## Memory 4### Tags: Memory Forensics, Volatility, Memory Dump, Registry, Subkey, Key, Value, Hive, Windows 7
I didn't do the previous Memory challenge because it was solved by another teammate.
[Volatility](https://github.com/volatilityfoundation/volatility) is a great tool for memory forensics, it has many modules and commands to explore a memory dump. You should experiment with it if you're just starting in forensics territory. The `imageinfo` command, which spits out the probable OS of the memory dump, gave us info that this is a Windows 7 64-bit. So we're using `Win7SP1x64` profile from now on.
This challenge is pretty tricky, the only clue it gave us only```Since i'm a geek, i hide my secrets in weird places```That's it. In a computer, where do geeks hid their secrets? It's a pretty vague, I didn't have any clue on what to do. So I see what might a geek do in their computer. Several failed attempts, I discovered a `printkey` command on Volatility. I naively use the command by entering:```python vol.py -f ../../FWord/foren.raw --profile=Win7SP1x64 printkey```
This command outputs every registry entered to the system and its subkeys. So it printed out all the registry.
```...Registry: \Device\HarddiskVolume1\Boot\BCDKey name: NewStoreRoot (S)Last updated: 2020-08-26 09:10:18 UTC+0000
Subkeys:  (S) Description  (S) Objects
Values:----------------------------Registry: \??\C:\Users\SBA_AK\ntuser.datKey name: CMI-CreateHive{D43B12B8-09B5-40DB-B4F6-F6DFEB78DAEC} (S)Last updated: 2020-08-26 09:11:20 UTC+0000
Subkeys:  (S) AppEvents  (S) Console  (S) Control Panel  (S) Environment  (S) EUDC  (S) FLAG  (S) Identities  (S) Keyboard Layout  (S) Network  (S) Printers  (S) Software  (S) System  (V) Volatile Environment
Values:----------------------------Registry: \??\C:\Users\SBA_AK\AppData\Local\Microsoft\Windows\UsrClass.dat...```
One particular registry has a FLAG subkey which obviously interesting. So I ran `hivelist` command to get the virtual offset of the registry location to print the subkey value:```python vol.py -f ../../FWord/foren.raw --profile=Win7SP1x64 hivelist``````...0xfffff8a0014da410 0x00000000275c0410 \SystemRoot\System32\Config\SAM0xfffff8a0033fe410 0x0000000069de6410 \??\C:\Users\SBA_AK\ntuser.dat0xfffff8a0036e7010 0x0000000069188010 \??\C:\Users\SBA_AK\AppData\Local\Microsoft\Windows\UsrClass.dat0xfffff8a0038fe280 0x0000000068390280 \??\C:\System Volume Information\Syscache.hve...```
Now to print the flag:```python vol.py -f ../../FWord/foren.raw --profile=Win7SP1x64 printkey -o 0xfffff8a0033fe410 -K 'FLAG'````-o` for the virtual offset of the registry which we got from `hivelist`, and `-K` to tell which subkey we would like to see the value.```Legend: (S) = Stable   (V) = Volatile
----------------------------Registry: \??\C:\Users\SBA_AK\ntuser.datKey name: FLAG (S)Last updated: 2020-08-25 18:45:05 UTC+0000
Subkeys:
Values:REG_SZ                        : (S) FwordCTF{hiding_secrets_in_regs}```After this solved, it just started to make sense that "Geeks" like to bother up with "registry". Well if you messing with any system you're technically also a "Geek"...