BlackHat_MEA_CTF_Qualification_2024.md

BlackHat MEA CTF Qualification 2024

Challenge: Artifact (Easy)

Description

During the investigation of a compromised machine, it was discovered that an impersonation tool had been executed. The Digital Forensics and Incident Response (DFIR) team provided a specific registry hive for analysis. Your objective is to identify the name of the executable associated with the impersonation tool and determine its earliest suspected execution time.

Flag format/example: BHFlagY{cmd.exe_29/12/1992 22:33:13}

The provided file, named execution, was identified as:

execution: MS Windows registry file, NT/2000 or above

---

Steps to Solve

1. Inspect the Registry File:

   • Confirm the file type using a tool like file or similar utilities.
   • Ensure the file is accessible for analysis.

2. Choose the Analysis Tool:

   • Utilize RegRipper, a well-known tool for parsing Windows registry files.
   • Run RegRipper against the provided hive to extract registry keys and values.

3. Search for Executable Entries:

   • Search for .exe files in the output generated by RegRipper.
   • Review the extracted details for any executables associated with privilege escalation or impersonation tools.

4. Identify the Relevant Executable:

   • Spot the executable DeadPotato-NET4.exe, which is part of the well-known "Potato" family of privilege escalation exploits.
   • This entry is particularly significant because of its association with Windows privilege escalation attacks.

5. Determine the Execution Time:

   • Locate the timestamp for the earliest execution of the identified executable.
   • Align the findings with the flag format required for the challenge.

6. Generate the Flag:

   • Combine the executable name and timestamp into the flag format.
   • Final flag:

     BHFlagY{DeadPotato-NET4.exe_09/08/2024_22:42:13}
     

---

Observations

• The DeadPotato-NET4.exe was identified using RegRipper by parsing the registry file.
• The tool’s timestamp indicated the first suspected execution time, leading to the flag's generation.