HomePlaygroundOSCPBuy Me a Flag 🚩

Ermittlung

Basic memory forensics

Challenge

Description

Our Incident Response team started their investigation on a device found when pinning down a terrorist. They got some doubts while analyzing the device, So they framed these questions can you help them in answering these questions? Our Intelligence report states that the terrorist used a legit chat application for communication among themselves.

Questions:

  • What is the name of the chat application program?

    • Ex: Mozilla_Firefox (Use Name of the program, Not the name of the binary. If there is a space replace it with _. )

  • When did the user last used this chat application?

    • Answer in DD-MM-YYYY_HH:MM:SS. Timestamp in UTC

  • How many unread messages are there in the chat application that the user is using?

    • Answer should be an integer n.

  • What is the current version of the chat application that's being used?

    • Answer in X.X.XXXX.XXXX

Note:

  • Wrap the answers around inctf{}.

  • Sample flag: inctf{Mozilla_Firefox_31-07-2020_19:00:00_10_1.2.2345.5678}

  • Flag is Case Sensitive

MD5 Hash: ermittlung.raw 110305F3CF71432B4DFAFD1538CDF850

Challenge Author: g4rud4

Solution

This challenge requires us to do some basic memory forensics using Volatility.

First of all, let's determine the profile.

Great! We will use the WinXPSP2x86 profile from now on.

What is the name of the chat application program?

If we look at the process tree, the only relevant process with "chat" functionality is msimn.exe, which is Outlook Express.

When did the user last used this chat application?

The date and timestamp are provided in the above output (2020-07-27 12:26:17 UTC+0000).

How many unread messages are there in the chat application that the user is using?

A quick Google search on Outlook Express registry keys showed us that the registry keySoftware\Microsoft\Windows\CurrentVersion\UnreadMail contains information about the unread mail. There is a subkey for each email address, and the MessageCount value of those subkeys tell us how many unread messages there are.

There were 4 unread messages.

What is the current version of the chat application that’s being used?

We can use procdump to dump the executable.

Opening up the file properties in Windows, the answer is staring at us in the face!

The current version is 6.0.2900.5512.

Final Flag

inctf{Outlook_Express_27-07-2020_12:26:17_4_6.0.2900.5512}

PreviousListenNextAlpha Pie

Last updated

Was this helpful?