Rating:
We were given a memory dump, a dwarf file and a system map. https://drive.google.com/drive/folders/1c6vdBabGu33edSLXQZY5s8JAeM8au8Uo?usp=sharing
The dwarf and system map can be zipped and put in the folder `volatility/plugins/overlays/linux/` to create a profile. The name of the created profile can be checked with `python2 vol.py --info | grep Profile` and in my case, it was Linuxphillipx64.
We can view the bash hisory using the command `python2 vol.py --profile=Linuxphillipx64 -f ../philip-1.raw linux_bash`, which outputs the following:
```
Pid Name Command Time Command
-------- -------------------- ------------------------------ -------
1534 bash 2021-04-03 03:18:46 UTC+0000 clear
1534 bash 2021-04-03 03:19:19 UTC+0000 scp -i key -P 5001 ./super-secret-flag [email protected]:~/
1534 bash 2021-04-14 22:11:37 UTC+0000 ssh -i key [email protected] -p 5001
```
We can see, that to get the flag, we can ssh, but we need the key file. RSA private keys can be found with memdump.py. https://github.com/Crapworks/pentest/blob/master/memdump.py
The command `python2 memdump.py philip-1.raw` outputs the following:
```
[*] Modul: privatekey [ 14 items ]
[+] offset: 0x12688000 - length: 1678
[+] offset: 0x3f4f4740 - length: 1211
[+] offset: 0x420ef998 - length: 88807105
[+] offset: 0x49c9f978 - length: 55832087
[+] offset: 0x49c9f998 - length: 55832055
[+] offset: 0x475a10d8 - length: 96720567
[+] offset: 0x09cc4197 - length: 144458999
[+] offset: 0x3f4f4d20 - length: 46115477
[+] offset: 0x3602fcf8 - length: 155995907
[+] offset: 0x09cc5417 - length: 144454263
[+] offset: 0x3602fb18 - length: 155996387
[+] offset: 0x475a12b8 - length: 96720087
[+] offset: 0x09cc41bc - length: 144458962
[+] offset: 0x420ef958 - length: 88807169
```
These are all possible keys. We can check them with `hexdump -C -s offset -n length philip-1.raw` and the first one shows promise. We can extract it with `dd bs=1 skip=308838400 count=1678 if=philip-1.raw of=key`. (0x12688000 = 308838400)
On most linux machines, we have to change the key file permissions for ssh to allow to use it. That can be accomplished with the command `chmod 600 key`.
Now we can ssh with the command `ssh -i key [email protected] -p 5001` and get the file `super-secret-flag` from there. The file contains `VU1EQ1RGLXtHNGxsNGdoM3JfNF8xaWYzfQ==`, which can be decoded from base64 to get the flag `UMDCTF-{G4ll4gh3r_4_1if3}`.
