Ищейка (Bloodhound)

Platform: duckerz | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: memory_dump_analysis, string_extraction

Summary

Task: Analyze a vmem memory dump to find a hidden flag. Solution: Used strings and grep to extract readable strings and search for the flag format, finding it in plaintext.

Ищейка (Bloodhound) — duckerz CTF

Description

Мы допрашиваем подозреваемого в шпионаже, но он не говорит куда спрятал флаг. Может в его компьютере остались какие-то данные? Формат флага: PolyCTF{...}.

Translation: We are interrogating a suspect in espionage, but he won't tell us where he hid the flag. Maybe there's some data left on his computer?

Files: bloodhound.zip (357MB) → bloodhound.vmem (1GB)

Analysis

Received an archive with a .vmem file — this is a virtual machine memory dump (Virtual Machine Memory). Such files are created by hypervisors (VMware, VirtualBox) and contain a complete snapshot of the guest OS RAM. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The task name "Ищейка" (Bloodhound) and the filename hint at searching for data. Given the "easy" category and 100 points, the flag is most likely stored in memory in plaintext.

Strategy: Start simple — extract all readable strings and search for the flag using the known format.

Solution

Step 1: Extracting the archive

 bash read-only • copy allowed Copy
unzip bloodhound.zip
# Result: bloodhound.vmem (1GB)

Step 2: Extracting strings and searching for the flag

 bash read-only • copy allowed Copy
strings bloodhound.vmem | grep -oE "PolyCTF\{[^}]+\}"

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Result:

PolyCTF{REDACTED}

Flag found instantly! No complex tools required.

Flag Analysis

The flag contains a hint about the solution method (leetspeak):

• 534RcH → SEARCH
• 57R1N6 → STRING
• 1N51d3 → INSIDE
• Vm3m → VMEM

Full message: "SEARCH STRING INSIDE VMEM" — exactly what we did!

Alternative Approaches

For more complex memory dump tasks, you can use:

 bash read-only • copy allowed Copy
# Volatility 3 — professional memory analysis tool
vol3 -f bloodhound.vmem windows.info
vol3 -f bloodhound.vmem windows.pslist
vol3 -f bloodhound.vmem windows.filescan
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Volatility 2 (for older images)
volatility -f bloodhound.vmem imageinfo
volatility -f bloodhound.vmem --profile=Win10x64 pslist

But in this case, simple strings | grep was sufficient.

Tools

Lessons

1. Start simple — before running heavy tools, try strings | grep
2. Flag format is key — knowing the format allows quick flag discovery in large data volumes
3. Read the hints — task and file names often contain hints
4. Memory dumps = goldmine — memory can store passwords, keys, flags in plaintext ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍