We get a XP memory dump and a file that looks like garbage - g00ds
Running histogram on goods shows its likely encrypted.
$ strings WinXP.vmem | grep g00ds
.png)
Looks like g00ds existed on the same machine this memory dump was from.
$strings WinXP.vmem | grep truecrypt
.png)
Guessing that we need to find the TC passphrase in memory to mount and decrypt g00ds.
Fire up volshell and take a look at the running processes (assuming WinXPSP3x86)
Really the only interesting thing running is TC, so we're hopefully on the right path.
Theres a known way of finding a TC passphrase if you have a memory dump, so lets just try that.
Convert DriverStart to hex > B24A9000
>>> db(0xB24A9000, 0x35000)
Scroll up a bit...
Excellent...this is the passphrase...use it to mount the container.
Mounts cleanly.
AHO NAO!
More details on this process can be found here.
See you all in Detroit!
No comments:
Post a Comment