DEV Community

Cover image for Management Wants a Word: TryHackMe Forensics Writeup
Md. Ibrahim Reza Rabbi
Md. Ibrahim Reza Rabbi

Posted on

Management Wants a Word: TryHackMe Forensics Writeup

#forensics #windows #cryptography #tryhackme

Challenge Goal

We are given a Windows KAPE triage collection from a laptop used by a guest named Vera. The goal is to follow the forensic artifacts, recover a hidden password, use it to open what Vera was hiding, and recover the flag.

Flag format starts with:

THM{
Enter fullscreen mode Exit fullscreen mode

Initial Enumeration

After extracting the task files, the main directory contained a KAPE collection:

Get-ChildItem -Force
Enter fullscreen mode Exit fullscreen mode

Important paths:

KAPE\C\Users\vera\
KAPE\C\Users\vera\Documents\backup
KAPE\C\Users\vera\AppData\Local\Google\Chrome For Testing\User Data\
KAPE\C\Windows\System32\config\SAM
KAPE\C\Windows\System32\config\SYSTEM
KAPE\C\Windows\System32\config\SECURITY
Enter fullscreen mode Exit fullscreen mode

The file Documents\backup had no extension and looked like random data when viewed in hex. This is a strong hint for an encrypted container.

Clue From The Story

The social media clue says:

a browser will remember things for you
not every hidden file needs a password cracker
version number 1.26.29
Enter fullscreen mode Exit fullscreen mode

That points to two things:

Browser saved credentials
VeraCrypt 1.26.29
Enter fullscreen mode Exit fullscreen mode

So the plan became:

  1. Check Chrome artifacts.
  2. Recover the saved browser password.
  3. Use that password on the suspicious backup file.
  4. Extract the hidden content and find the flag.

Chrome History

The Chrome history database was here:

KAPE\C\Users\vera\AppData\Local\Google\Chrome For Testing\User Data\Default\History
Enter fullscreen mode Exit fullscreen mode

Using SQLite:

sqlite3 "KAPE\C\Users\vera\AppData\Local\Google\Chrome For Testing\User Data\Default\History" ".tables"
Enter fullscreen mode Exit fullscreen mode

Then query visited URLs:

select datetime(last_visit_time/1000000-11644473600,'unixepoch') as last_visit,
       url,
       title
from urls
order by last_visit_time;
Enter fullscreen mode Exit fullscreen mode

Interesting result:

http://bytelotus.thm:8080/login
http://bytelotus.thm:8080/
SecureVault Portal
Enter fullscreen mode Exit fullscreen mode

So Vera used a portal called SecureVault.

Chrome Saved Login

The saved login database was here:

KAPE\C\Users\vera\AppData\Local\Google\Chrome For Testing\User Data\Default\Login Data
Enter fullscreen mode Exit fullscreen mode

Query:

select origin_url, action_url, username_value, hex(password_value)
from logins;
Enter fullscreen mode Exit fullscreen mode

Result:

origin_url: http://bytelotus.thm:8080/
username: VeraSecretVault
password_value: encrypted Chrome v10 blob
Enter fullscreen mode Exit fullscreen mode

Chrome passwords are encrypted with Windows DPAPI, so we need Vera’s DPAPI material.

Recover Windows/DPAPI Secret

The KAPE collection included Windows registry hives:

SAM
SYSTEM
SECURITY
Enter fullscreen mode Exit fullscreen mode

Using pypykatz, the offline registry secrets revealed:

LSA Default Password
Username: UNKNOWN
Password: minivera
Enter fullscreen mode Exit fullscreen mode

This password was important because it allowed decrypting Vera’s DPAPI masterkey.

Vera’s DPAPI masterkey folder:

KAPE\C\Users\vera\AppData\Roaming\Microsoft\Protect\S-1-5-21-2529683458-431225740-1723070931-1000
Enter fullscreen mode Exit fullscreen mode

The Chrome Local State file contained the encrypted Chrome key:

KAPE\C\Users\vera\AppData\Local\Google\Chrome For Testing\User Data\Local State
Enter fullscreen mode Exit fullscreen mode

After decrypting the DPAPI masterkey with minivera, the Chrome saved password decrypted to:

Wh4t1sV3raD0inG0nTh1sH0st
Enter fullscreen mode Exit fullscreen mode

Opening The Hidden Container

The suspicious file was:

KAPE\C\Users\vera\Documents\backup
Enter fullscreen mode Exit fullscreen mode

It had no signature and looked fully random. Combined with the 1.26.29 clue, this indicated a VeraCrypt container.

Use the recovered password:

Wh4t1sV3raD0inG0nTh1sH0st
Enter fullscreen mode Exit fullscreen mode

Open or mount the file with VeraCrypt.

Once opened, the container contained:

secret_financial_documents\
important_invoice_byte_lotus.pdf
transactions_q3.csv
Enter fullscreen mode Exit fullscreen mode

Finding The Flag

The CSV was not the flag. The PDF looked like an invoice, but it was image-based, so normal text extraction may return nothing.

Render or open the PDF visually. The invoice contains a line item with the flag:

Flag: THM{1t_w4s_****_A11_*******}
Enter fullscreen mode Exit fullscreen mode

Final Answer

THM{1t_w4s_****_A11_*******}
Enter fullscreen mode Exit fullscreen mode

Key Takeaways

Chrome saved credentials can be recovered from triage data if the DPAPI masterkey can be decrypted.

The SECURITY, SAM, and SYSTEM hives are extremely valuable in Windows forensics.

A file with no extension and random-looking bytes may be an encrypted container.

The clue 1.26.29 was the giveaway for VeraCrypt.

Official VeraCrypt format reference: https://veracrypt.io/en/VeraCrypt%20Volume%20Format%20Specification.html

Top comments (0)