Try   HackMD

2020 Defenit CTF - What Browser do I use

tags: forensics

whysw@PLUS

Attachments

Challenge

Find the version of the hacker's default browser!

Solution

Find default browser

using FTK imager, found
/Users/secre/NTUSER.DAT

using registry viewer, found that
/Software/Microsoft/Windows/Shell/Associations/UrlAssociations/http/UserChoice/ProgId
is ChromeHTML.


Find the version of Chrome

using FTK imager, found
/Program Files (x86)/Google/Chrome/Application/83.0.4103.61 folder.

send 83.0.4103.61 to server and got the flag.

FLAG : Defenit{Th1s_15_Chr0m3_Br0w53r!!}