| my rAnd0m m1ndfl0w |
| #whoami $bl0g /script.s |
The Nixu Challenge - 2019 - Bad memories - part 2 ------------------------------------------------- The briefing talks about lost files, so the first thing that pops into mind is to look for deleted files. In Windows deleted files go first to the recycle bin, if the user isn't using shift while deleting. So first we'll need to check filescan: volatility filescan -f mem.dmp --profile=Win7SP1x64 >> filescan Then check for recycled files: grep Recycle filescan 0x0000000004e6ddc0 16 0 R--rwd \Device\HarddiskVolume1\$Recycle.Bin\S-1-5-21-1610009768-122519599-941061767-1003\desktop.ini 0x0000000006cdd210 16 0 -W---- \Device\HarddiskVolume1\$Recycle.Bin\S-1-5-21-1610009768-122519599-941061767-1003\$INA5LHA.txt The first file seems unimportant, but the txt file might be of interest. I tried extracting the file straight away from the given offset in unsafe mode (-u) and saving the summary (-S) and including the filename (-n): volatility --profile=Win7SP1x64 dumpfiles -D ./ -Q 0x0000000006cdd210 -f mem.dmp -u -n -S summary.txt This gave nothing at all, so must've not been cached anymore. Next we can check the MFT table, to see if the content still remains reachable there: volatility --profile=Win7SP1x64 mftparser -f mem.dmp >> mftparsed See if there's anything from recycle bin: grep -n Recycle mftparsed 6199:2018-12-20 01:12:21 UTC+0000 2018-12-20 01:12:21 UTC+0000 2018-12-20 01:12:21 UTC+0000 2018-12-20 01:12:21 UTC+0000 $Recycle.Bin\S-1-5-~2 6204:2018-12-20 01:12:21 UTC+0000 2018-12-20 01:12:21 UTC+0000 2018-12-20 01:12:21 UTC+0000 2018-12-20 01:12:21 UTC+0000 $Recycle.Bin\S-1-5-21-1610009768-122519599-941061767-1003 214112:2018-03-06 19:05:32 UTC+0000 2018-03-06 19:05:32 UTC+0000 2018-03-06 19:05:32 UTC+0000 2018-03-06 19:05:32 UTC+0000 $Recycle.Bin 215086:2018-12-20 01:12:21 UTC+0000 2018-12-20 01:12:21 UTC+0000 2018-12-20 01:12:21 UTC+0000 2018-12-20 01:12:21 UTC+0000 $Recycle.Bin\S-1-5-21-1610009768-122519599-941061767-1003\desktop.ini 231422:2018-12-20 05:28:56 UTC+0000 2018-12-20 05:28:56 UTC+0000 2018-12-20 05:28:56 UTC+0000 2018-12-20 05:28:56 UTC+0000 $Recycle.Bin\S-1-5-21-1610009768-122519599-941061767-1003\$INA5LHA.txt 384965:2018-12-20 04:05:54 UTC+0000 2018-12-20 04:08:08 UTC+0000 2018-12-20 05:26:39 UTC+0000 2018-12-20 04:05:54 UTC+0000 $Recycle.Bin\S-1-5-21-1610009768-122519599-941061767-1003\$RNA5LHA.txt So the rows 231422 and 384965 look interesting. Opened the file in nano and checked row 231422 first: $FILE_NAME Creation Modified MFT Altered Access Date Name/Path ------------------------------ ------------------------------ ------------------------------ ------------------------------ --------- 2018-12-20 05:28:56 UTC+0000 2018-12-20 05:28:56 UTC+0000 2018-12-20 05:28:56 UTC+0000 2018-12-20 05:28:56 UTC+0000 $Recycle.Bin\S-1-5-21-1610009768-122519599-941061767-1003\$INA5LHA.txt $DATA 0000000000: 01 00 00 00 00 00 00 00 f8 01 00 00 00 00 00 00 ................ 0000000010: c0 c2 57 e7 24 98 d4 01 43 00 3a 00 5c 00 55 00 ..W.$...C.:.\.U. 0000000020: 73 00 65 00 72 00 73 00 5c 00 41 00 6c 00 69 00 s.e.r.s.\.A.l.i. 0000000030: 63 00 65 00 5c 00 44 00 6f 00 63 00 75 00 6d 00 c.e.\.D.o.c.u.m. 0000000040: 65 00 6e 00 74 00 73 00 5c 00 66 00 6c 00 61 00 e.n.t.s.\.f.l.a. 0000000050: 67 00 2e 00 74 00 78 00 74 00 00 00 00 00 00 00 g...t.x.t....... 0000000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ OK, there's the data telling the name of the file deleted, which confirmed we were on the right path, as the filename was flag.txt. Next I checked line 384965: $FILE_NAME Creation Modified MFT Altered Access Date Name/Path ------------------------------ ------------------------------ ------------------------------ ------------------------------ --------- 2018-12-20 04:05:54 UTC+0000 2018-12-20 04:08:08 UTC+0000 2018-12-20 05:26:39 UTC+0000 2018-12-20 04:05:54 UTC+0000 $Recycle.Bin\S-1-5-21-1610009768-122519599-941061767-1003\$RNA5LHA.txt $OBJECT_ID Object ID: c1d3eabf-0b04-e911-abc6-000c29112dd9 Birth Volume ID: 80000000-1002-0000-0000-180000000100 Birth Object ID: f8010000-1800-0000-4d44-45774d444578 Birth Domain ID: 4d544167-4d44-4577-4d44-45774d444567 $DATA 0000000000: 4d 44 45 77 4d 44 45 78 4d 54 41 67 4d 44 45 77 MDEwMDExMTAgMDEw 0000000010: 4d 44 45 77 4d 44 45 67 4d 44 45 77 4d 54 45 77 MDEwMDEgMDEwMTEw 0000000020: 4d 44 41 67 4d 44 45 77 4d 54 41 78 4d 44 45 67 MDAgMDEwMTAxMDEg 0000000030: 4d 44 45 78 4d 54 45 77 4d 54 45 67 4d 44 45 78 MDExMTEwMTEgMDEx 0000000040: 4d 54 41 78 4d 54 45 67 4d 44 45 78 4d 44 41 77 MTAxMTEgMDExMDAw 0000000050: 4d 44 45 67 4d 44 45 78 4d 44 45 77 4d 44 45 67 MDEgMDExMDEwMDEg 0000000060: 4d 44 45 78 4d 54 41 78 4d 44 41 67 4d 44 45 77 MDExMTAxMDAgMDEw 0000000070: 4d 54 45 78 4d 54 45 67 4d 44 45 78 4d 44 41 78 MTExMTEgMDExMDAx 0000000080: 4d 44 41 67 4d 44 45 78 4d 44 45 77 4d 44 45 67 MDAgMDExMDEwMDEg 0000000090: 4d 44 45 78 4d 44 41 78 4d 44 41 67 4d 44 45 78 MDExMDAxMDAgMDEx 00000000a0: 4d 44 45 78 4d 54 41 67 4d 44 45 78 4d 54 41 78 MDExMTAgMDExMTAx 00000000b0: 4d 44 41 67 4d 44 45 77 4d 54 45 78 4d 54 45 67 MDAgMDEwMTExMTEg 00000000c0: 4d 44 45 78 4d 44 45 77 4d 44 45 67 4d 44 45 77 MDExMDEwMDEgMDEw 00000000d0: 4d 54 45 78 4d 54 45 67 4d 44 45 78 4d 44 41 77 MTExMTEgMDExMDAw 00000000e0: 4d 44 45 67 4d 44 45 78 4d 44 45 78 4d 44 41 67 MDEgMDExMDExMDAg 00000000f0: 4d 44 45 78 4d 54 41 77 4d 54 41 67 4d 44 45 78 MDExMTAwMTAgMDEx 0000000100: 4d 44 41 78 4d 44 45 67 4d 44 45 78 4d 44 41 77 MDAxMDEgMDExMDAw 0000000110: 4d 44 45 67 4d 44 45 78 4d 44 41 78 4d 44 41 67 MDEgMDExMDAxMDAg 0000000120: 4d 44 45 78 4d 54 45 77 4d 44 45 67 4d 44 45 77 MDExMTEwMDEgMDEw 0000000130: 4d 54 45 78 4d 54 45 67 4d 44 45 78 4d 54 41 77 MTExMTEgMDExMTAw 0000000140: 4d 54 41 67 4d 44 45 78 4d 44 41 78 4d 44 45 67 MTAgMDExMDAxMDEg 0000000150: 4d 44 45 78 4d 44 45 78 4d 44 45 67 4d 44 45 78 MDExMDExMDEgMDEx 0000000160: 4d 44 45 78 4d 54 45 67 4d 44 45 78 4d 54 41 78 MDExMTEgMDExMTAx 0000000170: 4d 54 41 67 4d 44 45 78 4d 44 41 78 4d 44 45 67 MTAgMDExMDAxMDEg 0000000180: 4d 44 45 77 4d 54 45 78 4d 54 45 67 4d 44 45 78 MDEwMTExMTEgMDEx 0000000190: 4d 44 41 78 4d 44 45 67 4d 44 45 78 4d 54 41 78 MDAxMDEgMDExMTAx 00000001a0: 4d 54 41 67 4d 44 45 78 4d 44 45 77 4d 44 45 67 MTAgMDExMDEwMDEg 00000001b0: 4d 44 45 78 4d 44 41 78 4d 44 41 67 4d 44 45 78 MDExMDAxMDAgMDEx 00000001c0: 4d 44 41 78 4d 44 45 67 4d 44 45 78 4d 44 45 78 MDAxMDEgMDExMDEx 00000001d0: 4d 54 41 67 4d 44 45 78 4d 44 41 77 4d 54 45 67 MTAgMDExMDAwMTEg 00000001e0: 4d 44 45 78 4d 44 41 78 4d 44 45 67 4d 44 45 78 MDExMDAxMDEgMDEx 00000001f0: 4d 54 45 78 4d 44 45 3d MTExMDE= Well that data sure looks like possibly base64, so saved the data to temp and grepped out the ascii: sed 's/^.* //g' temp MDEwMDExMTAgMDEw MDEwMDEgMDEwMTEw MDAgMDEwMTAxMDEg MDExMTEwMTEgMDEx MTAxMTEgMDExMDAw MDEgMDExMDEwMDEg MDExMTAxMDAgMDEw MTExMTEgMDExMDAx MDAgMDExMDEwMDEg MDExMDAxMDAgMDEx MDExMTAgMDExMTAx MDAgMDEwMTExMTEg MDExMDEwMDEgMDEw MTExMTEgMDExMDAw MDEgMDExMDExMDAg MDExMTAwMTAgMDEx MDAxMDEgMDExMDAw MDEgMDExMDAxMDAg MDExMTEwMDEgMDEw MTExMTEgMDExMTAw MTAgMDExMDAxMDEg MDExMDExMDEgMDEx MDExMTEgMDExMTAx MTAgMDExMDAxMDEg MDEwMTExMTEgMDEx MDAxMDEgMDExMTAx MTAgMDExMDEwMDEg MDExMDAxMDAgMDEx MDAxMDEgMDExMDEx MTAgMDExMDAwMTEg MDExMDAxMDEgMDEx MTExMDE= Checked it with CyberChef and indeed it was base64, returning binary: 01001110 01001001 01011000 01010101 01111011 01110111 01100001 01101001 01110100 01011111 01100100 01101001 01100100 01101110 01110100 01011111 01101001 01011111 01100001 01101100 01110010 01100101 01100001 01100100 01111001 01011111 01110010 01100101 01101101 01101111 01110110 01100101 01011111 01100101 01110110 01101001 01100100 01100101 01101110 01100011 01100101 01111101 Then converted the binary to ascii with CyberChef:
NIXU{wait_didnt_i_already_remove_evidence}
|