aaron/htb-santa-ctf
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

add progress so far

Browse Source
This commit is contained in:
aaron
2021-12-03 17:27:35 +01:00
parent 07bdcd4f73
commit 65dc05b735
2 changed files with 18 additions and 132392 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
forensics/persist/README.md Normal file
View File

@@ -0,0 +1,18 @@
# Persist
Although Santa just updated his infra, problems still occur. He keeps
complaining about slow boot time and a blue window popping up for a split
second during startup. The IT elves support suggested that he should restart
his computer. Ah, classic IT support!
Download Link: http://46.101.25.140/forensics_persist.zip
## Flag
## Progress so far
- The zip file contains ä windows memory dump
- As the intro text states the boot time is slow and blue windows pop up. This might be ä Powershell reverse shell.
- So it is probably reasonable to check the windows autostart and the accoring registry keys
- I was not able to find anything as of yet
- Probably the `autostarts` plugin for `volatility2` would help. But I'm using version 3 and the plugin is not compatible.

132392
forensics/persist/test
View File

File diff suppressed because it is too large Load Diff