Дед Мороз забыл пароль (forgot_password)

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2025-12-26 | Status: Solved Techniques: File system forensics with 7z, NTFS partition analysis, User profile investigation, VMDK disk image extraction

Summary

Task: VMware VM image with Windows 10 guest OS. Solution: Extract NTFS partition from VMDK using 7z, then locate flag file on user desktop without booting the VM.

Дед Мороз забыл пароль — hackerlab

Description

Ой-ой, где же мой пароль?! Как же теперь я посмотрю, кто ждёт подарка...

Files: forgot_password.zip (12.5 GB)

Analysis

The archive contains a VMware virtual machine:

• task_forens.ovf — OVF description (Windows 10 64-bit)
• task_forens-disk1.vmdk — disk image (7.9 GB)
• task_forens-file1.iso — ISO file
• task_forens-file2.nvram — NVRAM

Despite the task name ("forgot password"), the real objective is to extract data from the disk image without booting the VM. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Analyzing VMDK structure

 bash read-only • copy allowed Copy
7z l task_forens-disk1.vmdk

Output shows partitions:

• EFI system partition
• Microsoft reserved partition
• Basic data partition.img — main Windows NTFS partition

Step 2: Extracting NTFS partition

 bash read-only • copy allowed Copy
7z x task_forens-disk1.vmdk "Basic data partition.img" -y

Step 3: Investigating user profiles

 bash read-only • copy allowed Copy
7z l "Basic data partition.img" | grep "Users/"

Found user: vanya_hacker_2011

Step 4: Searching desktop files

 bash read-only • copy allowed Copy
7z l "Basic data partition.img" | grep "Users/vanya_hacker_2011/Desktop"

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Found file: ny.txt

Step 5: Extracting the flag

 bash read-only • copy allowed Copy
7z x "Basic data partition.img" "Users/vanya_hacker_2011/Desktop/ny.txt" -y
cat "Users/vanya_hacker_2011/Desktop/ny.txt"

Notes

• 7z can work with VMDK directly, extracting partitions as .img files
• NTFS images can also be processed through 7z
• The task name ("forgot password") is a red herring — Windows password cracking is not required
• User vanya_hacker_2011 — typical username for hackerlab CTF tasks ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍