← Back to Writeups
CUSTOMMediumForensics
Bookmark

Koloboki

XESXOR9/2/20264 min read
#forensics#custom#medium#browser_artifact_recovery#memory_triage#remote_artifact_retrieval#url_pivoting#visual_hidden_text_extraction#windows

Koloboki

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2026-04-05 | Status: Solved Techniques: browser_artifact_recovery, memory_triage, remote_artifact_retrieval, url_pivoting, visual_hidden_text_extraction

Summary

Task: investigate a Windows memory dump and determine why an image matters in the case. Solution: recover browsing artifacts from memory, pivot from a Pastebin URL to a MEGA-hosted PNG, then rotate and inspect the image edge to read the hidden flag text.

Koloboki — HackerLab

Description

User-provided translated organizer summary: it was a koloboki investigation; why would we get a picture from a memory dump; do not make unnecessary noise.

English summary: the archive contained a large VMware memory dump, kolobki_task.vmem. The flag was not stored as plain text in memory. Instead, the dump preserved browser artifacts that led to an external image, and the final flag was hidden visually on that image.

Analysis

The challenge is a forensic pivot chain rather than a direct memory-only extraction. The useful path was: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

memory dump -> browser history / cached web artifacts -> Pastebin -> MEGA image -> rotated edge text

Initial plain-text flag searches in the dump failed, so the next step was normal Windows memory triage.

volatility3 identified the image as Windows 7 SP1 x64. Process listing showed several iexplore.exe processes, which strongly suggested that web browsing activity was relevant. File scanning also revealed many paths under Temporary Internet Files, especially image-related entries, confirming that Internet Explorer activity was preserved in the dump. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

At that point the goal became extracting browsing traces rather than hunting the flag string directly. URL and string extraction from memory revealed a visited page:

 text 
https://pastebin.com/vh3xQiy5

Opening that Pastebin page led to a MEGA link for an image file:

 text 
https://mega.nz/file/xNwwiLbK#rZs91jyGmoCuJYj6BTE8YN6sqKTq-zi-1si4_7IMVVc

Downloading the file produced kolobki.png.

Basic PNG container checks were clean: only normal IHDR, pHYs, IDAT, and IEND chunks were present; there were no extra chunks, no trailing payload, and no obvious metadata-based steganography. Simple string and LSB-style checks also did not immediately reveal the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The real trick was visual. The right edge of the image contained a very faint vertical text overlay, similar to a watermark or low-contrast margin note. Cropping that narrow strip, rotating it, and increasing contrast made the text readable. The user manually confirmed the exact final flag value.

Solution

1. Download and extract the evidence

 bash 
aria2c -x 16 -s 16 -k 1M "https://hackerlab.pro/game_api/files/download?folder=parts_0d7934a7-27ae-4504-9f2b-b2cbe147c4f1_data&name=task&type=zip"
unzip task.zip

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This yields the main artifact:

 text 
kolobki_task.vmem

2. Perform memory triage

Start with the usual quick checks:

 bash 
strings -a kolobki_task.vmem | grep 'CODEBY{' 
python3 vol.py -f kolobki_task.vmem windows.info
python3 vol.py -f kolobki_task.vmem windows.pslist
python3 vol.py -f kolobki_task.vmem windows.filescan
strings -a kolobki_task.vmem | grep -E 'https?://|pastebin|mega'

Important findings:

  • direct plain-text flag search failed
  • OS: Windows 7 SP1 x64
  • multiple iexplore.exe processes were running
  • Internet Explorer cache/file artifacts were visible
  • memory strings exposed a visited Pastebin URL ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Pivot from memory to the external artifact

Recovered URL:

 text 
https://pastebin.com/vh3xQiy5

That page contained the MEGA link:

 text 
https://mega.nz/file/xNwwiLbK#rZs91jyGmoCuJYj6BTE8YN6sqKTq-zi-1si4_7IMVVc

After downloading the image, the investigation moved from memory forensics to image inspection.

4. Check the PNG for standard stego/container tricks

The PNG itself was structurally normal:

  • no suspicious ancillary chunks
  • no appended data after IEND
  • no useful metadata payload
  • no immediate hit from simple string extraction or basic LSB checks ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This is the point where visual examination matters more than container analysis.

5. Extract the hidden text from the image edge

The rightmost strip of kolobki.png contains barely visible vertical text. Crop a narrow band from the right side, rotate it, and boost visibility.

Example helper script:

 python 
#!/usr/bin/env python3
from PIL import Image, ImageOps, ImageEnhance

img = Image.open("kolobki.png").convert("RGB")
w, h = img.size

# Crop a narrow strip from the right edge
strip = img.crop((w - 80, 0, w, h))
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Rotate so the vertical text becomes horizontal
rot = strip.rotate(90, expand=True)

# Improve readability
gray = ImageOps.grayscale(rot)
gray = ImageOps.autocontrast(gray)
gray = ImageEnhance.Contrast(gray).enhance(3.0)

gray.save("kolobki_edge_rotated.png")
print("Saved kolobki_edge_rotated.png")

After rotating and examining the strip, the hidden text becomes readable as the flag. Per the user's confirmed result, the canonical flag is:

 text 
CODEBY{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍