DEV Community

Cover image for Management Wants a Word - TryHackMe Write-up (Hacker Holidays Day 14)
Mohammad ali
Mohammad ali

Posted on

Management Wants a Word - TryHackMe Write-up (Hacker Holidays Day 14)

#ai #webdev #programming #productivity

In this write-up, we will walk through the digital forensics and incident response (DFIR) steps to solve the Management Wants a Word challenge from TryHackMe's Hacker Holidays.

1. Initial Setup and Reconnaissance

First, we navigate to the challenge directory and inspect the files extracted via KAPE:

cd management-wants-a-word-forensics-hh-day-14
cd KAPE
Enter fullscreen mode Exit fullscreen mode

Identify the suspicious backup file type and inspect its header:

file C/Users/vera/Documents/backup
xxd -l 64 C/Users/vera/Documents/backup
Enter fullscreen mode Exit fullscreen mode

Search for sensitive Google Chrome browser artifacts belonging to the user vera:

find C/Users/vera -type f \( -iname "Login Data" -o -iname "Local State" -o -iname "Web Data" -o -iname "History" \)
Enter fullscreen mode Exit fullscreen mode

2. Extracting Windows Secrets & DPAPI Masterkey

Extract the Windows registry hives to retrieve system security data:

impacket-secretsdump -sam C/Windows/System32/config/SAM -system C/Windows/System32/config/SYSTEM -security C/Windows/System32/config/SECURITY LOCAL
Enter fullscreen mode Exit fullscreen mode

Decrypt the user's DPAPI Masterkey using the account password (minivera):

impacket-dpapi masterkey -file 'C/Users/vera/AppData/Roaming/Microsoft/Protect/S-1-5-21-2529683458-431225740-1723070931-1000/c90719ef-5b98-474e-b934-136d606a702a' -sid 'S-1-5-21-2529683458-431225740-1723070931-1000' -password 'minivera'
Enter fullscreen mode Exit fullscreen mode

Store the resulting masterkey value in a shell variable:

MASTERKEY='5e5715ec9b6df5a86e97902692a66d28e691f05d5bc1e04d0159cfe960e94c978c07e5004a0179d3a96df2468885a28175b0b02cc064445f116a752d2b3e9d40'
Enter fullscreen mode Exit fullscreen mode

3. Decrypting the Chrome AES Key

Locate the Local State file path and extract the encrypted key:

LOCAL_STATE="$(find "$PWD/C/Users/vera" -type f -iname 'Local State' -print -quit)"
Enter fullscreen mode Exit fullscreen mode 


echo $LOCAL_STATE
Enter fullscreen mode Exit fullscreen mode 


printf '%s\n' "$LOCAL_STATE"
Enter fullscreen mode Exit fullscreen mode 


jq -r '.os_crypt.encrypted_key' "$LOCAL_STATE" | base64 -d | xxd
Enter fullscreen mode Exit fullscreen mode 


jq -r '.os_crypt.encrypted_key' "$LOCAL_STATE" | base64 -d | tail -c +6 > chrome-key.dpapi
Enter fullscreen mode Exit fullscreen mode

Run a Python script to decrypt the Chrome key using the Masterkey:

python3 - "$MASTERKEY" <<'PY'
import sys
from impacket.dpapi import DPAPI_BLOB
masterkey = bytes.fromhex(sys.argv[1])
with open("chrome-key.dpapi", "rb") as f:
    blob = DPAPI_BLOB(f.read())
decrypted = blob.decrypt(masterkey)
if decrypted is None:
    raise SystemExit("DPAPI decryption failed")
with open("chrome-aes.key", "wb") as f:
    f.write(decrypted)
print(f"Wrote {len(decrypted)} bytes")
print(f"Chrome AES key: {decrypted.hex()}")
PY
Enter fullscreen mode Exit fullscreen mode

..................

wc -c chrome-aes.key
Enter fullscreen mode Exit fullscreen mode

................

............

  1. Extracting Saved Credentials

Find the Login Data SQLite database and run a script to decrypt stored passwords using AES-GCM:
................

LOGIN_DATA="$(find "$PWD/C/Users/vera" -type f -iname 'Login Data' -print -quit)"
Enter fullscreen mode Exit fullscreen mode


.................

printf '%s\n' "$LOGIN_DATA"
Enter fullscreen mode Exit fullscreen mode


.............

file "$LOGIN_DATA"
Enter fullscreen mode Exit fullscreen mode


...........

python3 - "$LOGIN_DATA" ./chrome-aes.key <<'PY'
import sqlite3
import sys
from pathlib import Path
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
database = Path(sys.argv[1]).resolve()
keyfile = Path(sys.argv[2]).resolve()
if not database.is_file():
    raise SystemExit(f"Missing database: {database}")
key = keyfile.read_bytes()
if len(key) != 32:
    raise SystemExit(f"Unexpected AES key length: {len(key)}")
db = sqlite3.connect(database.as_uri() + "?mode=ro", uri=True)
for url, username, encrypted in db.execute("""
    SELECT origin_url, username_value, password_value
    FROM logins
"""):
    if not encrypted:
        continue
    try:
        iv = encrypted
        payload = encrypted[15:]
        aesgcm = AESGCM(key)
        decrypted = aesgcm.decrypt(iv, payload, None)
        password = decrypted.decode('utf-8')
    except Exception as e:
        password = f"[Decryption Failed: {e}]"
    print(f"URL: {url}")
    print(f"Username: {username}")
    print(f"Password: {password}")
    print("-" * 40)
PY
Enter fullscreen mode Exit fullscreen mode


..........

  1. Mounting the VeraCrypt Container

Open the VeraCrypt encrypted backup container, create a mount point, and mount it in read-only mode:

sudo cryptsetup tcryptOpen \ --veracrypt \ 'C/Users/vera/Documents/backup' \ vera_backup
Enter fullscreen mode Exit fullscreen mode 


password : Wh4t1sV3raD0ing0nTh1sH0st
Enter fullscreen mode Exit fullscreen mode

.........

sudo mkdir -p /mnt/vera
Enter fullscreen mode Exit fullscreen mode


.............

sudo mount -o ro /dev/mapper/vera_backup /mnt/vera
Enter fullscreen mode Exit fullscreen mode


...............

List the container contents and navigate to the financial documents:

ls /mnt/vera
ls /mnt/vera/secret_financial_documents
Enter fullscreen mode Exit fullscreen mode

..................
Open the target invoice PDF file to retrieve the flag:

xdg-open /mnt/vera/secret_financial_documents/important_invoice_byte_lotus.pdf
Enter fullscreen mode Exit fullscreen mode

Flag:
THM{---------_---_AL0ng?!}

6. Cleanup

Safely unmount the filesystem and close the encrypted device:
..................

cd ~
Enter fullscreen mode Exit fullscreen mode


................

sudo fuser -km /mnt/vera
Enter fullscreen mode Exit fullscreen mode


........................

sudo umount /mnt/vera
Enter fullscreen mode Exit fullscreen mode


.........................

sudo cryptsetup close vera_backup
Enter fullscreen mode Exit fullscreen mode

.........................

Top comments (0)