CHIqueen

Rick just loves to play some good old videogames. can you tell which game is he playing? whats the IP address of the server? format: CTF{flag} 게임 이름과 게임 서버의 ip를 알아내시면 됩니다. vol.py -f OtterCTF.vmem --profile=Win7SP1x64 netscan 0x7d6124d0 TCPv4 192.168.202.131:49530 77.102.199.102:7575 CLOSED 708 LunarMS.exe CTF{LunarMS}, CTF{77.102.199.102}

Let's start easy - whats the PC's name and IP address?format: CTF{flag} 컴퓨터의 이름과 IP를 알아내면 됩니다.vol.py -f OtterCTF.vmem --profile=Win7SP1x64 printkey -K 'ControlSet001\Control\ComputerName\ComputerName'CTF{WIN-LO6FAF3DTFE} vol.py -f OtterCTF.vmem --profile=Win7SP1x64 netscanCTF{192.168.202.131}

you got a sample of rick's PC's memory. can you get his user password? format: CTF{...} 메모리에서 비밀번호를 얻어내면 됩니다. 1. vol.py -f OtterCTF.vmem --profile=Win7SP1x64 mimikatz2. rekall -f OtterCTF.vmem mimikatz CTF{MortyIsReallyAnOtter}