题目描述：
我的朋友约翰是一位“环境”活动家和人道主义者。他讨厌《复仇者联盟3：无限战争》中灭霸的意识形态。他编程很烂。他在写程序的时候使用了太多的变量。有一天，约翰给了我一个记忆转储，让我在他转储的时候找出他在做什么。你能帮我算一下吗？

此题仅包含一个flag，入门难度

cmdscan

335d366f5d6031767631707f

envars | grep "cmd.exe"

1_4m_b3tt3r}

python2 vol.py --plugins=./volatility/plugins  -f Challenge.raw --profile=Win7SP1x86 mimikatz

flag{you_are_good_but

挑战描述：
My sister's computer crashed. We were very fortunate to recover this memory dump. Your job is get all her important files from the system. From what we remember, we suddenly saw a black window pop up with some thing being executed. When the crash happened, she was trying to draw something. Thats all we remember from the time of crash.

我姐姐的电脑崩溃了。我们非常幸运地恢复了这个内存转储。您的工作是从系统中获取她的所有重要文件。根据我们的记忆，我们突然看到一个黑色窗口弹出，上面正在执行一些事情。灾祸发生时，她正试图画什么。这就是我们灾祸发生时起所记得的一切。

Note: This challenge is composed of 3 flags.

注意：此挑战由 3 个flag组成。

flag{th1s_1s_th3_1st_st4g3!!}
flag{good_boy_good_girl}
flag{w3ll_3rd_stage_was_easy}

ython2 vol.py -f MemoryDump_Lab1.raw --profile=Win7SP1x64 hashdump
ython2 vol.py -f MemoryDump_Lab1.raw --profile=Win7SP1x64 lsadump
python2 vol.py --plugins=./volatility/plugins -f MemoryDump_Lab1.raw --profile=Win7SP1x64 mimikatz

ZmxhZ3t0aDFzXzFzX3RoM18xc3Rfc3Q0ZzMhIX0=

ZmxhZ3t0aDFzXzFzX3RoM18xc3Rfc3Q0ZzMhIX0=

flag{th1s_1s_th3_1st_st4g3!!}

python2 vol.py -f MemoryDump_Lab1.raw --profile=Win7SP1x64 memdump -p 2424 -D ./

python2 vol.py -f MemoryDump_Lab1.raw --profile=Win7SP1x64 cmdline    

python2 vol.py -f MemoryDump_Lab1.raw --profile=Win7SP1x64 filescan | grep "Important.rar"

python2 vol.py -f MemoryDump_Lab1.raw --profile=Win7SP1x64 dumpfiles -Q 0x000000003fa3ebc0 -D ./

NTLM：f4ff64c8baac57d22f22edc681055ba6

One of the clients of our company, lost the access to his system due to an unknown error. He is supposedly a very popular "environmental" activist. As a part of the investigation, he told us that his go to applications are browsers, his password managers etc. We hope that you can dig into this memory dump and find his important stuff and give it back to us.
挑战描述
我们公司的一个客户由于未知错误而失去了对其系统的访问权限。据说他是一位非常受欢迎的“环保”活动家。作为调查的一部分，他告诉我们，他常用的应用程序是浏览器、密码管理器等。我们希望你能深入挖掘这个记忆转储，找到他的重要东西并还给我们。
Note: This challenge is composed of 3 flags.
注意：此挑战由 3 个flag组成。

flag{w0w_th1s_1s_Th3_SeC0nD_ST4g3_!!}
flag{w3lc0m3_T0_$T4g3_!_Of_L4B_2}
flag{oK_So_Now_St4g3_3_is_DoNE!!}

python2 vol.py -f MemoryDump_Lab2.raw --profile=Win7SP1x64 iehistory

Important.rar
SW1wb3J0YW50.rar
stAg3_5.txt
Password.png
Hidden.kdbx

flag{w0w_th1s_1s_Th3_SeC0nD_ST4g3_!!}

python2 vol.py -f MemoryDump_Lab2.raw --profile=Win7SP1x64 cmdline

python2 vol.py -f MemoryDump_Lab2.raw --profile=Win7SP1x64 envars | grep "chrome.exe"

flag{w3lc0m3_T0_$T4g3_!_Of_L4B_2} 

python2 vol.py -f MemoryDump_Lab2.raw --profile=Win7SP1x64 chromehistory

echo -n "flag{w3ll_3rd_stage_was_easy}" | sha1sum

挑战描述

A malicious script encrypted a very secret piece of information I had on my system. Can you recover the information for me please?
一个恶意脚本加密了我系统上的一条非常机密的信息。您能帮我恢复信息吗？
Note-1: This challenge is composed of only 1 flag. The flag split into 2 parts.
注 1：此挑战仅由 1 个flag组成。flag分为两部分。
Note-2: You'll need the first half of the flag to get the second.
注 2：您需要flag的前半部分才能获得后半部分。
You will need this additional tool to solve the challenge,
您将需要这个额外的工具来解决挑战，
$ sudo apt install steghide
The flag format for this lab is: inctf{s0me_l33t_Str1ng}
本实验的标志格式为：inctf{s0me_l33t_Str1ng}

inctf{0n3_h4lf_1s_n0t_3n0ugh}

cmdline

filescan

dumpfiles

inctf{0n3_h4lf

python2 vol.py -f MemoryDump_Lab3.raw --profile=Win7SP1x86_23418 filescan | grep "jpeg"
python2 vol.py -f MemoryDump_Lab3.raw --profile=Win7SP1x86_23418 filescan | grep "bmp" 

steghide info suspision1.jpeg

steghide extract -sf suspision1.jpeg -p inctf{0n3_h4lf

_1s_n0t_3n0ugh}

挑战描述
My system was recently compromised. The Hacker stole a lot of information but he also deleted a very important file of mine. I have no idea on how to recover it. The only evidence we have, at this point of time is this memory dump. Please help me.
我的系统最近遭到入侵。黑客窃取了很多信息，但他也删除了我的一个非常重要的文件。我不知道如何恢复它。目前，我们拥有的唯一证据是这个内存转储。请帮助我。
Note: This challenge is composed of only 1 flag.
注意：此挑战仅由 1 个flag组成。
The flag format for this lab is: inctf{s0me_l33t_Str1ng}
本实验的标志格式为：inctf{s0me_l33t_Str1ng}

pslist

secrets.txt
flag.txt.txt
Important.txt.txt
New%20Text%20Document.txt
Screenshot1.png
galf.jpeg
Flag%20not%20here.bmp

python2 vol.py -f MemoryDump_Lab4.raw --profile=Win7SP1x64 mftparser > 1.txt

inctf{1_is_n0t_EQu4l_7o_2_bUt_th1s_d0s3nt_m4ke_s3ns3}

题目描述
We received this memory dump from our client recently. Someone accessed his system when he was not there and he found some rather strange files being accessed. Find those files and they might be useful. I quote his exact statement,
我们最近从客户那里收到了这个内存转储。有人在他不在的时候访问了他的系统，他发现了一些相当奇怪的文件被访问。找到这些文件，它们可能会有用。我引用他的原话，
The names were not readable. They were composed of alphabets and numbers but I wasn't able to make out what exactly it was.
这些名字不可读。它们由字母和数字组成，但我无法弄清楚它到底是什么。
Also, he noticed his most loved application that he always used crashed every time he ran it. Was it a virus?
此外，他注意到他最喜欢的应用程序每次运行时都会崩溃。是病毒吗？
Note-1: This challenge is composed of 3 flags. If you think 2nd flag is the end, it isn't!! 😛
注 1：此挑战由 3 个flag组成。如果你认为 2nd Flag 就是结束，那它就不是！！
Note-2: There was a small mistake when making this challenge. If you find any string which has the string "L4B_3_D0n3*!!" in it, please change it to "L4B_5_D0n3!!*" and then proceed.
注 2：在进行此挑战时有一个小错误。如果您发现任何字符串中包含字符串 “L4B_3_D0n3*！！”，请将其更改为 “L4B_5_D0n3*！！”，然后继续。
Note-3: You'll get the stage 2 flag only when you have the stage 1 flag.
注 3：只有当您拥有阶段 1 flag时，您才会获得阶段 2 flag。

flag1	flag{!!_w3LL_d0n3_St4g3-1_0f_L4B_5_D0n3_!!}
flag2	flag{W1th_th1s_$taGe_2_1s_cOmPL3T3_!!}
flag3	bi0s{M3m_l4B5_OVeR_!}

Important.rar
SW1wb3J0YW50.rar
stAg3_5.txt
Password.png
Hidden.kdbx
ZmxhZ3shIV93M0xMX2QwbjNfU3Q0ZzMtMV8wZl9MNEJfM19EMG4zXyEhfQ.bmp

flag{!!_w3LL_d0n3_St4g3-1_0f_L4B_3_D0n3_!!}

Important.rar
stAg3_5.txt
Password.png
Hidden.kdbx

python2 vol.py -f MemoryDump_Lab5.raw --profile=Win7SP1x64 envars | grep "WerFault.exe" 

2716
780
2168

python2 vol.py -f MemoryDump_Lab5.raw --profile=Win7SP1x64 memdump -p 2168 -D ./file

挑战描述
We received this memory dump from the Intelligence Bureau Department. They say this evidence might hold some secrets of the underworld gangster David Benjamin. This memory dump was taken from one of his workers whom the FBI busted earlier this week. Your job is to go through the memory dump and see if you can figure something out. FBI also says that David communicated with his workers via the internet so that might be a good place to start.
我们从情报局部门收到了这个内存转储。他们说，这些证据可能隐藏着黑社会黑帮大卫·本杰明的一些秘密。这个内存转储是从他的一名员工那里拿走的，本周早些时候被 FBI 逮捕了。您的工作是检查内存转储，看看是否能找出一些东西。FBI 还表示，David 通过互联网与他的员工进行了交流，因此这可能是一个不错的起点。
Note: This challenge is composed of 1 flag split into 2 parts.
The flag format for this lab is: inctf{s0me_l33t_Str1ng}
注意：本次挑战赛由 1 个flag组成，分为 2 个部分。
本实验的标志格式为：inctf{s0me_l33t_Str1ng}

python2 vol.py -f MemoryDump_Lab6.raw --profile=Win7SP1x64 envars | grep "pass"

Flag.zip
flag.zip
flag.rar

strings -n 500 MemoryDump_Lab6.raw | grep Mega