Magnet Weekly CTF Challenge Week #9

Part 1

https://svch0st.medium.com/magnet-virtual-summit-2020-ctf-memory-7927c755a182

Part 2

vol.py -f memdump.mem --profile=Win7SP1x64 handles -p 3180 -t File
cat filescan.txt | grep .doc
cat filescan.txt | grep .txt
cat filescan.txt | grep Document
vol.py -f memdump.mem --profile=Win7SP1x64 dumpfiles -Q 0x000000013e6de810 -D .

Part 3

  • Object ID (used as a key in the index)
  • Birth Volume Object ID
  • Birth Object ID
  • Domain Object ID
vol.py -f memdump.mem --profile=Win7SP1x64 mftparser --output-file=mft.txt

Part 4

Part 5

Part 6

strings -o memdump.mem > strings.txt
1274225055:wow_this_is_an_uncrackable_password

Part 7

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store