← Back to Writeups
CUSTOMMediumForensics
Bookmark

Some Kind

XESXOR9/2/20265 min read
#forensics#custom#medium#aes128_cbc_decryption#chained_byte_transform_reversa#container_mounting#memory_artifact_correlation#password_reuse_cracking#truecrypt_container_identifica

Some Kind

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-03-31 | Status: Solved Techniques: aes128_cbc_decryption, chained_byte_transform_reversal, container_mounting, memory_artifact_correlation, password_reuse_cracking, truecrypt_container_identification

Summary

Task: a ZIP archive contained a VM memory dump, an Edge profile, an unknown encrypted blob, and a small data artifact. Solution: correlate browser and RAM traces to identify TrueCrypt, open the hidden volume, recover the AES key and IV from secretiki.txt, then reverse the hinted sub/xor chain before AES-CBC decryption.

Some Kind — HackerLab

Description

The challenge provided some_kind.zip with several mixed forensic artifacts rather than one obvious target file. The goal was to pivot across memory, browser, image, and encrypted-container evidence until the final 32-byte blob could be decoded into the flag.

Brief Challenge Summary

The archive some_kind.zip contained three key starting points:

  • zip_kakoeto.vmem — a VM memory dump
  • Edge_Default.zip — an Edge browser profile
  • moya_prelest — an unlabeled high-entropy blob ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Browser traces and memory artifacts pointed to TrueCrypt usage, while recovered images contained explicit hints about a three-step transform chain. After opening the TrueCrypt volume, secretiki.txt revealed the AES key and IV, and the 32-byte payload from maybe_data.txt decrypted to the final flag.

Reconnaissance / Artifact Analysis

The fastest path was to treat the challenge as a correlation problem instead of trying to brute-force a single file in isolation.

1. Archive contents

Initial triage of some_kind.zip showed a classic “many artifacts, one story” layout: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

  • zip_kakoeto.vmem
  • Edge_Default.zip
  • moya_prelest

The memory dump and browser profile suggested user activity reconstruction, while moya_prelest looked like an encrypted container because it had high entropy and no useful plain-text structure.

2. Browser and memory clues

The Edge profile and memory image both contained evidence of TrueCrypt:

  • browser history referenced truecrypt.org
  • memory artifacts showed TrueCrypt-related execution
  • memory strings referenced C:\Users\Oleg\Desktop\moya_prelest
  • memory strings also referenced E:\secretiki.txt ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

That combination mattered a lot:

  • moya_prelest was likely not random junk, but a mounted or mountable encrypted volume
  • secretiki.txt likely existed inside that mounted volume
  • the challenge was probably designed around recovering a password and opening the container rather than carving raw bytes from RAM alone

3. Image hints

Recovered image artifacts contained the transformation hints needed later:

  • my_mood.jpg → sub 0x34
  • brain.png → xor 0x99
  • wtf_btw.png → AES

The numbering in the clues gave the intended order: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

  1. sub 0x34
  2. xor 0x99
  3. AES

At this point the likely interpretation was: some payload must be transformed with two byte-wise operations before AES decryption produces the flag.

How TrueCrypt Was Identified and Cracked

moya_prelest became the main target because all surrounding evidence pointed to an encrypted container:

  • Edge activity referenced TrueCrypt
  • RAM contained TrueCrypt traces
  • the blob was high-entropy and unlabeled
  • memory referenced a file that looked like content from a mounted volume: E:\secretiki.txt ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Conceptually, the cracking workflow was:

  1. recognize moya_prelest as a TrueCrypt volume candidate
  2. test or crack the volume password with TrueCrypt-compatible tooling
  3. verify the candidate by actually opening the volume

The correct password was:

 text 
iloveyou

Once that password worked, the hypothesis was confirmed: moya_prelest was indeed the TrueCrypt volume used in the challenge.

How the Decrypted Volume Was Mounted / Extracted

After obtaining the password, the next step was straightforward in concept: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

  1. open or mount moya_prelest as a TrueCrypt volume
  2. access the filesystem exposed by the decrypted container
  3. extract the interesting file from the mounted content

The important recovered file was:

 text 
secretiki.txt

This file contained two 16-byte hex strings, which turned out to be the AES material:

  • key: 3FA39E9C4664ED9FA00D315EEFA2909C
  • iv: 523C191DDA966C7A1C01BD32F16039DB

Combining secretiki.txt and maybe_data.txt

Another artifact, maybe_data.txt, contained a 32-byte value written as a comma-separated hex list: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 text 
0xa6,0x62,0x54,0xa5,0x3e,0x30,0x82,0xdb,0xa5,0x13,0x75,0xed,0x4a,0xdb,0x3d,0xa4,
0x6e,0xa0,0x31,0x93,0x94,0x71,0xf0,0x45,0x91,0x8b,0x9c,0xd9,0x93,0x08,0x67,0x99

That length is exactly two AES blocks, so it was a natural candidate for ciphertext. The full recovery path was therefore:

  • recover AES key and IV from secretiki.txt
  • parse the 32 bytes from maybe_data.txt
  • apply the ordered byte transforms from the image hints
  • decrypt the result with AES-CBC

Exact Transformation and AES Logic

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The order was important. Starting from the raw 32 bytes from maybe_data.txt:

  1. subtract 0x34 from each byte modulo 256
  2. XOR the result with 0x99
  3. decrypt the transformed bytes with AES-CBC using the recovered key and IV
  4. remove PKCS#7 padding

In Python terms:

 python 
#!/usr/bin/env python3
from Crypto.Cipher import AES

data = bytes([
    0xa6, 0x62, 0x54, 0xa5, 0x3e, 0x30, 0x82, 0xdb,
    0xa5, 0x13, 0x75, 0xed, 0x4a, 0xdb, 0x3d, 0xa4,
    0x6e, 0xa0, 0x31, 0x93, 0x94, 0x71, 0xf0, 0x45,
    0x91, 0x8b, 0x9c, 0xd9, 0x93, 0x08, 0x67, 0x99,
])
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

key = bytes.fromhex("3FA39E9C4664ED9FA00D315EEFA2909C")
iv = bytes.fromhex("523C191DDA966C7A1C01BD32F16039DB")

# Step 1: sub 0x34
stage1 = bytes((b - 0x34) & 0xff for b in data)

# Step 2: xor 0x99
stage2 = bytes(b ^ 0x99 for b in stage1)

# Step 3: AES-CBC decrypt
pt = AES.new(key, AES.MODE_CBC, iv).decrypt(stage2)

# PKCS#7 unpad
pad = pt[-1]
flag = pt[:-pad].decode()

print(flag)

Output:

 text 
CODEBY{REDACTED}

Solution

The challenge is easiest if solved as a chain of dependent facts:

  1. triage the archive and identify memory, browser, and encrypted-container artifacts
  2. use browser history and RAM traces to recognize TrueCrypt activity
  3. treat moya_prelest as a TrueCrypt volume and open it with password iloveyou
  4. extract secretiki.txt from the decrypted volume
  5. take the key and IV from secretiki.txt
  6. parse the 32-byte payload from maybe_data.txt
  7. follow the image-provided order: sub 0x34 → xor 0x99 → AES
  8. decrypt and unpad the result to obtain the flag ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍