# 1FA Guy**Category: Forensics**> https://drive.google.com/file/d/1tFys7Hh8kRtdMdPa5XDbzJz55sBxmvFw/view?usp=sharing
> We have obtained these files from a Hacker's computer known as 1FAGuy. Can you find the password of their C&C?
The download link was a compressed `AppData` folder. We can see the programs the user has installed from the folder contents:```$ ls AppData/*AppData/Local: Adaware  'Application Data'   ConnectedDevicesPlatform   DBG   Google   History   Lavasoft   Microsoft   Microsoft_Corporation   Mozilla   Packages   PeerDistRepub   Programs   Temp  'Temporary Internet Files'
AppData/LocalLow:BitTorrent  Microsoft  Mozilla
AppData/Roaming:Adobe  BitTorrent  DMCache  IDM  Lavasoft  Microsoft  Mozilla  Notepad++  WinRAR```
Considering we know we are looking for a password, the result is probably stored in a web browser's folder.
Using [HackBrowserData](https://github.com/moonD4rk/HackBrowserData) we can extract the information.
## Extracting Google Chrome Data
```./hack-browser-data -b chrome -p ../ctf/2021/securebug-odin/forensics/1FAGuy/AppData/Local/Google/Chrome/User\ Data/Default -k ../ctf/2021/securebug-odin/forensics/1FAGuy/AppData/Local/Google/Chrome/User\ Data/Local\ State[x]:  Get 1 download history, filename is results/chrome_download.csv[x]:  Get 1 passwords, filename is results/chrome_password.csv[x]:  Get 0 credit cards, filename is results/chrome_credit.csv[x]:  Get 4 bookmarks, filename is results/chrome_bookmark.csv[x]:  Get 6 cookies, filename is results/chrome_cookie.csv[x]:  Get 10 history, filename is results/chrome_history.csv```
Let's take a look at that passwords file:
```$ cat results/chrome_password.csvUserName,Password,LoginUrl,CreateDateCybercriminal,,https://secure.ssa.gov/RIL/SiView.action,2021-03-29T23:10:34.598548Z```
There's a username, but the password could not be decrypted. We can look at the browser history to see if it has anything interesting.
```$ cat results/chrome_history.csvTitle,Url,VisitCount,LastVisitTimeGoogle,https://www.google.com/,4,2021-03-29T23:11:10.166353Zgoogle - Google Search,https://www.google.com/search?q=google&source=hp&ei=gl5iYPHkKeSBi-gPsrec0Ak&iflsig=AINFCbYAAAAAYGJskpjbRoPB0LnxUF7lFSgq4fYqDXq7&oq=google&gs_lcp=Cgdnd3Mtd2l6EAMyCAgAELEDEIMBMggIABCxAxCDATIFCAAQsQMyBQgAELEDMgUIABCxAzICCAAyAggAMgUIABCxAzIICAAQsQMQgwEyAggAOgsILhCxAxDHARCjAjoICC4QsQMQgwFQpiJYmi9ghzRoAHAAeACAAUaIAdkCkgEBNpgBAKABAaoBB2d3cy13aXo&sclient=gws-wiz&ved=0ahUKEwjxrfb0z9bvAhXkwAIHHbIbB5oQ4dUDCAc&uact=5,2,2021-03-29T23:11:08.043081ZCentral Intelligence Agency - CIA,https://www.cia.gov/,2,2021-03-29T23:09:15.383984ZSocial Security,https://secure.ssa.gov/RIL/SiView.action,2,2021-03-29T23:10:25.915648Zhow to buy winrar - Google Search,https://www.google.com/search?q=how+to+buy+winrar&source=hp&ei=i15iYKjmFojqkgXj-JjgCw&iflsig=AINFCbYAAAAAYGJsm8wyZkZWUfa9d985F8fqZyy8lAIV&oq=how+to+buy+winrar&gs_lcp=Cgdnd3Mtd2l6EAMyAggAMgIIADICCAAyAggAMgIIADIFCAAQhgMyBQgAEIYDMgUIABCGAzoICAAQ6gIQjwE6BQgAELEDOggIABCxAxCDAToLCC4QsQMQxwEQowI6DgguELEDEIMBEMcBEKMCOgUILhCxAzoCCC5Q7g5YlTpgikJoAXAAeACAAVWIAeIHkgECMTeYAQCgAQGqAQdnd3Mtd2l6sAEK&sclient=gws-wiz&ved=0ahUKEwjo14j5z9bvAhUItaQKHWM8BrwQ4dUDCAc&uact=5,2,2021-03-29T23:11:20.015101ZCentral Intelligence Agency - CIA,https://www.cia.gov/index.html,1,2021-03-29T23:09:13.442216ZSocial Security,https://secure.ssa.gov/RIL/Si.action,1,2021-03-29T23:10:25.915648ZCentral Intelligence Agency - CIA,http://cia.gov/,1,2021-03-29T23:09:13.442216ZWinRAR and RAR buy site,https://www.rarlab.com/shop2rarlab-index.php?prod=winrar&x-source=winraronly,1,2021-03-29T23:11:21.845056Z"WinRAR archiver, a powerful tool to process RAR and ZIP files",https://www.rarlab.com/download.htm,1,2021-03-29T23:11:26.869327Z```
This guy really wants to buy WinRAR! This is looking like a red herring, let's move on.
## Extracting Firefox DataThe extract tool was not recovering a password file for Firefox. I ran it in verbose mode to check why:```$ ./hack-browser-data -b firefox -p ../ctf/2021/securebug-odin/forensics/1FAGuy/AppData/Roaming/Mozilla/Firefox/Profiles/pwbmg6f4.default-release/ -vvbrowser.go:205: debug Firefox find bookmark file successbrowser.go:205: debug Firefox find cookie file successbrowser.go:205: debug Firefox find history file successbrowser.go:195: debug Firefox find password file failed, ERR:find logins.json failed```
Looking in the folder it was talking about, `logins.json` was missing, but `login.json` was present. Renaming the file fixed the extraction.
```$ ./hack-browser-data -b firefox -p ../ctf/2021/securebug-odin/forensics/1FAGuy/AppData/Roaming/Mozilla/Firefox/Profiles/pwbmg6f4.default-release/[x]:  Get 13 bookmarks, filename is results/firefox_bookmark.csv[x]:  Get 0 cookies, filename is results/firefox_cookie.csv[x]:  Get 11 history, filename is results/firefox_history.csv[x]:  Get 1 passwords, filename is results/firefox_password.csv```
```$ cat results/firefox_password.csvUserName,Password,LoginUrl,CreateDateadmin,SBCTF{MuL71_f4C70R_4U7H3N71C4710n_70_7h3_r35cU3},,2021-03-29T19:14:38-04:00```
`SBCTF{MuL71_f4C70R_4U7H3N71C4710n_70_7h3_r35cU3}`