Какой-то DMP...

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2025-12-26 | Status: Solved Techniques: minidump_analysis, password_protected_archive, string_extraction

Summary

Task: Windows minidump file and password-protected RAR archive. Solution: Extract strings from minidump to find flag-like string that serves as RAR password, then extract archive to get the real flag.

Какой-то DMP... - HackerLab

Description

Мне тут знакомый скинул файл и попросил посмотреть. А я знать не знаю, что с этим делать :)

Files:

• task.zip contains:
  • csrss.DMP - Windows Mini DuMP crash report file
  • maybe_hint.rar - Password-protected RAR archive

Analysis

Step 1: File Identification

 bash read-only • copy allowed Copy
$ file csrss.DMP
csrss.DMP: Mini DuMP crash report, 16 streams, Sat Dec 21 09:15:23 2024, 0x0 type

$ file maybe_hint.rar
maybe_hint.rar: RAR archive data, v5

Minidump is a Windows memory dump format containing process information at the moment of crash. The RAR archive is password-protected. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 2: Extracting Strings from Minidump

 bash read-only • copy allowed Copy
$ strings csrss.DMP | head -50

Interesting findings:

• Path: C:\Users\Oleg\Desktop\csrss.exe
• User: Oleg, computer: OLEG-PC
• Decoy string: Th1s_i$_R2eal_sEcrER_str (red herring)
• Suspicious string: C0DEBY{Da_ladn0_snOv@} (with zero instead of O)

Step 3: Analyzing Found Strings

The string C0DEBY{Da_ladn0_snOv@} looks like a flag, but:

• Uses C0DEBY (with zero) instead of CODEBY
• This is not the real flag, but the password for the RAR archive ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 4: Extracting the RAR Archive

 bash read-only • copy allowed Copy
$ 7z x maybe_hint.rar -p"C0DEBY{Da_ladn0_snOv@}"
# or
$ unrar x -p"C0DEBY{Da_ladn0_snOv@}" maybe_hint.rar

This extracts flag.txt containing the real flag.

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Solution for "Какой-то DMP..." - HackerLab Forensics
"""
import subprocess
import re

# Extract strings from minidump
result = subprocess.run(['strings', 'csrss.DMP'], capture_output=True, text=True)
strings_output = result.stdout

# Search for flag-like patterns
flag_pattern = re.compile(r'C[O0]DEBY\{[^}]+\}', re.IGNORECASE)
matches = flag_pattern.findall(strings_output)
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

print("Found patterns:")
for match in matches:
    print(f"  {match}")

# Password for RAR: C0DEBY{Da_ladn0_snOv@}
password = "C0DEBY{Da_ladn0_snOv@}"

# Extract RAR
subprocess.run(['7z', 'x', '-y', f'-p{password}', 'maybe_hint.rar'])

# Read flag
with open('flag.txt', 'r') as f:
    flag = f.read().strip()
    print(f"\nFlag: {flag}")

Notes

1. Misdirection: The string C0DEBY{Da_ladn0_snOv@} is deliberately similar to a flag but uses 0 instead of O - it's a password, not the flag
2. Red herring: The string Th1s_i$_R2eal_sEcrER_str is a distraction
3. Minidump analysis: For deeper analysis you can use:
   • volatility - memory analysis framework
   • minidump Python library
   • WinDbg for Windows ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Alternative Tools

 bash read-only • copy allowed Copy
# Using grep to search for patterns
strings csrss.DMP | grep -iE 'codeby|c0deby|flag|password'

# Using Python minidump library
pip install minidump
python -c "from minidump.minidumpfile import MinidumpFile; print(MinidumpFile.parse('csrss.DMP'))"

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍