Memory Forensics (TryHackMe)
Category: Digital Forensics and Incident Response (DFIR) | Difficulty: Easy
Memory Forensics (TryHackMe)
Category: Digital Forensics and Incident Response (DFIR) | Difficulty: Easy
**OS Distro Utilized:** Kali Linux (Debian)
Objective: Perform memory forensics to find the flags.
Note: Block comments that begin with “#” are added for context and are not considered to be entered via Command-Line Interface (CLI).
Task 1
Perform memory forensics to find the flags. If you are having trouble, maybe check out the Volatility room first.
Link to walkthrough: https://tryhackme.com/room/volatility
Before getting started
It is encouraged to learn from the volatility walkthrough for familiarity. Also, researching different approaches using different versions of volatility is highly recommended.
Note: While going through tasks 2–4, there were a few nuances to overcome in order to solve each task. Some approaches involved leveraging between Volatility and Volatility 3; however, it is likely that the task files are 1) memory captures from an unsupported OS and 2) requiring specific plugins for Volatility that are not included nor supported once installed.
Below are some commands performed before getting started:
# Download latest updates and or new packages from software repositories.
sudo apt-get update# Clone a copy of the current Git Repository for Volatility.
git clone https://github.com/volatilityfoundation/volatility.git# List plugins for Volatility.
sudo python2 vol.py -h
List of failed and available plugins for Volatility
# Install pip3 for installing and managing Python 3 packages.
sudo apt install python3-pip# Clone a copy of the current Git Repository for Volatility 3.
git clone https://github.com/volatilityfoundation/volatility3.git# List plugins for Volatility 3.
sudo python3 vol.py -h
List of available plugins for Volatility 3
Task 2
The forensic investigator on-site has performed the initial forensic analysis of John’s computer and handed you the memory dump he generated on the computer. As the secondary forensic investigator, it is up to you to find all the required information in the memory dump.
# Required dependency for the windows.registry.hashdump.Hashdump plugin for Volatility 3.
pip3 install pycryptodomeAnswer: charmander999
Method 1: Volatility 3, John the Ripper
# Determine if the .vmem file is a Linux/UNIX OS.
python3 vol.py -f <filename>.vmem linux.info# Determine if the .vmem file is a Windows OS which is then confirmed to be a Windows 7 OS.
python3 vol.py -f <filename>.vmem windows.info
Windows 7 Service Pack 1
# Leverage the hashdump plugin to identify the hashes for users.
python3 vol.py -f <filename>.vmem windows.registry.hashdump.Hashdump
NTLM Hashes
# Save output of the hashdumps within a text file based on preferred directory path for password cracking.
python3 vol.py -f <filename>.vmem windows.registry.hashdump.Hashdump > <file path/name of file with hashdumps>.txt# Before leveraging a password cracking tool, edit the file using a CLI text to modify the formatting of the output.
vi <name of file with hashdumps>.txt
# Once in a CLI text editor, enter "i" for insert to edit the text file.
NTLM hashes dumped within a .txt file
# After editing the text file, enter the "Esc" tab to escape insert mode then enter ":wq" to save then quit out of vi.
Formatted NTLM hashes and user accounts within the .txt file
# Leveraging John the Ripper, one of many password cracking tools, to crack the extracted hashes. The rockyout.txt file is utilized since it contains a list of common passwords.
john --format=NT <name of modified file with hashdumps>.txt --wordlist=/usr/share/wordlists/rockyou.txt
# Once the hash for user John has been cracked, it will reveal the password.Method 2 for Password Cracking:
CrackStation Website
Cracked NTLM Hash
Task 3
On arrival a picture was taken of the suspect’s machine, on it, you could see that John had a command prompt window open. The picture wasn’t very clear, sadly, and you could not see what John was doing in the command prompt window.
To complete your forensic timeline, you should also have a look at what other information you can find, when was the last time John turned off his computer?
Answer 1: 2020–12–27 22:50:12
Method for Answer 1: Volatility 3
# List plugins for Volatility 3 that begins with windows.
python3 vol.py | grep windows. | more
# The suggested plugin is windows.registry.printkey to identify a specific subkey involving a shutdowntime for the machine.# Leverage the windows.registry.printkey plugin to identify the ShutdownTime within the ContrSet001 subkey which is considered (in most cases) the last known activity for the machine.
python3 vol.py -f <filename>.vmem windows.registry.printkey --key "ControlSet001\\Control\\Windows"
Identified Shutdown Time for the Windows 7 Machine
Answer 2: You_found_me
Method for Answer 2: Volatility
# List plugins for Volatility.
python2 vol.py -h
# The suggested plugin is imageinfo in order to identify then utilize the OS profile to view the commands that the user performed within the Command Prompt.# Leverage imageinfo plugin to identify the OS profile for Windows.
python2 vol.py -f <filename>.vmem imageinfo# Once the profile has been identified, reference the profile for Win7SP1x64 (Windows 7 Service Pack) and specify the plugin for console to review all inputs from the Command Prompt.
python2 vol.py -f <filename>.vmem --profile=Win7SP1x64 consoles
Observed flag using consoles plugin
Method 2 for Answer 2: Volatility
# Aside from the consoles plugin, the cmdscan plugin is an alternative to list all entered commands from the command prompt.
python2 vol.py -f <filename>.vmem --profile=Win7SP1x64 cmdscan
Observed flag using cmdscan plugin
Task 4
A common task of forensic investigators is looking for hidden partitions and encrypted files, as suspicion arose when TrueCrypt was found on the suspect’s machine and an encrypted partition was found. The interrogation did not yield any success in getting the passphrase from the suspect; however, it may be present in the memory dump obtained from the suspect’s computer.
Answer: forgetmenot
Method: Volatility 3
# List plugins for Volatility 3 that begins with windows.
python3 vol.py -h | grep windows. | more
# The suggested plugin is windows.truecrypt to reveal the passphrase for TrueCrypt.# Before performing the commands with the suggested plugin, the truecrypt.py script requires adjustments in order for the plugin to identify the passphrase within the memory dump.
cd /volatility3/framework/plugins/windows# Any text editor would suffice; however, gedit is utilized to narrow down to lines 89-82.
gedit truecrypt.py &
Lines 80–82
# Modify the specific lines and include the following as shown below for line 80 then save the script.
Line 80
# Leverage the suggested plugin after modiyfing the script to reveal the passphrase for TrueCrypt.
python3 vol.py -f <filename>.vmem windows.truecrypt
Passphrase for TrueCrypt
References:
[embed]Memory Forensics Perform memory forensics to find the flagstryhackme.com
[embed]
메타데이터
- post_id
- 436edbcdef30
- slug
- memory-forensics-tryhackme-436edbcdef30
- url
- https://medium.com/@pac443/memory-forensics-tryhackme-436edbcdef30
- canonical_url
- https://medium.com/@pac443/memory-forensics-tryhackme-436edbcdef30
- author_url
- https://medium.com/@pac443
- status
- ok
- fetched_at
- 2026-06-23 03:48:11
