Task description
Jacky has learnt about the importance of strong passwords and made sure to encrypt the BitLocker drive with a very long and complex password. We managed to capture the RAM while this drive was opened however. See if you can break through the encryption!
Approach 1: The flag in cleartext
The first approach is based on the fact that we have a RAM dump, and therefore the flag will probably be available in plaintext. This approach is most likely not the intended approach, but something to try to potentially reap some low-hanging fruit.
First we need to extract the RAM dump with gunzip memdump.mem.gz. Then we can use the strings command to print all plaintext strings in the file, combined with grep to only see strings that follow the format of the flag: strings memdump.mem | grep “picoCTF”.
That was easy! The flag is picoCTF{B1tl0ck3r_dr1v3_d3crypt3d_9029ae5b}.
Approach 2: Using Volatility
In the second approach, we use Volatility. Before getting started, I recommend using Volatility 2 with the this plugin for BitLocker.
Identifying the profile
First, we need to identify the profile for the operating system. This can be done with the command python2 vol.py -f </path/to/memdump.mem> imageinfo. This identified the profile as “Win10x64_19041”.
Extracting the FVEKs
Since the memory capture was done while the machine was running, the FVEK (Full Volume Encryption Key) should be stored in plaintext in the memory dump. To extract the FVEK, we need to use the aforementioned plugin.
Get ColdByte’s stories in your inbox
Join Medium for free to get updates from this writer.
Run the following command to extract the FVEK: python2 vol.py --plugins </path/to/installed/plugin> -f </path/to/memdump.mem> --profile=Win10x64_19041 bitlocker </path/to/putput/folder>.
This will result in many .fvek files being saved in the specified output folder. As I understand it, it is impossible to know which one is correct. Therefore, we have to test them until we get one without an error message.
Finding the correct FVEK
To find which key is correct, we can use the following command: sudo dislocker -V </path/to/bitlocker-2.dd> -k </path/to/.fvek-file> -- /mnt/dislocker. Then we use hexdump to check if it contains a NTFS signature: sudo hexdump -C /mnt/dislocker/dislocker-file | head. If not, sudo umount /mnt/dislocker 2>/dev/null and repeat. If it contains the NTFS signature, this is the correct key!
Eventually I got to 0x8087865bead0-Dislocker.fvek. When I checked the hexdump for this FVEK file, I saw the NTFS signature:
This means that 0x8087865bead0-Dislocker.fvek is the correct key.
Mounting and finding the flag
First, we create the folder in which the decrypted content will be stored with sudo mkdir -p /mnt/decrypted. The next step now is just to mount and retrieve the flag: sudo mount -t ntfs-3g /mnt/dislocker/dislocker-file /mnt/decrypted.
After mounting, we can simply run cd /mnt/decrypted and we will be able to retrieve the flag:
The flag is: picoCTF{B1tl0ck3r_dr1v3_d3crypt3d_9029ae5b}
Clean-up
It’s always smart to clean-up after working with potentially malicious files. First, move out of the /mnt/ directory, then run the following commands:
- sudo umount /mnt/decrypted
- sudo umount /mnt/dislocker
- sudo rmdir /mnt/decrypted
- sudo rmdir /mnt/dislocker
That’s it! Thanks for reading!
