forensicshard
Colonel
tamuctf
Task: 8GB Linux memory dump with AES-CBC encrypted flag file, known IV but unknown key. Solution: Extract kernel module key validation error logs showing two failed key attempts with different incorrect character indices, reconstruct correct 32-byte AES-256 key by combining correct characters from both attempts.
$ ls tags/ techniques/
memory_forensicskernel_log_analysiskey_reconstructionaes_decryption
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub, then upgrade to Pro.
$ssh [email protected]