Locked Secrets — Flagyard Forensics CTF Walkthrough

Goal: Unlocking BitLocker with a GPP Password

Challenge Description

Step 1: Analyze the Triage Image

We were given a triage image containing user artifacts and a BitLocker-encrypted E01 file, we need the passsword that is in the triage image to unlock it.

After some navigation under ‘triage image’, i found this under
..\LockedSecrets\triageimage\E\Users\Administrator\AppData\Roaming\
Microsoft\Windows\Recent\

LNK files that lead to Groups; Group policy; the flag; and the BitLocker Recovery Keys (but the last ones revealed nothing for me).

I checked the properties of the ‘Groups.LNK’ file:

Groups.LNK properties & the location of Groups.xml file

Destination = C:\Windows\SYSVOL\domain\Policies\{F6E536A8–76F2–4111-A113-C19D882367AF}\Machine\Preferences\Groups
I decided to further with that file, this is why:

Why Check Groups.xml?

Groups.xml is a Group Policy Preference (GPP) file used in Active Directory environments to manage local user accounts across domain-joined machines.

Why Attackers Abuse It

• When administrators use GPP to set local account passwords, the password is stored in the cPassword attribute.
• Microsoft encrypts it using AES-256-CBC, but the encryption key is publicly known and hardcoded in Windows.
• This means anyone with the encrypted string can decrypt it using readily available tools (gpp-decrypt).

Step 2: verify the location and extract the cPassword

As we saw, the key file was:

C:\Windows\SYSVOL\domain\Policies\{F6E536A8-76F2-4111-A113-C19D882367AF}\Machine\Preferences\Groups\Groups.xml

Contents of Groups.xml:

<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}">
  <User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" 
       name="SM" 
       image="0" 
       changed="2024-09-06 12:12:55" 
       uid="{E4073160-0C87-4FCE-9ED1-0C890558E45E}">
    <Properties action="C" 
                fullName="mr.shosho" 
                description="" 
                cpassword="Xpk4DyKDjYQQ/EUHClHlP+m6AKRQL5cC+JABNiw5C9aUMrmXIH2Mkky4a8tKUxIq" 
                changeLogon="1" 
                noChange="0" 
                neverExpires="0" 
                acctDisabled="0" 
                userName="SM"/>
  </User>
</Groups>

Step 3: Decrypt the cPassword

Group Policy Preferences (GPP) store passwords in the cPassword field using AES-256-CBC with a static key. This makes them easily decryptable.

Get Slender-man’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

inside kali linux:

gpp-decrypt "Xpk4DyKDjYQQ/EUHClHlP+m6AKRQL5cC+JABNiw5C9aUMrmXIH2Mkky4a8tKUxIq"

Output:

Passw0rd123!@Meme

Step 4: Unlock the BitLocker Drive & get the flag

On windows, using FTK Imager, i mounted the bitlocker_drive.E01 file, the new partition will show up under ‘this computer’:

When trying to open it, a windows like this will show up:

Enter the password, open the partition again, you’ll find the ‘the flag.txt’ file.