G1bs0n - misc 300
@mjdubell - ChalmersCTF
Agent Gill called, we have until tomorrow at 15:00 UTC to fix some virus problem.
File: G1bs0n.tar.gz
Download: https://github.com/ymgve/ctf-writeups/blob/master/sect2017/misc300-g1bs0n/gibson.zip
Even though I followed too many rabbit holes, this was a fun challenge to work on. In order to solve this challenge, you would need some basic understanding on how to analyze memory dumps. I solved this challenge with volatility which is a forensic tool for analyzing memory dumps, and it’s built with python! Volatility can be found here https://github.com/volatilityfoundation/volatility
After downloading the memory dump, I ran strings G1bs0n > strings.txt which I then skimmed through to see what kind of information was present. I could quickly determine that the memory dump belonged to a Windows 7 system. Volatility can also help identifying the system by running vol.py -f G1bs0n imageinfo which returned:
vagrant@stretch:~/G1bson$ vol.py -f G1bs0n imageinfo
Volatility Foundation Volatility Framework 2.6
INFO : volatility.debug : Determining profile based on KDBG search...
Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_23418
AS Layer1 : WindowsAMD64PagedMemory (Kernel AS)
AS Layer2 : VMWareAddressSpace (Unnamed AS)
AS Layer3 : FileAddressSpace (/home/vagrant/G1bson/G1bs0n)
PAE type : No PAE
DTB : 0x187000L
KDBG : 0xf8000284f0a0L
Number of Processors : 1
Image Type (Service Pack) : 1
KPCR for CPU 0 : 0xfffff80002850d00L
KUSER_SHARED_DATA : 0xfffff78000000000L
Image date and time : 2017-09-03 10:33:21 UTC+0000
Image local date and time : 2017-09-03 12:33:21 +0200
Now that the system has been identified, the hunt for the flag can begin!
RECON
I began by extracting a list of all files present in the dump.
vol.py -f G1bs0n --profile=Win7SP0x64 filescan > filescan.txt
From here I could identify some interesting files such as:
0x000000003fe14390 16 0 R--rwd \Device\HarddiskVolume2\Users\plauge\Desktop\g4rb4g3.txt
Let’s extract the contents of that file!
vol.py -f G1bs0n --profile=Win7SP0x64 dumpfiles -Q 0x000000003fe14390 --name -D files/
Running strings file.None.0xfffffa8001264bb0.g4rb4g3.txt.dat revealed _X43EUC_3H64YC{GPRF, could this be part of the flag???
Don’t follow the white rabbit
At this point I assumed I had some part of the flag and I followed a few rabbit holes looking for the next part of the flag. But after taking a break, I started looking for files with the keyword gibson which yielded the following result:
vagrant@stretch:~/G1bson$ grep gibson strings.txt
jpg C:\T3MP\gibson.jpg
certutil -decode gibson.jpg gibson.zip >nul
del gibson.zip
[...]
The windows command certutil was used to decode base64 data found in gibson.jpg and the result is gibson.zip. The next step was to search for gibson in filescan.txt to find the above files.
vagrant@stretch:~/G1bson$ grep gibson filescan.txt
0x000000003ed50dd0 16 0 -W-r-- \Device\HarddiskVolume2\T3MP\gibson.jpgp
Great, now extract the file like before:
vol.py -f G1bs0n --profile=Win7SP0x64 dumpfiles -Q 0x000000003ed50dd0 --name -D files/
Opening the resulting file showed that it contained base64 data, and since we know that certutil was used to decode the data, let’s do the same thing:
C:\Users\sect\Documents\Virtual_Machines\ubuntu\share
λ certutil -decode gibson.jpgp gibson.zip
Input Length = 4096
Output Length = 1409
CertUtil: -decode command completed successfully.
GET THE FLAG
The .zip file contained three files (run.bat, run.ps1, run.reg) with some interesting data, but only one of them contained the next part of the flag:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security]
"Special"="}JGS_3G4X_GH0_3Z"
Now we have the flag, but it doesn’t look correct: _X43EUC_3H64YC{GPRF}JGS_3G4X_GH0_3Z
Reversing the flag and applying ROT13 returned the flag in the wrong order M3_0UT_K4T3_FTW}SECT{PL46U3_PHR34K_. By moving M3_0UT_K4T3_FTW} to the end of the string we get the correct flag: SECT{PL46U3_PHR34K_M3_0UT_K4T3_FTW}