Memory Liar

The brief

A critical workstation on the financial management subnet was suspected of being compromised by an advanced persistent threat (APT). Our tier-1 triage team collected a physical memory capture and ran an automated process audit. The automated audit reported everything clean: all running processes appear ordinary, can you retrieve the flag?

• memory-liar.zip, 54 KB

In short

A Windows memory image whose process audit came back clean. The process list showed ten processes, while a pool scan and the process ID table showed eleven. The hidden one had been unlinked by DKOM, and its only private page held an XOR encoded flag record.

An audit that says all clear

The image is 16 MB of physical memory from a 32-bit Windows 7 style workstation. An automated audit walked the process list, found ten processes and called every one ordinary.

Its own way into the kernel

The image is hand built, so the lab read the kernel structures itself. The debugger block at physical 0x210000 points to the process list and the process ID table. A page directory at 0x185000 maps the kernel.

Three views, one disagrees

Walking the list gives 10 processes. A scan for process pool tags gives 11, and so does the process ID table. The extra one is winxnet.exe, PID 1337, started by a real svchost.

Cut out of the list

Both list links of winxnet.exe point at its own entry, 0x8035d0c0, the mark of a DKOM unlink. Its neighbours skip it, yet it still has a running thread, an ID entry and live page tables.

One private page

Read through its own page directory at 0x357000, the process maps exactly one user page. Virtual 0x450000 sits at physical 0x35f000 and opens with a record tagged ROOT for PID 1337.

Key 0x5D, and a decoy

The record gives XOR key 0x5D and length 51. The 51 bytes decode to the flag and end on its closing brace. The only plain text flag in the image sits in notepad and calls itself a fake.

The insight

The audit trusted one list that an attacker can rewrite. Two independent views of the same processes disagreed, and the gap was the attacker.

The flag

hiCTF{dk0m_unl1nk_3pr0c3ss_l1st_cr0ss_ch3ck_7c3a9f}