Write-up - Defcon-20-quals 2012 - Forensic 400

by @Jiss and @Jonathan Salwan - 2012-06-04

We download the file, and we unzip all.

$ gzip -d ./for400-411f6273d434317ccdb567a8e345eddc.gz
$ tar -xf for400-411f6273d434317ccdb567a8e345eddc
$ ls -l
total 2.1G
-rw-r--r-- 1 jonathan users 1.1G Jun  3 18:28 for400-411f6273d434317ccdb567a8e345eddc
-rw-r----- 1 jonathan users 1.0G May 28 09:06 memory.dmp
$

We now have a 'memory.dmp' file. So we use 'volatility' tool to extract some informations about this file.

First of all, let's see which type of dump it is:

$ vol.py imageinfo -f ./memory.dmp
Volatile Systems Volatility Framework 2.0
Determining profile based on KDBG search...

  Suggested Profile(s) : Win7SP1x86, Win7SP0x86
             AS Layer1 : JKIA32PagedMemoryPae (Kernel AS)
             AS Layer2 : FileAddressSpace (C:\Users\Jiss\defcon\for400\memory.dmp)
              PAE type : PAE
                   DTB : 0x185000
                  KDBG : 0x82948c28L

Let's list all the processes:

> vol.py pslist --profile=Win7SP1x86 -f ./memory.dmp
Volatile Systems Volatility Framework 2.0
 Offset(V)  Name                 PID    PPID   Thds   Hnds   Time 
---------- -------------------- ------ ------ ------ ------ ------------------- 
0x84138c40 System                    4      0     86    496 2012-05-28 02:31:14       
0x846ea308 smss.exe                244      4      2     29 2012-05-28 02:31:14       
[...]     
0x84945030 chrome.exe             3884   3440      6    126 2012-05-28 02:36:37       
0x8494dd40 rundll32.exe           3916   3440      2     84 2012-05-28 02:36:37       
0x8494ed40 chrome.exe             3924   3440      6    209 2012-05-28 02:36:37       
0x8495d508 chrome.exe             4004   3440      6    124 2012-05-28 02:36:41       
0x85716d40 thunderbird.ex         2372   2176     36    432 2012-05-28 02:47:24       
0x849e2540 gpg.exe                2804   2372      0 ------ 2012-05-28 02:50:29       
0x84a16168 gpg-connect-ag         3616   2372      0 ------ 2012-05-28 02:50:29       
0x84a25d40 gpg-agent.exe          4036   3128      1     72 2012-05-28 02:50:30       
0x848a8d40 gpg.exe                2360   2372      0 ------ 2012-05-28 02:54:56       
0x84a25030 gpg.exe                2464   2372      0 ------ 2012-05-28 02:54:56       
[...]    
0x84a22a38 pinentry.exe           3692   4036      0 ------ 2012-05-28 02:56:27       
0x849fb620 pinentry.exe           3868   4036      0 ------ 2012-05-28 02:56:30

We have two interesting processes, '2372' and '4036' (thunderbird & gpg-agent). So, wo dump the memory of this two process.

$ vol.py --profile=Win7SP1x86 -f ./memory.dmp -p 2372 memdump -D out/
Volatile Systems Volatility Framework 2.0
************************************************************************
Writing thunderbird.ex [  2372] to 2372.dmp

$ vol.py --profile=Win7SP1x86 -f ./memory.dmp -p 4036 memdump -D out/
Volatile Systems Volatility Framework 2.0
************************************************************************
Writing gpg-agent.exe [  4036] to 4036.dmp

Running a "strings" on the thunderbird memory dump reveals some interesting informations:

vulcan.ddtek@gmail.com
Poseidon ddtek <poseidon.ddtek@gmail.com>

If we grep "ddtek" we get something else:

"Poseidon (defcon ctf quals key) <poseidon.ddtek@gmail.com>"

Let's take a look:

jiss@fistouille:$ strings 2372.dmp | grep "Poseidon (defcon ctf quals key) <poseidon.ddtek@gmail.com>" -B 5

[GNUPG:] GOOD_PASSPHRASE
[GNUPG:] ENC_TO 21877E7CEC1B51DB 1 0
gpg: encrypted with RSA key, ID EC1B51DB
[GNUPG:] NO_SECKEY 21877E7CEC1B51DB
gpg: encrypted with 1024-bit RSA key, ID D7A51CC5, created 2012-05-26
"Poseidon (defcon ctf quals key) <poseidon.ddtek@gmail.com>"

Well, we have some informations concerning the key used to cipher some messages :). Now let's try to find those messages in gpg-agent memory dump, by searching PGP headers ("-----BEGIN PGP MESSAGE-----"). We get two different ones:

Ok right now, we have some messages ciphered and information concerning the private key. Let's inspect the initial memory.dmp, searching the string "(defcon ctf quals key)". We finally find this string among something which seems to be a binary blob. Let's dump this and take a look:

jiss@fistouille:$ file try_key.dmp 
try_key.dmp: PGP key security ring

Great !

jiss@fistouille:$ gpg --import try_key.dmp 
gpg: cle FB9C695E: cle secrete importee   (secret key!)
gpg: cle FB9C695E: cle publique " Poseidon (defcon ctf quals key) <poseidon.ddtek@gmail.com> " importee
gpg:        Quantite totale traitee: 1
gpg:                       importee: 1  (RSA: 1)
gpg:             cles secretes lues: 1
gpg:        cles secretes importees: 1

Let's decipher messages:

jiss@fistouille:$ for i in $(seq 1 2); do gpg --decrypt $i.txt ; done
* g o a t s e x * g o a t s e x * g o a t s e x *
g                                               g
o /     \             \            /    \       o
a|       |             \          |      |      a
t|       `.             |         |       :     t
s`        |             |        \|       |     s
e \       | /       /  \\\   --__ \\       :    e
x  \      \/   _--~~          ~--__| \     |    x
*   \      \_-~                    ~-_\    |    *
g    \_     \        _.--------.______\|   |    g
o      \     \______// _ ___ _ (_(__>  \   |    o
a       \   .  C ___)  ______ (_(____>  |  /    a
t       /\ |   C ____)/      \ (_____>  |_/     t
s      / /\|   C_____)       |  (___>   /  \    s
e     |   (   _C_____)\______/  // _/ /     \   e
x     |    \  |__   \\_________// (__/       |  x
*    | \    \____)   `----   --'             |  *
g    |  \_          ___\       /_          _/ | g
o   |              /    |     |  \            | o
a   |             |    /       \  \           | a
t   |          / /    |         |  \           |t
s   |         / /      \__/\___/    |          |s
e  |           /        |    |       |         |e
x  |          |         |    |       |         |x
* g o a t s e x * g o a t s e x * g o a t s e x *
the key is: as it turns out, Phil Zimmermann also likes sheep.

Well, the goatse ASCII-art might not be the validation key...

So, here it is: as it turns out, Phil Zimmermann also likes sheep.