CTF Forensic challenge
CTF Forensic challenge

Photo by Mika Baumeister on Unsplash

Last week a CTF event organized by the Spanish Guardia Civil was organized, the II NATIONAL CYBERLEAGUE GC. This challenge is oriented to students, due to that reason I could not participate. But I have I friend who participate, He knows I love forensic challenges so He sent me one of the challenges that were part of the competition. Their team did not manage to solve this challenge so let’s see what was about and how to solve it.

Evidence

There are two files:

container

snap.vmem

If you have played other CTF challenges this seems a little obvious but let it break into parts. The container seems to be an encrypted container and snap.vmem it is a RAM acquisition.

Secrets in live memory have been always a problem. Having a RAM acquisition can give us a lot of information in a digital forensics investigation. We can discover processes running, dump files, secrets, connections and a lot of useful information. The most popular tool for memory analysis is Volatility. Volatility is an Open Source project with a great and active community behind it, there are alternatives like Rekall but I personally prefer Volatility.

Right now Volatility has a 3.0 version with a lot of improvements but it is under beta. Because of that, I used the latest stable release, Volatility 2.6.

Volatility Analysis

The first thing we need to do is to identify the operative system in order to properly analyzed the live memory adquistion. Every operative system handles memory in a different way. Running image info will give us the suggested operative systems profiles.

./volatility_2.6 -f evidencias/snap.vmem imageinfo

The suggested profiles are Windows XP related, we can use one of them WinXPSP2x86 or WinXPSP3x86.

Knowing the operative system we can start to extract useful information. I always start with pstree. This will let us know whats processes were running in the system.

./volatility_2.6 -f evidencias/snap.vmem --profile WinXPSP2x86 pstree

The most interesting process to lookup is TrueCrypt. TrueCrypt was a program that allows us to created encrypted containers and partitions. Right now it is discontinued and has been replaced by Veracrypt. Some people thought that Truecrypt had hidden vulnerabilities but long history short, nothing was found.

Either way, Volatility has some commands centred in analysing Truecrypt processed:

truecryptsummary

truecryptmaster

truecryptpassphrase

truecryptsummary can give us information about the TrueCrypt process.
['Carlos Cilleruelo']
['Security', 'Encryption', 'Ctf', 'Cybersecurity', 'Technology']