際際滷

際際滷Share a Scribd company logo

BSides Delhi CTF 2018 [Never Too Late Mister (Forensics 200pts)] WriteUp

Sehan Lee
Sehan Lee

BSides Delhi CTF 2018 [Never Too Late Mister (Forensics 200pts)] WriteUp Language: Korean

1 of 13
Download to read offline
BSides Delhi CTF 2018 WriteUp Never Too Late Mister (Forensics 200points) by (Alchemic)
2 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] れ螻 螳 覓語螳 譯殊伎. 覓語 る朱 覲伎 , 覃覈襴 ろ襯 覿 伎朱 覲伎讌.
覓語 殊 豢 朱 譯殊伎覃, 豢 伎覃 れ螻 螳 れ 殊 誤 給. 覃覈襴 ろ 殊 Challenge.raw 殊 誤 給. 伎 [volatility]襯 伎 覃覈襴 ろ 殊 覿企慨襦 蟆給. 一, 企 蟆曙 襷れ伎 覃覈襴 ろ語 語 企慨襦 蟆給. 3 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)]
4 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] 蟆郁骸, 覲 覓語 譯殊伎 覃覈襴 ろ 殊 Windows 7 Service Pack 1 x86 蟆曙 襷れ伎 覃覈襴 ろ 殊 蟆 誤 給. 伎 企 蟆曙語襯 誤朱襦, [volatility]襯 伎 螻伎 覿 讌襦 蟆給. 一, 企 覈 ろ襴螳 讌襯 覲願鍵 cmdscan 蠏語語 企慨襦 蟆給.
5 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] Python ろ襴渚碁ゼ ろ 覈 ろ襴襯 覦蟆蟆 給. consoles 蠏語語朱 企 ろ襴渚瑚 企 蟆郁骸襯 企讌襯 誤企慨襦 蟆給.
6 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] 伎 ろ襴渚碁ゼ ろ 蟆郁骸, 335d366f5d6031767631707f 朱 螳 蟆 誤 給. 企 HEX 覓語企 覲伎讌. 讌襷 一危磯朱 覓伎語 朱襦 覿 讌企慨襦 蟆給.
7 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] 螻 覿 讌り envars 蠏語語 伎 襦語 蟆 覲襯 譟一り 轟危 覲襯 覦蟆蟆 給. conhost.exe(2424) 襦語れ Thanos 朱 覲襯 誤蟆 螻, 蠏 覲螳朱 xor and password 朱 覓語伎 誤 給. 企 覓語襯 願屋蠍 碁 覲伎讌.
8 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] 讌襷 碁ゼ 覲伎 , れ 蟆曙 Windows User Password襯 詩 蟆朱 覃, XOR 蟆曙一 朱襦 讌 誤 伎 ろ襴渚 殊 demon.py.txt 殊 譟一襦 蟆給. mftparser 蠏語瑚骸 grep 覈轟企ゼ 伎 demon.py.txt 殊 伎 MFT(Master File Table) 伎 誤螻, 企 offset螻 一危 朱襯 谿場 給.
9 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] MFT(Master File Table) NT 螻 伎豌伎 ろ NTFS 譴 . NTFS 覲朱エ 覈 殊 企 碁Μ襯 螳讌螻 朱, 蠍, 殊, 蟠, 一危 伎 殊 蟯 覈 覲願 ル螻 蟯襴 企手 覲 給. [Reference: NTFS Master File Table (MFT) Structure, http://www.ntfs.com/ntfs-mft.htm]
10 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] Python script 伎 碁 offset (0x7ca3c00) 伎 MFT 譟一 伎 ろ襴渚語 伎 誤 給! 碁 語 xor and password XOR 語 旧 覦蟆給!
11 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] [volatility] consoles 蠏語語 伎 誤 HEX 覓語願骸 螳 螳 豢ル 蟆 誤 給. 企 flag 朱 1_4m_b3tt3r} 蟆 給. 伎 flag 襾語 覿覿 谿場 . 語 password 朱 碁ゼ 覲伎朱襦, Windows User Password 襯 誤企慨襦 蟆給.
12 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] hashdump 蠏語語 伎 れ 伎 ろ襯 誤企慨襦 蟆給. User hello 企, れ NTLM Hash襦 豢ル 蟆 誤 給. 企ゼ crack 蠍 mimikatz 蠏語語 襦 蟆給. (mimikatz.py) れ 蟆郁骸 flag るジ 覿覿 谿場 給! The flag is... flag{you_are_good_but1_4m_b3tt3r}
Thank You! Contact sehands@sju.ac.kr

More Related Content

BSides Delhi CTF 2018 [Never Too Late Mister (Forensics 200pts)] WriteUp

  • 1. BSides Delhi CTF 2018 WriteUp Never Too Late Mister (Forensics 200points) by (Alchemic)
  • 2. 2 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] れ螻 螳 覓語螳 譯殊伎. 覓語 る朱 覲伎 , 覃覈襴 ろ襯 覿 伎朱 覲伎讌.
  • 3. 覓語 殊 豢 朱 譯殊伎覃, 豢 伎覃 れ螻 螳 れ 殊 誤 給. 覃覈襴 ろ 殊 Challenge.raw 殊 誤 給. 伎 [volatility]襯 伎 覃覈襴 ろ 殊 覿企慨襦 蟆給. 一, 企 蟆曙 襷れ伎 覃覈襴 ろ語 語 企慨襦 蟆給. 3 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)]
  • 4. 4 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] 蟆郁骸, 覲 覓語 譯殊伎 覃覈襴 ろ 殊 Windows 7 Service Pack 1 x86 蟆曙 襷れ伎 覃覈襴 ろ 殊 蟆 誤 給. 伎 企 蟆曙語襯 誤朱襦, [volatility]襯 伎 螻伎 覿 讌襦 蟆給. 一, 企 覈 ろ襴螳 讌襯 覲願鍵 cmdscan 蠏語語 企慨襦 蟆給.
  • 5. 5 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] Python ろ襴渚碁ゼ ろ 覈 ろ襴襯 覦蟆蟆 給. consoles 蠏語語朱 企 ろ襴渚瑚 企 蟆郁骸襯 企讌襯 誤企慨襦 蟆給.
  • 6. 6 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] 伎 ろ襴渚碁ゼ ろ 蟆郁骸, 335d366f5d6031767631707f 朱 螳 蟆 誤 給. 企 HEX 覓語企 覲伎讌. 讌襷 一危磯朱 覓伎語 朱襦 覿 讌企慨襦 蟆給.
  • 7. 7 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] 螻 覿 讌り envars 蠏語語 伎 襦語 蟆 覲襯 譟一り 轟危 覲襯 覦蟆蟆 給. conhost.exe(2424) 襦語れ Thanos 朱 覲襯 誤蟆 螻, 蠏 覲螳朱 xor and password 朱 覓語伎 誤 給. 企 覓語襯 願屋蠍 碁 覲伎讌.
  • 8. 8 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] 讌襷 碁ゼ 覲伎 , れ 蟆曙 Windows User Password襯 詩 蟆朱 覃, XOR 蟆曙一 朱襦 讌 誤 伎 ろ襴渚 殊 demon.py.txt 殊 譟一襦 蟆給. mftparser 蠏語瑚骸 grep 覈轟企ゼ 伎 demon.py.txt 殊 伎 MFT(Master File Table) 伎 誤螻, 企 offset螻 一危 朱襯 谿場 給.
  • 9. 9 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] MFT(Master File Table) NT 螻 伎豌伎 ろ NTFS 譴 . NTFS 覲朱エ 覈 殊 企 碁Μ襯 螳讌螻 朱, 蠍, 殊, 蟠, 一危 伎 殊 蟯 覈 覲願 ル螻 蟯襴 企手 覲 給. [Reference: NTFS Master File Table (MFT) Structure, http://www.ntfs.com/ntfs-mft.htm]
  • 10. 10 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] Python script 伎 碁 offset (0x7ca3c00) 伎 MFT 譟一 伎 ろ襴渚語 伎 誤 給! 碁 語 xor and password XOR 語 旧 覦蟆給!
  • 11. 11 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] [volatility] consoles 蠏語語 伎 誤 HEX 覓語願骸 螳 螳 豢ル 蟆 誤 給. 企 flag 朱 1_4m_b3tt3r} 蟆 給. 伎 flag 襾語 覿覿 谿場 . 語 password 朱 碁ゼ 覲伎朱襦, Windows User Password 襯 誤企慨襦 蟆給.
  • 12. 12 BSides Delhi CTF 2018 WriteUp [Never Too Late Mister (Forensics 200points)] hashdump 蠏語語 伎 れ 伎 ろ襯 誤企慨襦 蟆給. User hello 企, れ NTLM Hash襦 豢ル 蟆 誤 給. 企ゼ crack 蠍 mimikatz 蠏語語 襦 蟆給. (mimikatz.py) れ 蟆郁骸 flag るジ 覿覿 谿場 給! The flag is... flag{you_are_good_but1_4m_b3tt3r}