---
# System prepended metadata

title: This-file-hides-something

---

# This-file-hides-something

## Challenge Description

There is an emergency regarding this file. We need to extract the password ASAP. It's a crash dump, but our tools are not working. Please help us, time is not on our side.

PS: Flag format is not standard.

[Challenge File](https://api.cyberedu.ro/v1/contest/dctf21/challenge/bf7cde20-89b7-11ec-b6ba-fdc8d6daa06e/download/2001)

## Writeup

- We are given with a ``elf`` file . We need to extract the memory image out of it and analyse with ``volatility`` .
-  We're interested into the first LOAD section, that's where main memory reference is. We can get the correct offset using objdump
 ![](https://i.imgur.com/LvAIFRp.png)
 
- This section contains the RAM information we care about. We remove the bytes we don’t need
- So memory dump is in crashdump.elf, starting at offset 0x25d0 and counting 0x80000000 bytes
- Now let's extract the RAM
![](https://i.imgur.com/mC4bSRJ.png)

- we use volatility to determine the image profile
![](https://i.imgur.com/0Snr1he.png)

- Using hasdump plugin we got the ntlm hash of the password and tried to crack it using crackstation but couldn't get the password 
![](https://i.imgur.com/ypA30RT.png)
![](https://i.imgur.com/JVUnpba.png)

- So using mimikatz plugin we were able to get the password(Mimikatz is a plugin that pulls plain-text passwords out)
![](https://i.imgur.com/xC9Arql.png)

- password : ```Str0ngAsAR0ck! ```

## Flag

**Str0ngAsAR0ck!**






