Rating:
Honestly? Go view the GitHub URL instead of looking here.
## Notes (notes)
### Description - notes
Solved By: [OreoByte](https://github.com/OreoByte)
Author: [goproslowyo](https://github.com/goproslowyo)
We're given a memory dump to analyze. Inside we find a base64 encoded string on the users clipboard containing the flag.
### Process - notes
1. Downloaded `image.mem` for the challenge.
```shell
root@ip-10-10-162-135:~/repos# curl -LO http://static.ctf.umasscybersec.org/forensics/13096721-bb26-4b79-956f-3f0cddebd49b/image.mem
```
1. Analyze the memory dump:
- Using the `imageinfo` command can help to identify the correct profile to use later with the `--profile=[profile]` argument. From the output it seems like it's a `Windows 7 Service Pack 1` memory dump.
- We can get the same results without the `grep -vi 'fail'` (we we're removing some error out from python modules with that).
```shell
root@ip-10-10-162-135:~/repos# vol.py -f image.mem imageinfo | grep -vi 'fail'
Volatility Foundation Volatility Framework 2.6.1
INFO : volatility.debug : Determining profile based on KDBG search...
Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_24000, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_24000, Win7SP1x64_23418
AS Layer1 : WindowsAMD64PagedMemory (Kernel AS)
AS Layer2 : FileAddressSpace (/root/repos/image.mem)
PAE type : No PAE
DTB : 0x187000L
KDBG : 0xf80002a3b0a0L
Number of Processors : 6
Image Type (Service Pack) : 1
KPCR for CPU 0 : 0xfffff80002a3cd00L
KPCR for CPU 1 : 0xfffff880009f1000L
KPCR for CPU 2 : 0xfffff88002ea9000L
KPCR for CPU 3 : 0xfffff88002f1f000L
KPCR for CPU 4 : 0xfffff88002f95000L
KPCR for CPU 5 : 0xfffff88002fcb000L
KUSER_SHARED_DATA : 0xfffff78000000000L
Image date and time : 2021-03-20 18:16:12 UTC+0000
Image local date and time : 2021-03-20 13:16:12 -0500
```
1. Hidden in the users clipboard memory dump we find a base64 encoded string.
```shell
root@ip-10-10-162-135:~/repos# vol.py -f image.mem --profile=Win7SP1x64 clipboard
Volatility Foundation Volatility Framework 2.6.1
Session WindowStation Format Handle Object Data
---------- ------------- ------------------ ------------------ ------------------ --------------------------------------------------
1 WinSta0 CF_UNICODETEXT 0x5a00b5 0xfffff900c26aeb60 VU1BU1N7JDNDVVIzXyQ3MFJhZzN9Cg==
1 WinSta0 CF_TEXT 0x64006e00000010 ------------------
1 WinSta0 0x13c01b7L 0x0 ------------------
1 WinSta0 CF_TEXT 0x1 ------------------
1 ------------- ------------------ 0x13c01b7 0xfffff900c06fa270
```
1. Decode the string:
```shell
root@ip-10-10-162-135:~/repos# echo VU1BU1N7JDNDVVIzXyQ3MFJhZzN9Cg== | base64 -d
UMASS{$3CUR3_$70Rag3}
```
### Screen Grabs - notes
#### Analyzing the Memory Dump - notes
#### Dumping the Memory Contents - notes
#### Decoding the Flag - notes
### Tools Used - notes
1. [Volatility v2.6](https://github.com/volatilityfoundation/volatility/tree/2.6)
