CTF - Obsession
해당 문제는 Github의 MemLabs의 Obsession 문제에 대한 풀이입니다.1. Challenge descriptionMy system was recently compromised. The Hacker stole a lot of information but he also deleted a very important file of mine. I have no idea on how to recover it. The only evidence we have, at this point of time is this memory dump. Please help me. Note: This challenge is composed of only 1 flag. The flag format for this lab i..
CTF - The Evil's Den
해당 문제는 Github의 MemLabs의 The Evil's Den 문제에 대한 풀이입니다.1. Challenge descriptionA malicious script encrypted a very secret piece of information I had on my system. Can you recover the information for me please? Note-1: This challenge is composed of only 1 flag. The flag split into 2 parts. Note-2: You'll need the first half of the flag to get the second. You will need this additional tool to solve t..
CTF - A New World
해당 문제는 Github의 MemLabs의 A New World 문제에 대한 풀이입니다.1. Challenge descriptionOne of the clients of our company, lost the access to his system due to an unknown error. He is supposedly a very popular "environmental" activist. As a part of the investigation, he told us that his go to applications are browsers, his password managers etc. We hope that you can dig into this memory dump and find his impor..
CTF - Beginner's Luck
해당 문제는 Github의 MemLabs의 Beginner's Luck 문제에 대한 풀이입니다. 1. Challenge descriptionMy sister's computer crashed. We were very fortunate to recover this memory dump. Your job is get all her important files from the system. From what we remember, we suddenly saw a black window pop up with some thing being executed. When the crash happened, she was trying to draw something. Thats all we remember from th..
CTF - Never Too Late Mister
해당 문제는 Github의 MemLabs의 Never Too Late Mister 문제에 대한 풀이입니다.1. 문제 설명My friend John is an "environmental" activist and a humanitarian. He hated the ideology of Thanos from the Avengers: Infinity War. He sucks at programming. He used too many variables while writing any program. One day, John gave me a memory dump and asked me to find out what he was doing while he took the dump. Can you figure it ..
CTF-D GrrCon 2015 정리 & 추가 분석
해당 포스트에서는 CTF-D GrrCon 2015 문제에 대한 정리입니다.아래 포스트를 먼저 보고 오시는걸 추천합니다.https://infosec-noh.tistory.com/11 CTF-D, GrrCon 2015 with volatility해당 포스트에서는 CTF-D의 GrrCon 2015 #1 문제에 대한 분석입니다. 해당 문제를 제공하는 사이트는 현재 막혀있는 상태로 파일 다운을 원하고자 하면 댓글 남겨주세요. 1. 운영체제 식별 해당 파일infosec-noh.tistory.com1. GrrCon 2015운영체제 식별Win7SP1X86프로세스 검색Teamviewer 관련 프로세스(tv_w32.exe)explorer 하위 프로세스 (mstsc.exe, OUTLOOK.exe)인터넷 익스플로러 (iexp..