Oleg's Secrets

hackerlab

Task: a ZIP archive contained VMware memory artifacts and a nested Windows user profile with a KeePass database. Solution: inspect the profile, recover a password hint from an image with OCR, correct the OCR mistakes, then open the KDBX and read the stored flag entry.

ocr browser_history vmware_snapshot windows_profile keepassxc kdbx nested_zip

artifact_triageclue_extraction_from_imagekeepass_database_extractionnested_archive_analysisocr_assisted_password_recovery

$ ls tags/ techniques/

ocr browser_history vmware_snapshot windows_profile keepassxc kdbx nested_zip

artifact_triageclue_extraction_from_imagekeepass_database_extractionnested_archive_analysisocr_assisted_password_recovery

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ grep --similar

Similar writeups

[forensics][Pro]Oleg— duckerz
[forensics][Pro]Самосаботаж (Self-Sabotage)— duckerz
[forensics][Pro]Какой-то DMP...— hackerlab
[forensics][Pro]The flag is visible outside the windows— hackerlab
[forensics][Pro]Some Kind— hackerlab