November 05, 2017

Root me write-up : Command & Control - level 2

root me description of command & control level 2

When I unzip the downloaded file, a.dump file is created. The goal is to find the host name in this dump file.




volatility imageinfo of command & control level 2

I used the "volatility" tool to analyze the dump file. I checked the OS with the "imageinfo" plugin.




volatility envars plugin of command & control level 2

The "envars" plugin can check the environment variables of the processes, which can be used to check hostnames. The environment variable name for the host name, which is the flag, is "COMPUTERNAME".




strings command of command & control level 2

If you know the name of the environment variable, you can also extract the hostname using the "strings" command as above.