> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/forense/beginners-luck.md).
# Beginner's Luck
{% embed url="" %}
> **Challenge Description:** My sister's computer crashed. We were very fortunate to recover this memory dump. Your job is get all her important files from the system. From what we remember, we suddenly saw a black window pop up with some thing being executed. When the crash happened, she was trying to draw something. Thats all we remember from the time of crash.
{% hint style="info" %}
Note: This challenge is composed of 3 flags.
{% endhint %}
## **1. Identificación del Sistema (`imageinfo`)**
```bash
vol2 -f MemoryDump_Lab1.raw imageinfo
```
```bash
Volatility Foundation Volatility Framework 2.6
INFO : volatility.debug : Determining profile based on KDBG search...
Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_23418
AS Layer1 : WindowsAMD64PagedMemory (Kernel AS)
AS Layer2 : FileAddressSpace (/home/barre/Documents/Labs/Forense/memlabs/BeginnersLuck/MemoryDump_Lab1.raw)
PAE type : No PAE
DTB : 0x187000L
KDBG : 0xf800028100a0L
Number of Processors : 1
Image Type (Service Pack) : 1
KPCR for CPU 0 : 0xfffff80002811d00L
KUSER_SHARED_DATA : 0xfffff78000000000L
Image date and time : 2019-12-11 14:38:00 UTC+0000
Image local date and time : 2019-12-11 20:08:00 +0530
```
## **2. Mapeo de Procesos**
### **Listado de procesos (`pslist`)**
```bash
vol2 -f MemoryDump_Lab1.raw --profile=Win7SP1x64 pslist
```
```bash
0xfffffa8002222780 cmd.exe 1984 604 1 21 1 0 2019-12-11 14:34:54 UTC+0000
0xfffffa8002227140 conhost.exe 2692 368 2 50 1 0 2019-12-11 14:34:54 UTC+0000
0xfffffa80022bab30 mspaint.exe 2424 604 6 128 1 0 2019-12-11 14:35:14 UTC+0000
0xfffffa8001010b30 WinRAR.exe 1512 2504 6 207 2 0 2019-12-11 14:37:23 UTC+0000
0xfffffa800104a780 conhost.exe 2260 368 2 50 1 0 2019-12-11 14:37:54 UTC+0000
```
## **3. Análisis de Línea de Comandos**
### **Buffer de consola (`consoles`)**
```bash
vol2 -f MemoryDump_Lab1.raw --profile=Win7SP1x64 consoles
```
```bash
**************************************************
ConsoleProcess: conhost.exe Pid: 2692
Console: 0xff756200 CommandHistorySize: 50
HistoryBufferCount: 1 HistoryBufferMax: 4
OriginalTitle: %SystemRoot%\\system32\\cmd.exe
Title: C:\\Windows\\system32\\cmd.exe - St4G3$1
AttachedProcess: cmd.exe Pid: 1984 Handle: 0x60
----
CommandHistory: 0x1fe9c0 Application: cmd.exe Flags: Allocated, Reset
CommandCount: 1 LastAdded: 0 LastDisplayed: 0
FirstCommand: 0 CommandCountMax: 50
ProcessHandle: 0x60
Cmd #0 at 0x1de3c0: St4G3$1
----
Screen 0x1e0f70 X:80 Y:300
Dump:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\\Users\\SmartNet>St4G3$1
ZmxhZ3t0aDFzXzFzX3RoM18xc3Rfc3Q0ZzMhIX0=
Press any key to continue . . .
**************************************************
```
Sacamos la flag 1 que esta en base 64: `ZmxhZ3t0aDFzXzFzX3RoM18xc3Rfc3Q0ZzMhIX0=`
> flag{th1s\_1s\_th3\_1st\_st4g3!!}
### Lineas de comandos (`cmdline`)
Lista las líneas de comandos completas utilizadas para ejecutar los procesos en un sistema
```bash
vol2 -f MemoryDump_Lab1.raw --profile=Win7SP1x64 cmdline
```
```bash
WinRAR.exe pid: 1512
Command line : "C:\\Program Files\\WinRAR\\WinRAR.exe" "C:\\Users\\Alissa Simpson\\Documents\\Important.rar"
************************************************************************
```
Vemos que `WinRAR.exe` esta abriendo el archivo `Important.rar`
## **4. Archivos en Memoria**
### **Busqueda de archivos (`filescan`)**
```bash
vol2 -f MemoryDump_Lab1.raw --profile=Win7SP1x64 filescan
```
```bash
Volatility Foundation Volatility Framework 2.6
0x000000003fa3ebc0 1 0 R--r-- \\Device\\HarddiskVolume2\\Users\\Alissa Simpson\\Documents\\Important.rar
0x000000003fac3bc0 1 0 R--r-- \\Device\\HarddiskVolume2\\Users\\Alissa Simpson\\Documents\\Important.rar
0x000000003fb48bc0 1 0 R--r-- \\Device\\HarddiskVolume2\\Users\\Alissa Simpson\\Documents\\Important.rar
```
### **Volcado del archivo (`dumpfiles`)**
```bash
vol2 -f MemoryDump_Lab1.raw --profile=Win7SP1x64 dumpfiles -Q 0x000000003fa3ebc0 -D ./dump
```
```bash
file dump/file.None.0xfffffa8001034450.dat
dump/file.None.0xfffffa8001034450.dat: RAR archive data, v5
```
Cambiamos la extensión a .rar ya que hemos confirmado que se trata de un archivo .rar
```bash
unrar l Important.rar
UNRAR 7.12 freeware Copyright (c) 1993-2025 Alexander Roshal
Archive comment:
Password is NTLM hash(in uppercase) of Alissa's account passwd.
Archive: Important.rar
Details: RAR 5
Attributes Size Date Time Name
----------- --------- ---------- ----- ----
* ..A.... 46045 2019-12-11 14:34 flag3.png
----------- --------- ---------- ----- ----
46045 1
```
Vemos que nos pide contraseña para extraer el contenido del rar
### **Extracción de Hashes de Contraseñas (`hashdump`)**
```bash
vol2 -f MemoryDump_Lab1.raw --profile=Win7SP1x64 hashdump
```
```bash
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SmartNet:1001:aad3b435b51404eeaad3b435b51404ee:4943abb39473a6f32c11301f4987e7e0:::
HomeGroupUser$:1002:aad3b435b51404eeaad3b435b51404ee:f0fc3d257814e08fea06e63c5762ebd5:::
Alissa Simpson:1003:aad3b435b51404eeaad3b435b51404ee:f4ff64c8baac57d22f22edc681055ba6:::
```
### **Crackeo de la contraseña**
Ahora si que sacamos la flag 3
> flag{w3ll\_3rd\_stage\_was\_easy}
## **5. Análisis Específico de Procesos**
### **Análisis de `mspaint.exe`** (2424)
```bash
vol2 -f MemoryDump_Lab1.raw --profile=Win7SP1x64 memdump -p 2424 -D dump/
```
#### **Análisis del dump**
Para analizar el dump de mspaint.exe usaremos GIMP