- Source: setodaNote CTF Exhibition
- Author: (不明)
Windowsのレジストリハイブとログが配布される。
この中にパスワードハッシュが含まれているらしいので、impacketを使って抽出する。
$ impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0xc2f71c8a15cee734ce4ab65b3e9da4e1
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:27c3a146aa209b2120f7ecc9db065540:::
stella:1001:aad3b435b51404eeaad3b435b51404ee:2f8ae2e260d0cfe3756ff53e639e3377:::
test:1002:aad3b435b51404eeaad3b435b51404ee:3c99b8901b00758369f18b9df72012c8:::
akari:1003:aad3b435b51404eeaad3b435b51404ee:b66eade488ce2c23ba226427e40fed41:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] DefaultPassword
(Unknown User):_TBAL_{68EDDCF5-0AEB-4C28-A770-AF5302ECA3C9}
[*] DPAPI_SYSTEM
dpapi_machinekey:0xd4a669f9f497412cee7cd70c13c318c1b743c4d7
dpapi_userkey:0xe8a7ce7d52e77f0632f7225fe1cb66bccafb0171
[*] NL$KM
0000 49 EA 37 D4 AD 86 BC F9 1D C3 70 FD B3 1F 14 5D I.7.......p....]
0010 42 AD 20 DB 9F AB C9 30 3F 72 4D 0A 08 63 53 70 B. ....0?rM..cSp
0020 7F E2 25 F5 57 21 94 D2 98 31 E7 A4 D6 3C D9 37 ..%.W!...1...<.7
0030 A0 D2 3D ED 49 FD 98 7B 76 34 CF A6 F0 7E 76 B6 ..=.I..{v4...~v.
NL$KM:49ea37d4ad86bcf91dc370fdb31f145d42ad20db9fabc9303f724d0a086353707fe225f5572194d29831e7a4d63cd937a0d23ded49fd987b7634cfa6f07e76b6
[*] Cleaning up...
CSIRT_asks_you_01でユーザー名はtestだということが分かっているので、ハッシュはtest:1002:aad3b435b51404eeaad3b435b51404ee:3c99b8901b00758369f18b9df72012c8:::になる。
次に、Ophcrackをインストールし、無料のパスワード辞書をセットしてクラックを試そうとしたが、Tableを正しく読み込めていなかったのかそもそもTableにパスワードが含まれていなかったのか、見つからず。
仕方ないのでrockyou.txtを用いてhashcatでパスワードをクラックする。
$ hashcat -m 1000 -a 0 hash.txt rockyou.txt --opencl-device-types 1
hashcat (v6.2.6) starting
OpenCL API (OpenCL 3.0 PoCL 5.0+debian Linux, None+Asserts, RELOC, SPIR, LLVM 16.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
==================================================================================================================================================
* Device #1: cpu-skylake-avx512-11th Gen Intel(R) Core(TM) i7-1195G7 @ 2.90GHz, 2831/5726 MB (1024 MB allocatable), 8MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Early-Skip
* Not-Salted
* Not-Iterated
* Single-Hash
* Single-Salt
* Raw-Hash
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Temperature abort trigger set to 90c
Host memory required for this attack: 2 MB
Dictionary cache built:
* Filename..: rockyou.txt
* Passwords.: 14344391
* Bytes.....: 139921497
* Keyspace..: 14344384
* Runtime...: 1 sec
3c99b8901b00758369f18b9df72012c8:testtest
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 1000 (NTLM)
Hash.Target......: 3c99b8901b00758369f18b9df72012c8
Time.Started.....: Sat Dec 13 13:56:57 2025 (0 secs)
Time.Estimated...: Sat Dec 13 13:56:57 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 531.8 kH/s (0.15ms) @ Accel:512 Loops:1 Thr:1 Vec:16
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 49152/14344384 (0.34%)
Rejected.........: 0/49152 (0.00%)
Restore.Point....: 45056/14344384 (0.31%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: hehe123 -> truckin
Hardware.Mon.#1..: Util: 11%
Started: Sat Dec 13 13:56:32 2025
Stopped: Sat Dec 13 13:56:58 2025
testtestがヒットした。flag形式はflag{user_pass}なので、
flag{test_testtest}