Whoami - Baby

Home
BelkaCTF #7 | Next →

Challenge

Whoami.png

Task

Let’s go! Grab the RAM dump of the ATC tower terminal exhibiting weird behavior. First, let’s identify the artifact.

What is the username and hostname of the imaged machine?
Format: user@hostname

Tools

Solution

Intro

In this task we are given BelkaCTF_7_CASE250722_KTSAERO.mem. The challenge is more of a test of whether you know how to deal with the source of the info at all. What we actually have is a dump of the RAM of a compromised terminal. The main tools that you would use for forensic analysis of a RAM dump are MemProcFS and Volatility3. For this task I will stick to MemProcFS.

Names

MemProcFS very conveniently stores important sys variables like that in the sys dir so we can just cat them.

❯ cat sys/users/users.txt
   # Username                         SID                                       
-----------------------------------------                                       
0000 award                            S-1-5-21-3557345689-3593742580-873049707-1001
❯ cat sys/computername.txt
TSO-ATC-CT412

We only have one user so we don't even have to guess, the answer is award@TSO-ATC-CT412