Oleg's Secrets

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2026-04-05 | Status: Solved Techniques: artifact_triage, clue_extraction_from_image, keepass_database_extraction, nested_archive_analysis, ocr_assisted_password_recovery

Summary

Task: a ZIP archive contained VMware memory artifacts and a nested Windows user profile with a KeePass database. Solution: inspect the profile, recover a password hint from an image with OCR, correct the OCR mistakes, then open the KDBX and read the stored flag entry.

Oleg's Secrets — HackerLab

Description

Organizer description was not preserved in the working directory.

English summary: the archive contained VMware snapshot artifacts and a nested Windows user profile. The goal was to identify where Oleg stored secrets, recover the KeePass password, and extract the final flag.

Brief Challenge Summary

The main archive task_oleg.zip contained three notable files:

• task.vmem
• task.vmsn
• Oleg.zip

The decisive path was not full memory forensics, but artifact triage inside the nested Windows profile. On the Desktop and in Downloads there was a KeePass database my_passwords.kdbx, plus tt.zip containing the same database and a clue image bg.png. OCR on that image revealed an almost-correct password string; after fixing the OCR mistakes, the database opened and exposed the flag entry directly. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Reconnaissance

1. Inspect the outer archive

Start by listing the contents of the downloaded task archive:

 bash read-only • copy allowed Copy
$ unzip -l task_oleg.zip

The important top-level artifacts were:

• task.vmem — VMware memory dump
• task.vmsn — VMware snapshot metadata
• Oleg.zip — nested archive with a Windows user profile

That layout strongly suggests a user-activity reconstruction challenge: RAM and snapshot files provide context, while the profile archive preserves the files the user actually interacted with. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. Inspect the nested Windows profile

After extracting Oleg.zip, the most interesting paths were:

• Oleg/Desktop/my_passwords.kdbx
• Oleg/Downloads/tt.zip
• Oleg/Desktop/flag.txt.txt — empty decoy
• Oleg/AppData/Local/Temp/keepassxc-Oleg.lock

The KeePass lock file was the strongest indicator that the .kdbx database had been opened recently on this machine.

Browser artifacts added more context:

• Edge history contained searches about where to keep flags and passwords
• visits to KeePassXC download pages were present
• visits to transfiles.ru/q44gy were also present ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This made my_passwords.kdbx the primary target.

3. Check the Downloads archive

The file Oleg/Downloads/tt.zip contained:

• my_passwords.kdbx
• bg.png

The my_passwords.kdbx file inside tt.zip had the same hash as the Desktop copy, so it was the same database duplicated in two places. That usually means the second file in the archive is the real hint.

Analysis

4. Recover the password clue from the image

The image bg.png contained text rendered on the wallpaper. OCR with Tesseract produced: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 text read-only • copy allowed Copy
S2pER_P@$$_fOR_k22p@sS$

Example OCR command:

 bash read-only • copy allowed Copy
$ tesseract bg.png stdout

This string was very close, but not fully correct. The actual valid KeePass password was:

 text read-only • copy allowed Copy
S2pER_P@$$_f0R_k22p@sS

Two OCR mistakes had to be corrected:

• fOR → f0R (letter O misread instead of zero)
• trailing $ removed

This is a common CTF pattern when text is embedded in an image: OCR gives a near-match, but visually similar characters still need manual verification.

5. Open the KeePass database

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Once the corrected password was identified, the database could be opened with pykeepass.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pykeepass import PyKeePass

kp = PyKeePass("my_passwords.kdbx", password="S2pER_P@$$_f0R_k22p@sS")

for entry in kp.entries:
    print(f"title={entry.title!r} user={entry.username!r} password={entry.password!r}")

The database contained a single useful entry:

• title: FLAG
• user: Oleg
• password: CODEBY{REDACTED}

Solution

1. Download and extract task_oleg.zip.
2. Notice the combination of VMware snapshot files and nested Oleg.zip.
3. Extract Oleg.zip and inspect Desktop, Downloads, Temp, and browser artifacts.
4. Prioritize my_passwords.kdbx because of the matching KeePassXC lock file and browser history.
5. Extract tt.zip and inspect bg.png as the likely password hint.
6. Run OCR on bg.png and manually correct the small OCR mistakes.
7. Open my_passwords.kdbx with the corrected password.
8. Read the FLAG entry and recover the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Minimal command flow

 bash read-only • copy allowed Copy
$ unzip -l task_oleg.zip
$ unzip -l Oleg.zip
$ unzip -l tt.zip
$ tesseract bg.png stdout

Full working solve script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pykeepass import PyKeePass

db_path = "my_passwords.kdbx"
password = "S2pER_P@$$_f0R_k22p@sS"

kp = PyKeePass(db_path, password=password)

flag_entry = next((e for e in kp.entries if e.title == "FLAG"), None)
if not flag_entry:
    raise SystemExit("FLAG entry not found")

print(flag_entry.password)

Expected output: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 text read-only • copy allowed Copy
CODEBY{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍