SHOW:
|
|
- or go back to the newest paste.
| 1 | - | Stuck with the cybercrime challenge 2013 (0x7dd) - You found out that Vultura is there but now it's harder? |
| 1 | + | Stuck with the cybercrime challenge 2013 (0x7dd) - You found out that Vultura is behind H4ck3nb3rg. |
| 2 | Miss M is using the same password for truecrypt, but now you came to question 11. | |
| 3 | And 11 is incredible hard. | |
| 4 | ||
| 5 | - | Did you get the answer of the BOT in the channel? |
| 5 | + | |
| 6 | - | You noticed this is a base64 encoded string but if you decode it you get all garbage. |
| 6 | + | |
| 7 | First you are going to need a linux machine. If you don't have one, you need to setup a virtual server. Download either Ubuntu or Fedora and install those on your Virtual Server. You don't need any fancy configuration for it. Just make sure you get the crypto file and the memory.raw file on this Linux machine. | |
| 8 | - | This is were crypto comes in place, but for crypto to work you need a password. |
| 8 | + | |
| 9 | - | The password is encrypted in the memory.raw, to retrieve it you need some difficult tools like volatilitux. In order for volatilitux to work you need to create a profile which can be hard. |
| 9 | + | Now back to question 11, did you found that special bot in the channel? If you talked to you it gave you a encoded string back. This string needs to be decoded, thats were the crypto files come in handy. |
| 10 | This file is a Linux executable and it's able to decode the text of this bot. | |
| 11 | - | The answer of question 11 is not found on the internet because it changes constantly. |
| 11 | + | |
| 12 | The password is encrypted in the memory.raw, to retrieve it you need some difficult tools like Volatilitux. To understand and setup Volatilitux can be hard. The answer to question 11 changes constantly as well, so you will not find it on the internet. | |
| 13 | - | Therefor I made the following perl script that can decrypt it successfully for you |
| 13 | + | |
| 14 | Thats why I created a script to decode that string for you, the program below will scan the memory.raw and find the password in there. | |
| 15 | - | You need to go the directory where you have placed the file 'crypto' and 'memory.raw' |
| 15 | + | |
| 16 | - | And run the following command: |
| 16 | + | So login in your Linux machine, and if you have a graphical interface search for something like "Terminal" in the menu's. If you click on that you will get... well a terminal. |
| 17 | ||
| 18 | - | SEARCHIN=memory.raw |
| 18 | + | "cd" to the directory where you have placed crypto and memory.raw and execute the following command: |
| 19 | - | CRYPTOFILE=crypto |
| 19 | + | |
| 20 | perl -e "$(echo -n 'QlpoOTFBWSZTWe9xM1QAATWfgFx14d8q+/8EP+/fqzABazNkGqehACabUGTENDQGQ0DTajQDSZRiYhQ8p+oBNAwQwACek9QSSTJok/VPTCmammj0gyAAGIBpAmmtYGJ42Jw9wkE5hQTM5mlBY3N6aXakfm4Yn+51eYHEWyyBYw9/Axy0ItgbD+vqygk9u1shA+TndZ0nZMJj+GqsZovSekZ2A0sjUyDRjc2t1McOzthY2avvmWP9+/R9JcXYP8k2ZrdZetNpkgyTN5xBcqn8TJoI+vXBihcc1VTz4rDbag6uCRmMLHUCJyAjyWjCLA9aIQyym8rAFziO8Fq+S+QRpYqynoRcAeZ2lliIDcFvgIiIfTBuHe0GH5SYqQ+ykbN75mYwYFlq33EpEEUPtqAzdSdwx5agKROshXRGi6W6N5OKds8hKpi0IVuvosiTmpgjuSbehZvowjPiQ/FEIwHMJm4CWUDuHSrlxTTTJUSKbMtThWCvVNZiBPZ+0G6cxQdQrBCseJEkqjW9RqFcIm4PVKqMb6Q4nAILW1PWvGRGBr/xdyRThQkO9xM1QA==' | base64 -d | bzip2 -d)" | |
| 21 | ||
| 22 | Make sure the whole perl line is on one line ! | |
| 23 | ||
| 24 | - | This perl line will search for a specific string in the memory and use crypto to decrypt it and run it directory through base64 decoding so you can read the message. |
| 24 | + | This perl line will search for a specific string in the memory and use crypto to decrypt it and run it directly through base64 decoding so you can read the message. |
| 25 | ||
| 26 | Hope you solve question 11 with this !. |