Overview
We start with a 2GB raw memory dump file. Grepping for the flag prefix yields nothing, suggesting the flag is compressed, encrypted, or obfuscated in memory.
Reconnaissance
Scanning for file signatures in the memory dump reveals PK ZIP file headers (PK\\x03\\x04) alongside strings referencing a file named challenge.pcap.
Exploitation Strategy
We carve out the ZIP bytes and attempt extraction. The archive is encrypted using ZipCrypto. We run zip2john to extract the password hash and crack it using John the Ripper with the rockyou dictionary.
The recovered password is gravity. Decrypting and extracting challenge.pcap exposes 3 Base64 chunks split across packets.
Solution Code
import zipfile
from pathlib import Path
import base64
with zipfile.ZipFile("carved_challenge.zip") as zf:
data = zf.read("challenge.pcap", pwd=b"gravity")
Path("challenge.pcap").write_bytes(data)
# Reconstruct Base64 chunks:
# S2FhbHtDMDBQM1Ig -> Kaal{C00P3R
# NVQ0WSBNM1NTNEcz -> 5T4Y M3SS4G3
# IEYwVU5EfQ== -> F0UND}
flag = base64.b64decode("S2FhbHtDMDBQM1Ig").decode() + base64.b64decode("NVQ0WSBNM1NTNEcz").decode() + base64.b64decode("IEYwVU5EfQ==").decode()
print(flag)Flag
Kaal{C00P3R_5T4Y_M3SS4G3_F0UND}