Magnet Weekly CTF Challenge Week 10 Writeup
There were 5 parts in the week 10 challenge of the ongoing Magnet Weekly CTF. I managed to solve 4 parts out of 5 and the following would cover my walkthrough for this challenges:
Notice the wording "established connection" was used in the challenge description. Therefore, the term "ESTABLISHED" was searched inside the the Volatility netscan plugin output:
There were 4 known established connections at the time of RAM collection. According to whois output, the 1st IP address (18.104.22.168) belongs to fastly. However, the 2nd IP address (22.214.171.124) belongs to Google. Thus, the answer should be 126.96.36.199:443.
Part 2 of the question immediately asked for the local IP address and the port number. From the Part 1 netscan screenshot, the answer should be 192.168.10.146:54282.The browsed URL should be lurking somewhere inside the Chrome History SQLite database, which could be dumped with the following Volatility command:
The last visited URL, which was "https://www.google.com", is the answer for this part of the challenge:
python vol.py -f ../memdump.mem --profile=Win7SP1x64 dumpfiles -Q 0x000000013e9ccb30 --dump-dir Chrome/
The Chrome History file physical offset could be found from Volatility filescan plugin output:
As discussed in week 9 write-up, Warren should be the only active user on the system.
- submitting the visit_duration value (437292) of "https://www.google.com" as the answer
- finding when the Google Chrome was last updated and calculate the time difference
- searching "Volatility" and "focus" on Google and found tons of stock-related material instead (which was clearly not related to the 5-point "FOCUS" hint)
At the end, it was about the "Time Focused" field from Volatility UserAssist plugin output and 3:36:47.30100 was the intended answer.For the uninitiated, the following text excerpted from this Opentext page illustrated how the "Time Focused" mechanism works:
- Leave no stones unturned. The answer that you have been desperately looking for might very well just beneath that unturned stone.
- KNOW YOUR ARTIFACTS! KNOW YOUR TOOLS!