Ringbearer

Flag: HACKDAY{TH4nk_Y0u_s4M_G4mg3e}

Challenge

31MB

Ringbearer.zip

archive

Ouvrir

Description

---

You are the ringbearer, you carry a burden that must never fall into the wrong hands. Many who once walked beside you are no longer found in the present records. Yet one faithful companion never left your side. What remains beside the Ringbearer may hold the key to secrets long forgotten. The one who never left the Ringbearer's side is the user that we searching for , can you find him ?

Solution

Voici les fichiers que contient l'archive :

$ unzip -l Ringbearer.zip
Archive:  Ringbearer.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
        0  2026-01-18 14:11   Ringbearer/
        0  2026-01-21 12:14   Ringbearer/Desktop/
       65  2026-01-19 14:36   Ringbearer/Desktop/7zPasswordFormat.txt
        0  2026-01-18 14:31   Ringbearer/Documents/
        0  2026-01-21 14:45   Ringbearer/Documents/old/
 12558336  2026-01-18 05:01   Ringbearer/Documents/old/317f1e761f2faa8da781a4762b9dcc2c5cad209a.bak
    32768  2026-01-18 05:01   Ringbearer/Documents/old/8eec7bc461808e0b8a28783d0bec1a3a22eb0821.bak
 70983680  2026-01-18 05:01   Ringbearer/Documents/old/c981d125d1a564c9f5738faff51d59d98711f145.bak
    65536  2026-01-18 05:01   Ringbearer/Documents/old/f16bed56189e249fe4ca8ed10a1ecae60e8ceac0.bak
      186  2026-01-19 05:42   Ringbearer/Documents/old/f873f39163f5b43dbf1fee63cbce284074896221.bak
        0  2026-01-21 13:54   Ringbearer/Downloads/
      250  2026-01-21 13:54   Ringbearer/Downloads/Invitation.7z
       22  2026-01-19 05:41   Ringbearer/Downloads/notes.txt
        0  2026-01-19 05:43   Ringbearer/System32/
        0  2026-01-19 05:43   Ringbearer/System32/driver
    57344  2026-01-18 04:55   Ringbearer/System32/sam
    32768  2026-01-18 04:54   Ringbearer/System32/security
 70983680  2026-01-18 04:55   Ringbearer/System32/software
 12558336  2026-01-18 04:55   Ringbearer/System32/system
---------                     -------
167272971                     19 files

Les fichiers texte contiennent :

$ cat Ringbearer/Desktop/7zPasswordFormat.txt
Expected a pair seperated by @, an identity bound to its secret.

$ cat Ringbearer/Downloads/notes.txt
You are not invited !

On apprend que le mot de passe des 7z c'est <username>@<password>. Et ça tombien bien car il y a du SAM et SYSTEM, on commence par dump tout ça :

$ impacket-secretsdump -sam Ringbearer/System32/sam -system Ringbearer/System32/system LOCAL
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Target system bootKey: 0x3e0fb360762ca6d969cfac8038281b09
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:209c6174da490caeb422f3fa5a7ae634:::
guest:501:aad3b435b51404eeaad3b435b51404ee:5591dab10212457bbce3c99927ed7bc0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:e5785e26e90569fee749be90b1c6a7a6:::
ringbearer:1001:aad3b435b51404eeaad3b435b51404ee:5e8a41106cf5fece3ab30d2f668c886f:::
[*] Cleaning up...

On cherche ces hash sur hashes.com :

En les testant tous sur Ringbearer/Downloads/Invitation.7z, on trouve que guest@youareinvited fonctionne :

$ 7z x -so Ringbearer/Downloads/Invitation.7z -pguest@youareinvited
The user you've been searching for once said this: "I Can't Carry It For You... But I Can Carry You!"

On cherche donc l'utilisateur Sam !

---

Les fichiers dans olds sont des registres windows aussi, donc probablement ancienne base SAM et SYSTEM. Il y a également un 7z chiffré.

$ file Ringbearer/Documents/old/*.bak
Ringbearer/Documents/old/317f1e761f2faa8da781a4762b9dcc2c5cad209a.bak: MS Windows registry file, NT/2000 or above
Ringbearer/Documents/old/8eec7bc461808e0b8a28783d0bec1a3a22eb0821.bak: MS Windows registry file, NT/2000 or above
Ringbearer/Documents/old/c981d125d1a564c9f5738faff51d59d98711f145.bak: MS Windows registry file, NT/2000 or above
Ringbearer/Documents/old/f16bed56189e249fe4ca8ed10a1ecae60e8ceac0.bak: MS Windows registry file, NT/2000 or above
Ringbearer/Documents/old/f873f39163f5b43dbf1fee63cbce284074896221.bak: 7-zip archive data, version 0.4

On peut identifier quels fichiers sont le SAM et le SYSTEM avec un ptit script généré par LLM :

$ for f in Ringbearer/Documents/old/*.bak; do
  if strings -n8 "$f" | grep -q "SupplementalCredentials"; then
    echo "[+] Trouvé dans: $f"
  fi
done
[+] Trouvé dans: Ringbearer/Documents/old/f16bed56189e249fe4ca8ed10a1ecae60e8ceac0.bak

$ for f in Ringbearer/Documents/old/*.bak; do
  if strings -n8 "$f" | grep -q "MountedDevices"; then
    echo "[+] Trouvé dans: $f"
  fi
done
[+] Trouvé dans: Ringbearer/Documents/old/317f1e761f2faa8da781a4762b9dcc2c5cad209a.bak

Donc :

• SAM = Ringbearer/Documents/old/f16bed56189e249fe4ca8ed10a1ecae60e8ceac0.bak

• SYSTEM = Ringbearer/Documents/old/317f1e761f2faa8da781a4762b9dcc2c5cad209a.bak

Maintenant il faut dump la backup de la même manière que tout à l'heure :

┌──(thaysan㉿DESKTOP-PVE89Q3)-[~]
└─$ impacket-secretsdump -sam Ringbearer/Documents/old/f16bed56189e249fe4ca8ed10a1ecae60e8ceac0.bak -system Ringbearer/Documents/old/317f1e761f2faa8da781a4762b9dcc2c5cad209a.bak LOCAL
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Target system bootKey: 0x3e0fb360762ca6d969cfac8038281b09
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:209c6174da490caeb422f3fa5a7ae634:::
guest:501:aad3b435b51404eeaad3b435b51404ee:5591dab10212457bbce3c99927ed7bc0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:e5785e26e90569fee749be90b1c6a7a6:::
ringbearer:1001:aad3b435b51404eeaad3b435b51404ee:5e8a41106cf5fece3ab30d2f668c886f:::
gandalftw:1012:aad3b435b51404eeaad3b435b51404ee:98815f8c88e7b2dcf5603d14ef48f3f2:::
samwiseg:1013:aad3b435b51404eeaad3b435b51404ee:dcd99365563e67eb8fbe8c9d83b0ca6c:::
aragornii:1014:aad3b435b51404eeaad3b435b51404ee:9146cf0dfda2169b163869bedb8457ae:::
legolasg:1015:aad3b435b51404eeaad3b435b51404ee:91268860a660d8cff4aef11b6550c11e:::
[*] Cleaning up...

Bingo, y a un samwiseg ! On casse son hash pour trouver son mot de passe et ourvrir le 7z dans old avec :

$ 7z x -so  Ringbearer/Documents/old/f873f39163f5b43dbf1fee63cbce284074896221.bak -psamwiseg@TheHelper
HACKDAY{TH4nk_Y0u_s4M_G4mg3e}