I spent a bit of time on this trying to get Volatility 2 to work with the Mimikatz plug-in. I was not successful. I was able to run the Volatility hashdump module.
I switched to Volatility3 and ran hashdump. For whatever reason the output of Volatility3 was different.
The only user besides the default accounts is for ‘Congo.’ Copy the hashed password and head over to https://hashes.com/en/decrypt/hash where we can search for the hash.
Yay, we got a match.
[Note: anecdotally I was advised that you could do this offline as well with Hashcat and the rockyou wordlist. I had tried that earlier but was using the Volatility2 output. 😦 ]
The last step is to convert ‘goldfish#’ to MD5.
Now just wrap it in the flag { } and you’re good to go.
Use the tag #HuntressCTF on BakerStreetForensics.com to see all related posts and solutions for the 2023 Huntress CTF.
Throughout October, as part of Cyber Security Awareness Month, the team over at Huntress put on a ~30 day Capture the Flag event with 58 unique challenges.
First and foremost, kudos to the organizers for pulling off an event of this size and duration. There were only minor technical difficulties noticed throughout the month, and on more than one occasion those were due to people not observing the rules and using brute force tools where they weren’t needed (or allowed.)
Overall, I found the event to be a great learning experience that challenged me, increased my confidence, and gave me an avenue to pursue skills I want to develop further.
The challenges covered a wide area of subjects with the majority being DFIR related. The categories included:
Warm Ups (14)
Forensics (10)
Malware (16)
M365 (4)
OSINT (3)
Steganography (1)
Miscellaneous (10)
Today the final challenge of the event, graced us with another lovely malware sample to analyze.
I was very pleased with myself at having solved nearly 80% of the challenges. There’s still another 20 or so hours to go, so we’ll see if that improves any further. The only categories I didn’t have 100% in were Miscellaneous and Malware. I think this is fair considering my skill levels. The Malware scenarios were appropriately challenging for someone newer to this area. This is an area that I’ve been developing my skills in more recently. I’m looking forward to seeing others’ write-ups on those challenges where I didn’t make it all the way through, and following along with my own data.
Tools used in the CTF
I added a number of new tools to my toolkit throughout the CTF, and got more experienced with some old friends as well. Depending on the challenge I switched between operating systems including MacOS, REMnux (Linux), and a customized Windows VM with a plethora of malware analysis utilities. By the end of the event the tools used included:
PowerShell
Strings
CyberChef
Gimp
Curl
Firepwd.py
rita
the_silver_searcher
nmap
dcode.fr
meld
Cutter
Ghidra
Python
ChatGPT
Google Chrome Developer Tools
iSteg
exiftool
Google Lens
Google Maps
detonaRE
Process Monitor (procmon)
Visual Studio Code
Site Sucker
7zip
Magnet AXIOM
olevba
x64dbg
AADInternals
Microsoft Excel
Event Viewer
chainsaw
PowerDecode
PowerShell ISE
rclone
Volatility3
hashcat
impacket
Write-Ups
Over the next few days I’ll be releasing the write-ups on how I solved each of the completed challenges. The organizers requested that no solutions be posted until 24 hours after the conclusion of the CTF.
Based on the amount of content, I’ll be breaking the write-ups down by week number (1-4) and challenge category.
Wednesday:
Thursday:
Friday:
Saturday:
You can follow along through the week, or come back on the weekend to read them all.
Once again, I want to extend my thanks to the Huntress team for a great event. I hope you’ll follow along with my solutions, and please comment with other ways to solve if you have them. It’s all about the learning.
Use the tag #HuntressCTF on BakerStreetForensics.com to see all related posts and solutions for the 2023 Huntress CTF.
Baker Street Forensics 