo.FrameworkInfo
Plugin to list the various modular components of Volatility
isfinfo.IsfInfo Determines information about the currently available ISF files, or a specific one
layerwriter.LayerWriter
Runs the automagics and writes out the primary layer produced by the stacker.
linux.bash.Bash Recovers bash command history from memory.
linux.capabilities.Capabilities
Lists process capabilities
linux.check_afinfo.Check_afinfo
Verifies the operation function pointers of network protocols.
linux.check_creds.Check_creds
Checks if any processes are sharing credential structures
linux.check_idt.Check_idt
Checks if the IDT has been altered
linux.check_modules.Check_modules
Compares module list to sysfs info, if available
linux.check_syscall.Check_syscall
Check system call table for hooks.
linux.elfs.Elfs Lists all memory mapped ELF files for all processes.
linux.envars.Envars
linux.envvars.Envvars
Lists processes with their environment variables
...
เริ่มเลย “1st flag can be found in somewhere that every-windows have it.” โจทย์บอกมา ก็รู้เลยว่าเป็น Windows memory dump เราก็สนใจเฉพาะ Plugin ของ Windows ก็พอ เพราะ volatility3 มัน scan ได้หมด Linux,Mac,Windows :)
จากคำใบ้มันน่าจะเป็น windows.envars.Envars plugin เพราะ Environment Variable มันต้องมีทุกที่อยู่แล้ว
$ ./vol.py -f ~/Downloads/stdio-ctf-2023/25/STDiO_memdump windows.envars.Envars
...
4944 RuntimeBroker. 0x20d67603430 CommonProgramFiles(x86) C:\Program Files (x86)\Common Files
4944 RuntimeBroker. 0x20d67603430 CommonProgramW6432 C:\Program Files\Common Files
4944 RuntimeBroker. 0x20d67603430 COMPUTERNAME DESKTOP-QPU6OJ5
4944 RuntimeBroker. 0x20d67603430 ComSpec C:\Windows\system32\cmd.exe
4944 RuntimeBroker. 0x20d67603430 DriverData C:\Windows\System32\Drivers\DriverData
4944 RuntimeBroker. 0x20d67603430 F.1.a.G is d616ad7365a1b99bc7257091356d9514
4944 RuntimeBroker. 0x20d67603430 HOMEDRIVE C:
4944 RuntimeBroker. 0x20d67603430 HOMEPATH \Users\Mirth
4944 RuntimeBroker. 0x20d67603430 LOCALAPPDATA C:\Users\Mirth\AppData\Local
...
เจอแล้ว ทำการปรับให้ตรงตามรูปแบบของ flag
STDIO23_25{d616ad7365a1b99bc7257091356d9514}