Tianji's Blog.

内存取证分析

Word count: 4,720 / Reading time: 28 min
2018/12/16 Share

Otter-CTF 内存取证分析

下载地址：https://mega.nz/#!sh8wmCIL!b4tpech4wzc3QQ6YgQ2uZnOmctRZ2duQxDqxbkWYipQ

mega这个平台看起来也不错。

prepare

  • 查看内存镜像的信息
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem imageinfo
Volatility Foundation Volatility Framework 2.5
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : Win7SP0x64, Win7SP1x64, Win2008R2SP0x64, Win2008R2SP1x64
                     AS Layer1 : AMD64PagedMemory (Kernel AS)
                     AS Layer2 : FileAddressSpace (/mnt/c/Users/HT/Desktop/OtterCTF/OtterCTF.vmem)
                      PAE type : No PAE
                           DTB : 0x187000L
                          KDBG : 0xf80002c430a0L
          Number of Processors : 2
     Image Type (Service Pack) : 1
                KPCR for CPU 0 : 0xfffff80002c44d00L
                KPCR for CPU 1 : 0xfffff880009ef000L
             KUSER_SHARED_DATA : 0xfffff78000000000L
           Image date and time : 2018-08-04 19:34:22 UTC+0000
     Image local date and time : 2018-08-04 22:34:22 +0300
  • 安装mimkatz

介绍： 可以直接从 lsass中获取当前处于Active系统的登录密码， lsass是微软Windows系统的安全机制它主要用于本地安全和登陆策略，通常我们在登陆系统时输入密码之后，密码便会储存在 lsass内存中，经过其 wdigest 和 tspkg 两个模块调用后，对其使用可逆的算法进行加密并存储在内存之中， 而mimikatz正是通过对lsass的逆算获取到明文密码！也就是说只要你不重启电脑，就可以通过他获取到登陆密码，只限当前登陆系统！

首先下载mimkatz.py，然后复制到volatility的插件所在目录。

1
2
$ git clone https://github.com/sans-dfir/sift-files.git
$ sudo cp ./sift-files/volatility/mimikatz.py /usr/lib/python2.7/dist-packages/volatility/plugins/registry/

运行之后提示，construct不存在，安装即可。

1
2
3
4
5
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 mimikatz
Volatility Foundation Volatility Framework 2.5
*** Failed to import volatility.plugins.registry.mimikatz (ImportError: No module named construct)
ERROR   : volatility.debug    : You must specify something to do (try -h)
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ sudo pip install construct==2.5.5-reupload

What’s the password

question:

1
you got a sample of rick's PC's memory. can you get his user password?
1
2
3
4
5
6
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 mimikatz
Volatility Foundation Volatility Framework 2.5
Module   User             Domain           Password
-------- ---------------- ---------------- ----------------------------------------
wdigest  Rick             WIN-LO6FAF3DTFE  MortyIsReallyAnOtter
wdigest  WIN-LO6FAF3DTFE$ WORKGROUP

General Info

question:

1
Let's start easy - whats the PC's name and IP address?

pc的名字: WIN-LO6FAF3DTFE

法1: 上一题中，获取密码的时候得到一个pc的名字。

法2：查看注册表

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 hivelist
Volatility Foundation Volatility Framework 2.5
Virtual            Physical           Name
------------------ ------------------ ----
0xfffff8a00377d2d0 0x00000000624162d0 \??\C:\System Volume Information\Syscache.hve
0xfffff8a00000f010 0x000000002d4c1010 [no name]
0xfffff8a000024010 0x000000002d50c010 \REGISTRY\MACHINE\SYSTEM
0xfffff8a000053320 0x000000002d5bb320 \REGISTRY\MACHINE\HARDWARE
0xfffff8a000109410 0x0000000029cb4410 \SystemRoot\System32\Config\SECURITY
0xfffff8a00033d410 0x000000002a958410 \Device\HarddiskVolume1\Boot\BCD
0xfffff8a0005d5010 0x000000002a983010 \SystemRoot\System32\Config\SOFTWARE
0xfffff8a001495010 0x0000000024912010 \SystemRoot\System32\Config\DEFAULT
0xfffff8a0016d4010 0x00000000214e1010 \SystemRoot\System32\Config\SAM
0xfffff8a00175b010 0x00000000211eb010 \??\C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
0xfffff8a00176e410 0x00000000206db410 \??\C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
0xfffff8a002090010 0x000000000b92b010 \??\C:\Users\Rick\ntuser.dat
0xfffff8a0020ad410 0x000000000db41410 \??\C:\Users\Rick\AppData\Local\Microsoft\Windows\UsrClass.dat

看到\REGISTRY\MACHINE\SYSTEM，接着看即可。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win
7SP1x64 -o 0xfffff8a000024010 printkey                                     
Volatility Foundation Volatility Framework 2.5                             
Legend: (S) = Stable   (V) = Volatile                                       
----------------------------                                               
Registry: \REGISTRY\MACHINE\SYSTEM                                         
Key name: CMI-CreateHive{2A7FB991-7BBE-4F9D-B91E-7CB51D4737F5} (S)         
Last updated: 2018-08-04 19:25:54 UTC+0000                                 
Subkeys:                                                                   
  (S) ControlSet001                                                         
  (S) ControlSet002                                                         
  (S) MountedDevices                                                       
  (S) RNG                                                                   
  (S) Select                                                               
  (S) Setup
  (S) Software                                                            
  (S) WPA                                                                  
  (V) CurrentControlSet                                                     
Values:   
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win
7SP1x64 -o 0xfffff8a000024010 printkey -K "ControlSet001"               
Volatility Foundation Volatility Framework 2.5                             
Legend: (S) = Stable   (V) = Volatile                                       
----------------------------                                               
Registry: \REGISTRY\MACHINE\SYSTEM                                         
Key name: ControlSet001 (S)                                                 
Last updated: 2018-06-02 19:23:00 UTC+0000          
Subkeys:                                                                  
  (S) Control                                    
  (S) Enum                                      
  (S) Hardware Profiles                                                     
  (S) Policies                                                             
  (S) services                                                             
Values: 
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 -o 0xfffff8a000024010 printkey -K "ControlSet001\Control"
Volatility Foundation Volatility Framework 2.5
Legend: (S) = Stable   (V) = Volatile

----------------------------
Registry: \REGISTRY\MACHINE\SYSTEM
Key name: Control (S)
Last updated: 2018-08-04 19:26:03 UTC+0000

Subkeys:
  (S) ACPI
  (S) AGP
  (S) AppID
  (S) Arbiters
  (S) BackupRestore
  (S) Class
  (S) CMF
  (S) CoDeviceInstallers
  (S) COM Name Arbiter
  (S) ComputerName
.........................................
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 -o 0xfffff8a000024010 printkey -K "ControlSet001\Control\ComputerName"
Volatility Foundation Volatility Framework 2.5
Legend: (S) = Stable   (V) = Volatile

----------------------------
Registry: \REGISTRY\MACHINE\SYSTEM
Key name: ComputerName (S)
Last updated: 2018-08-04 19:26:11 UTC+0000

Subkeys:
  (S) ComputerName
  (V) ActiveComputerName

Values:
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 -o 0xfffff8a000024010 printkey -K "ControlSet001\Control\ComputerName\ComputerName"
Volatility Foundation Volatility Framework 2.5
Legend: (S) = Stable   (V) = Volatile

----------------------------
Registry: \REGISTRY\MACHINE\SYSTEM
Key name: ComputerName (S)
Last updated: 2018-06-02 19:23:00 UTC+0000

Subkeys:

Values:
REG_SZ                        : (S) mnmsrvc
REG_SZ        ComputerName    : (S) WIN-LO6FAF3DTFE

IP地址：192.168.202.131

使用netscan查看网络链接情况

1
2
3
4
5
6
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 netscan
Volatility Foundation Volatility Framework 2.5
Offset(P)          Proto    Local Address                  Foreign Address      State            Pid      Owner          Created
0x7d60f010         UDPv4    0.0.0.0:1900                   *:*                                   2836     BitTorrent.exe 2018-08-04 19:27:17 UTC+0000
0x7d62b3f0         UDPv4    192.168.202.131:6771           *:*                                   2836     BitTorrent.exe 2018-08-04 19:27:22 UTC+0000
0x7d62f4c0         UDPv4    127.0.0.1:62307                *:*                                   2836     BitTorrent.exe 2018-08-04 19:27:17 UTC+0000

Play Time

question:

1
Rick just loves to play some good old videogames. can you tell which game is he playing? whats the IP address of the server?

查看网络链接情况:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 netscan
Volatility Foundation Volatility Framework 2.5
Offset(P)          Proto    Local Address                  Foreign Address      State            Pid      Owner          Created
0x7d60f010         UDPv4    0.0.0.0:1900                   *:*                                   2836     BitTorrent.exe 2018-08-04 19:27:17 UTC+0000
0x7d62b3f0         UDPv4    192.168.202.131:6771           *:*                                   2836     BitTorrent.exe 2018-08-04 19:27:22 UTC+0000
0x7d62f4c0         UDPv4    127.0.0.1:62307                *:*                                   2836     BitTorrent.exe 2018-08-04 19:27:17 UTC+0000
0x7d62f920         UDPv4    192.168.202.131:62306          *:*                                   2836     BitTorrent.exe 2018-08-04 19:27:17 UTC+0000
0x7d6424c0         UDPv4    0.0.0.0:50762                  *:*                                   4076     chrome.exe     2018-08-04 19:33:37 UTC+0000
0x7d6b4250         UDPv6    ::1:1900                       *:*                                   164      svchost.exe    2018-08-04 19:28:42 UTC+0000
0x7d6e3230         UDPv4    127.0.0.1:6771                 *:*                                   2836     BitTorrent.exe 2018-08-04 19:27:22 UTC+0000
0x7d6ed650         UDPv4    0.0.0.0:5355                   *:*                                   620      svchost.exe    2018-08-04 19:34:22 UTC+0000
0x7d71c8a0         UDPv4    0.0.0.0:0                      *:*                                   868      svchost.exe    2018-08-04 19:34:22 UTC+0000
0x7d71c8a0         UDPv6    :::0                           *:*                                   868      svchost.exe    2018-08-04 19:34:22 UTC+0000
0x7d74a390         UDPv4    127.0.0.1:52847                *:*                                   2624     bittorrentie.e 2018-08-04 19:27:24 UTC+0000
0x7d7602c0         UDPv4    127.0.0.1:52846                *:*                                   2308     bittorrentie.e 2018-08-04 19:27:24 UTC+0000
0x7d787010         UDPv4    0.0.0.0:65452                  *:*                                   4076     chrome.exe     2018-08-04 19:33:42 UTC+0000
0x7d789b50         UDPv4    0.0.0.0:50523                  *:*                                   620      svchost.exe    2018-08-04 19:34:22 UTC+0000
0x7d789b50         UDPv6    :::50523                       *:*                                   620      svchost.exe    2018-08-04 19:34:22 UTC+0000
0x7d92a230         UDPv4    0.0.0.0:0                      *:*                                   868      svchost.exe    2018-08-04 19:34:22 UTC+0000
0x7d92a230         UDPv6    :::0                           *:*                                   868      svchost.exe    2018-08-04 19:34:22 UTC+0000
0x7d9e8b50         UDPv4    0.0.0.0:20830                  *:*                                   2836     BitTorrent.exe 2018-08-04 19:27:15 UTC+0000
0x7d9f4560         UDPv4    0.0.0.0:0                      *:*                                   3856     WebCompanion.e 2018-08-04 19:34:22 UTC+0000
0x7d9f8cb0         UDPv4    0.0.0.0:20830                  *:*                                   2836     BitTorrent.exe 2018-08-04 19:27:15 UTC+0000
0x7d9f8cb0         UDPv6    :::20830                       *:*                                   2836     BitTorrent.exe 2018-08-04 19:27:15 UTC+0000
0x7d8bb390         TCPv4    0.0.0.0:9008                   0.0.0.0:0            LISTENING        4        System
0x7d8bb390         TCPv6    :::9008                        :::0                 LISTENING        4        System
0x7d9a9240         TCPv4    0.0.0.0:8733                   0.0.0.0:0            LISTENING        4        System
0x7d9a9240         TCPv6    :::8733                        :::0                 LISTENING        4        System
0x7d9e19e0         TCPv4    0.0.0.0:20830                  0.0.0.0:0            LISTENING        2836     BitTorrent.exe
0x7d9e19e0         TCPv6    :::20830                       :::0                 LISTENING        2836     BitTorrent.exe
0x7d9e1c90         TCPv4    0.0.0.0:20830                  0.0.0.0:0            LISTENING        2836     BitTorrent.exe
0x7d42ba90         TCPv4    -:0                            56.219.196.26:0      CLOSED           2836     BitTorrent.exe
0x7d6124d0         TCPv4    192.168.202.131:49530          77.102.199.102:7575  CLOSED           708      LunarMS.exe
。。。。。。。。。。。。。。。。。。。

看到进程LunarMS.exe,搜一下，确实是个游戏。

Name Game

question:

1
We know that the account was logged in to a channel called Lunar-3. what is the account name?

如果用户登录了，那么账号应该会保存在Lunar的内存中。搜索字符串Lunar-3即可。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ strings OtterCTF.vmem | grep -A3 -B3 "Lunar-3"
disabled
mouseOver
keyFocused
Lunar-3
0tt3r8r33z3
Sound/UI.img/
BtMouseClick
--
c+Yt
tb+Y4c+Y
b+YLc+Y
Lunar-3
Lunar-4
L(dNVxdNV
L|eNV

0tt3r8r33z3就很像。

Name Game2

1
From a little research we found that the username of the logged on character is always after this signature: 0x64 0x??{6-8} 0x40 0x06 0x??{18} 0x5a 0x0c 0x00{2} What's rick's character's name? format: CTF{...}

方法1: 导出Lunar进程的内存。

1
$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 memdump -D . -p 708

搜索生成的文件708.dmp:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
$ hexdump -C 708.dmp > log
$ cat LOG | grep -A2 -B3 "5a 0c 00 00"
1425c610  00 00 00 00 60 00 00 00  22 41 76 01 00 00 00 80  |....`..."Av.....|
1425c620  75 05 00 00 ff 0d 00 00  d9 f0 22 fd 7d 00 00 00  |u.........".}...|
1425c630  00 00 01 01 00 00 ae d9  bf 2e ba 86 31 eb 4f fc  |............1.O.|
1425c640  25 fd ff ff ff ff ff ff  ff ff 00 5a 0c 00 00 4d  |%..........Z...M|
1425c650  30 72 74 79 4c 30 4c 00  00 00 00 00 00 00 21 4e  |0rtyL0L.......!N|
1425c660  00 00 55 75 00 00 00 00  00 00 00 00 00 00 00 00  |..Uu............|
--
*
20b05fa0  2e 81 b2 92 47 ef 4d 08  44 64 00 00 00 00 00 00  |....G.M.Dd......|
20b05fb0  40 06 00 00 b4 e5 af 00  01 00 00 00 00 00 00 00  |@...............|
20b05fc0  b0 e5 af 00 5a 0c 00 00  4d 30 72 74 79 4c 30 4c  |....Z...M0rtyL0L|
20b05fd0  00 00 00 00 00 00 00 21  4e 00 00 55 75 00 00 00  |.......!N..Uu...|
20b05fe0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

方法二: 使用yarascan搜索字符串即可。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 yarascan -Y "/\x64(.{6,8})\x40\x06(.{18})\x5a\x0c\x00\x00/i" -p 708
Volatility Foundation Volatility Framework 2.5
Rule: r1
Owner: Process LunarMS.exe Pid 708
0x5ab4dfa8  44 64 00 00 00 00 00 00 40 06 00 00 b4 e5 af 00   Dd......@.......
0x5ab4dfb8  01 00 00 00 00 00 00 00 b0 e5 af 00 5a 0c 00 00   ............Z...
0x5ab4dfc8  4d 30 72 74 79 4c 30 4c 00 00 00 00 00 00 00 21   M0rtyL0L.......!
0x5ab4dfd8  4e 00 00 55 75 00 00 00 00 00 00 00 00 00 00 00   N..Uu...........
0x5ab4dfe8  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4   ................
0x5ab4dff8  10 95 6f d5 cd 66 36 66 36 b4 ab ee fa a4 73 9f   ..o..f6f6.....s.
0x5ab4e008  70 f2 ab 6e ba 3a c4 3f c4 3c ac ee 25 ac d9 a8   p..n.:.?.<..%...
0x5ab4e018  d9 60 ac 6e a0 d6 25 d2 25 a8 ab ee ee e1 aa d2   .`.n..%.%.......
0x5ab4e028  a2 29 ac 2e 9b d1 5e f4 57 d8 ab 2e 27 86 01 7c   .)....^.W...'..|
0x5ab4e038  07 87 ab ee 0a e8 5f 12 59 d7 ab 6e 31 96 49 96   ......_.Y..n1.I.
0x5ab4e048  49 cb ab ee 9e dd e6 dd e6 6a ac 2e 2c 12 bd 3e   I........j..,..>
0x5ab4e058  25 1f 03 6d 29 87 9d 69 26 f8 4a f8 4a cb ab 6e   %..m)..i&.J.J..n
0x5ab4e068  ad 60 35 ef a2 01 c2 38 65 2c d8 fa cd e4 f8 90   .`5....8e,......
0x5ab4e078  31 c7 87 8c 21 0e 70 e6 6d 78 20 af 00 00 00 00   1...!.p.mx......
0x5ab4e088  00 00 00 00 00 00 00 00 00 00 00 00 00 5e 81 ee   .............^..
0x5ab4e098  8f 7c 6a 4e 74 06 86 f8 0d 06 00 00 00 00 00 00   .|jNt...........
Rule: r1

结果: M0rtyL0L

Silly Rick

1
Silly rick always forgets his email’s password, so he uses a Stored Password Services online to store his password. He always copy and paste the password so he will not get it wrong. whats rick’s email password?

使用clipboard查看粘贴板即可。

1
2
3
4
5
6
7
8
9
10
11
12
13
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 clipboard
Volatility Foundation Volatility Framework 2.5
Session    WindowStation Format                         Handle Object             Data

---------- ------------- ------------------ ------------------ ------------------ --------------------------------------------------
         1 WinSta0       CF_UNICODETEXT                0x602e3 0xfffff900c1ad93f0 M@il_Pr0vid0rs
         1 WinSta0       CF_TEXT                          0x10 ------------------

         1 WinSta0       0x150133L              0x200000000000 ------------------

         1 WinSta0       CF_TEXT                           0x1 ------------------

         1 ------------- ------------------           0x150133 0xfffff900c1c1adc0

结果：M@il_Pr0vid0rs

Hide And Seek

1
The reason that we took rick’s PC memory dump is because there was a malware infection. Please find the malware process name (including the extension)

查看当前进程:

1
2
3
4
5
6
7
8
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 pstree
Volatility Foundation Volatility Framework 2.5
Name                                                  Pid   PPid   Thds   Hnds Time
-------------------------------------------------- ------ ------ ------ ------ ----
 0xfffffa801b27e060:explorer.exe                     2728   2696     33    854 2018-08-04 19:27:04 UTC+0000
. 0xfffffa801b486b30:Rick And Morty                  3820   2728      4    185 2018-08-04 19:32:55 UTC+0000
.. 0xfffffa801a4c5b30:vmware-tray.ex                 3720   3820      8    147 2018-08-04 19:33:02 UTC+0000
. 0xfffffa801b2f02e0:WebCompanion.e                  2844   2728      0 ------ 2018-08-04 19:27:07 UTC+0000

可以看到可疑进程vmware-tray.exe,它的ppid3820对应着Rick And Morty，很奇怪。

查看该进程的命令:

1
2
3
4
5
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 cmdline -p 3820
Volatility Foundation Volatility Framework 2.5
************************************************************************
Rick And Morty pid:   3820
Command line : "C:\Torrents\Rick And Morty season 1 download.exe"

下载该程序：

memdump: 提取进程在内存中的信息保存到文件中 –D 指定保存的目录

procdump: 提取进程的可执行文件

1
2
3
4
5
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 procdump -p 3720 -D ./
Volatility Foundation Volatility Framework 2.5
Process(V)         ImageBase          Name                 Result
------------------ ------------------ -------------------- ------
0xfffffa801a4c5b30 0x0000000000ec0000 vmware-tray.ex       OK: executable.3720.exe

立马报毒。。。。。

Path To Glory

1
How did the malware got to rick's PC? It must be one of rick old illigal habits...

猜测应该是通过torrent下载的病毒。

  • 搜索torrent 文件
1
2
3
4
5
6
7
8
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 filescan | grep "Rick And Morty"
Volatility Foundation Volatility Framework 2.5
0x000000007d63dbc0     10      0 R--r-d \Device\HarddiskVolume1\Torrents\Rick And Morty season 1 download.exe
0x000000007d8813c0      2      0 RW-rwd \Device\HarddiskVolume1\Users\Rick\Downloads\Rick And Morty season 1 download.exe.torrent
0x000000007da56240      2      0 RW-rwd \Device\HarddiskVolume1\Torrents\Rick And Morty season 1 download.exe
0x000000007dae9350      2      0 RWD--- \Device\HarddiskVolume1\Users\Rick\AppData\Roaming\BitTorrent\Rick And Morty season 1 download.exe.1.torrent
0x000000007dcbf6f0      2      0 RW-rwd \Device\HarddiskVolume1\Users\Rick\AppData\Roaming\BitTorrent\Rick And Morty season 1 download.exe.1.torrent
0x000000007e710070      8      0 R--rwd \Device\HarddiskVolume1\Torrents\Rick And Morty season 1 download.exe
  • 提取0x000000007dae9350对应文件
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 dumpfiles -Q 0x000000007dae9350 -D .
Volatility Foundation Volatility Framework 2.5
DataSectionObject 0x7dae9350   None   \Device\HarddiskVolume1\Users\Rick\AppData\Roaming\BitTorrent\Rick And Morty season 1 download.exe.1.torrent
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ strings file.None.0xfffffa801b42c9e0.dat
d8:announce44:udp://tracker.openbittorrent.com:80/announce13:announce-listll44:udp://tracker.openbittorrent.com:80/announceel42:udp://tracker.opentrackr.org:1337/announceee10:created by17:BitTorrent/7.10.313:creation datei1533150595e8:encoding5:UTF-84:infod6:lengthi456670e4:name36:Rick And Morty season 1 download.exe12:piece lengthi16384e6:pieces560:\I
!PC<^X
B.k_Rk
0<;O87o
!4^"
3hq,
&iW1|
K68:o
w~Q~YT
$$o9p
bwF:u
e7:website19:M3an_T0rren7_4_R!cke

发现可以字符串M3an_T0rren7_4_R!cke

Path To Glory 2

1
Continue the search after the the way that malware got in.

该题的意思是，torrent 文件从哪下载的。极有可能是从Chrome浏览器中下载的。。。。。

提取chrome进程所有的内存：

1
2
3
4
5
6
7
8
. 0xfffffa801a4e3870:chrome.exe                      4076   2728     44   1160 2018-08-04 19:29:30 UTC+0000
.. 0xfffffa801a4eab30:chrome.exe                     4084   4076      8     86 2018-08-04 19:29:30 UTC+0000
.. 0xfffffa801a5ef1f0:chrome.exe                     1796   4076     15    170 2018-08-04 19:33:41 UTC+0000
.. 0xfffffa801aa00a90:chrome.exe                     3924   4076     16    228 2018-08-04 19:29:51 UTC+0000
.. 0xfffffa801a635240:chrome.exe                     3648   4076     16    207 2018-08-04 19:33:38 UTC+0000
.. 0xfffffa801a502b30:chrome.exe                      576   4076      2     58 2018-08-04 19:29:31 UTC+0000
.. 0xfffffa801a4f7b30:chrome.exe                     1808   4076     13    229 2018-08-04 19:29:32 UTC+0000
.. 0xfffffa801a7f98f0:chrome.exe                     2748   4076     15    181 2018-08-04 19:31:15 UTC+0000

提取内存：

1
2
3
4
5
6
7
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 memdump -p 3648,576 -D ./dumps/
Volatility Foundation Volatility Framework 2.5
************************************************************************
Writing chrome.exe [   576] to 576.dmp
************************************************************************
Writing chrome.exe [  3648] to 3648.dmp
。。。。。。。。。。。。。。。。。

搜索字符串:

1
2
3
4
5
6
7
8
9
10
11
12
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ strings ./dumps/* | grep "download\.exe\.torrent"
Rick And Morty season 1 download.exe.torrent
==e1f778b7-adf6-48f2-816d-740c99c5f9a4C:\Users\Rick\Downloads\Rick And Morty season 1 download.exe.torrentC:\Users\Rick\Downloads\Rick And Morty season 1 download.exe.torrent
==de371043-340d-42e5-8e16-90e6fbfbc509C:\Users\Rick\Downloads\Rick And Morty season 1 download.exe.torrentC:\Users\Rick\Downloads\Rick And Morty season 1 download.exe.torrent
Visited: Rick@file:///C:/Users/Rick/Downloads/Rick%20And%20Morty%20season%201%20download.exe.torrent
Rick And Morty season 1 download.exe.torrent
Rick And Morty season 1 download.exe.torrent
Rick And Morty season 1 download.exe.torrent
Rick And Morty season 1 download.exe.torrent
Content-Disposition: attachment; filename="Rick And Morty season 1 download.exe.torrent"
attachment; filename="Rick And Morty season 1 download.exe.torrent"
Download complete: Rick And Morty season 1 download.exe.torrent. Press Shift+F6 to cycle to the downloads bar area.

最后3行，可以帮助我们确定torrent文件就是从chrome中下载下来的。

查看该字符串周边的字符串。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ strings ./dumps/* | grep -A12 -B12 "download\.exe\.torrent"
form-composite-addresschooser_textfieldc.com
SPnvideo-label video-title trc_ellipsis  ]"sAE=
display:inline;width:56px;height:200px;m>
Hum@n_I5_Th3_Weak3s7_Link_In_Th3_Ch@inYear
//sec-s.uicdn.com/nav-cdn/home/preloader.gif
simple-icon_toolbar-change-view-horizontal
 nnx-track-sec-click-communication-inboxic.com
nx-track-sec-click-dashboard-hide_smileyable
Nftd-box stem-north big fullsize js-focusable
js-box-flex need-overlay js-componentone
Jhttps://search.mail.com/web [q origin ]Year
ntrack-and-trace__delivery-info--has-iconf
Rick And Morty season 1 download.exe.torrent
tbl_1533411035475_7.0.1.40728_2033115181
panel-mail-display-table-mail-default35"
Cnpanel-mail-display-table-mail-horizontal.js
.......................

很容易就发现flag.

Bit 4 Bit

1
We’ve found out that the malware is a ransomware. Find the attacker’s bitcoin address.

通常勒索病毒会在桌面留下一些文件：

1
2
3
4
5
6
7
8
9
10
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility  -f OtterCTF.vmem --profile=Win7SP1x64 filescan | grep Desktop
Volatility Foundation Volatility Framework 2.5
0x000000007d660500      2      0 -W-r-- \Device\HarddiskVolume1\Users\Rick\Desktop\READ_IT.txt
0x000000007d74c2d0      2      1 R--rwd \Device\HarddiskVolume1\Users\Rick\Desktop
0x000000007d7f98c0      2      1 R--rwd \Device\HarddiskVolume1\Users\Rick\Desktop
0x000000007d864250     16      0 R--rwd \Device\HarddiskVolume1\Users\Public\Desktop\desktop.ini
0x000000007d8a9070     16      0 R--rwd \Device\HarddiskVolume1\Users\Rick\Desktop\desktop.ini
0x000000007d8ac800      2      1 R--rwd \Device\HarddiskVolume1\Users\Public\Desktop 0x000000007d8ac950      2      1 R--rwd \Device\HarddiskVolume1\Users\Public\Desktop 0x000000007e410890     16      0 R--r-- \Device\HarddiskVolume1\Users\Rick\Desktop\Flag.txt
0x000000007e5c52d0      3      0 R--rwd \Device\HarddiskVolume1\Users\Rick\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini
0x000000007e77fb60      1      1 R--rw- \Device\HarddiskVolume1\Users\Rick\Desktop

提取文件:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility  -f OtterCTF.vmem --profile=Win7SP1x64 dumpfiles -Q 0x000000007d660500 -D .
Volatility Foundation Volatility Framework 2.5
DataSectionObject 0x7d660500   None   \Device\HarddiskVolume1\Users\Rick\Desktop\READ_IT.txt
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ ls
file.None.0xfffffa801b2def10.dat  OtterCTF.vmem  sift-files
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ cat file.None.0xfffffa801b2def10.dat
Your files have been encrypted.
Read the Program for more information
read program for more information.

ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility  -f OtterCTF.vmem --profile=Win7SP1x64 dumpfiles -Q 0x000000007e410890 -D .
Volatility Foundation Volatility Framework 2.5
DataSectionObject 0x7e410890   None   \Device\HarddiskVolume1\Users\Rick\Desktop\Flag.txt
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ cat file.None.0xfffffa801b0532e0.dat
{$V\☼C(Ńl1∟Tr~{ƍШn>♥G♂

flag.txt里边没东西。。。

根据提示，需要将勒索病毒下载下来。。是个正儿八经的真病毒，需要小心。。。。。

1
2
3
4
5
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ volatility -f OtterCTF.vmem --profile=Win7SP1x64 procdump -p 3720 -D ./
Volatility Foundation Volatility Framework 2.5
Process(V)         ImageBase          Name                 Result
------------------ ------------------ -------------------- ------
0xfffffa801a4c5b30 0x0000000000ec0000 vmware-tray.ex       OK: executable.3720.exe

下载下来，使用ILSpy反编译即可。

Graphic’s For The Weak

1
There’s something fishy in the malware’s graphics.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ foremost executable.3720.exe -v
Foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus
Audit File

Foremost started at Sun Dec 16 15:27:39 2018
Invocation: foremost executable.3720.exe -v
Output directory: /mnt/c/Users/HT/Desktop/OtterCTF/output
Configuration file: /etc/foremost.conf
Processing: executable.3720.exe
|------------------------------------------------------------------
File: executable.3720.exe
Start: Sun Dec 16 15:27:39 2018
Length: 414 KB (424448 bytes)

Num      Name (bs=512)         Size      File Offset     Comment

0:      00000000.exe         414 KB               0      06/02/2017 15:44:57
1:      00000672.png          14 KB          344098       (800 x 600)
*|

查看图片即可。

##Recovery

1
Rick got to have his files recovered! What is the random password used to encrypt the files?

通过上上一步反编译的结果:

1
2
3
4
public void SendPassword(string password)
{
	string text = computerName + "-" + userName + " " + password;
}

然后搜索字符串:

1
2
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ strings -el OtterCTF.vmem | grep WIN-LO6FAF3DTFE-Rick
WIN-LO6FAF3DTFE-Rick aDOBofVYUNVnmp7

Closure

1
Now that you extracted the password from the memory, could you decrypt rick’s files?

这个加密的文件就是Bit 4 Bit题中发现的flag.txt.

1
2
ht@TIANJI:/mnt/c/Users/HT/Desktop/OtterCTF$ strings executable.3720.exe | grep pdb
C:\Users\Tyler\Desktop\hidden-tear-master\hidden-tear\hidden-tear\obj\Debug\VapeHacksLoader.pdb

根据字符串hidden-tear-master，可以发现，使用的是开源的加密软件https://github.com/goliate/hidden-tear.

解密Flag.txt文件即可。

参考文章

原文作者: Tianji

原文链接: https://www.tiandiwuji.top/posts/21890/

发表日期: December 16th 2018, 12:50:26 pm

版权声明: 本文采用知识共享署名-非商业性使用 4.0 国际许可协议进行许可

CATALOG
  1. 1. Otter-CTF 内存取证分析
    1. 1.1. prepare
    2. 1.2. What’s the password
    3. 1.3. General Info
    4. 1.4. Play Time
    5. 1.5. Name Game
    6. 1.6. Name Game2
    7. 1.7. Silly Rick
    8. 1.8. Hide And Seek
    9. 1.9. Path To Glory
    10. 1.10. Path To Glory 2
    11. 1.11. Bit 4 Bit
    12. 1.12. Graphic’s For The Weak
    13. 1.13. Closure
  2. 2. 参考文章
Total : 77
2099
2019
2018
pwn ctf web安全 ctf_php_debug 置顶 工具手册 dubbo jvm linux 运维 mysql php python python安全 前端 zookeeper 渗透测试 安全体系建设
安全