hemu1438/forensicsgpt-training-data huggingface dataset:
Update README.md · stuxnet999/MemLabs@ac78fff · GitHub
Original file line numberDiff line numberDiff line change
@@ -96,4 +96,4 @@ Cyber Forensics, [Team bi0s](https://www.twitter.com/teambi0s)
	
96	96		
97	97	
+ Mail: abhiram1999@gmail.com
	
98	98	
+ Twitter: [@_abhiramkumar](https://www.twitter.com/_abhiramkumar)
	
99		-
+ Personal Blog: [volatilevirus.home.blog](https://www.volatilevirus.home.blog)
	
	99	+
+ Personal Blog: [volatilevirus.home.blog](https://volatilevirus.home.blog)
MemLabs/Lab 5 at 79ad019621f5e45519daa0b1de9f00c111cb5816 · stuxnet999/MemLabs · GitHub
We received this memory dump from our client recently. Someone accessed his system when he was not there and he found some rather strange files being accessed. Find those files and they might be useful. I quote his exact statement,
The names were not readable. They were composed of alphabets and numbers but I wasn't able to make out what exactly it was.
Also, he noticed his most loved application that he always used crashed every time he ran it. Was it a virus?
Note-1: This challenge is composed of 3 flags. If you think 2nd flag is the end, it isn't!! :P
Note-2: There was a small mistake when making this challenge. If you find any string which has the string "L4B_3_D0n3!!" in it, please change it to "L4B_5_D0n3!!" and then proceed.
Note-3: You'll get the stage 2 flag only when you have the stage 1 flag.
Challenge file: MemLabs_Lab5
The commpressed archive
MD5 hash: d72a2141baa6670d46c77b5f452f09f7
The memory dump
MD5 hash: 9dd6cb1134c9b018020bad44f27394db
Please follow the flag submission rules when sending the email for solution verification.
MemLabs/Lab 5 at 21508294496c564a20e8b6b9f0c6adc3abf20fdf · stuxnet999/MemLabs · GitHub
This challenge is composed of 2 flags but do you really think so? Maybe a little flag is hiding somewhere.
Note: There was a small mistake when making this challenge. If you find any string which has the string "L4B_3_D0n3!!" in it, please change it to "L4B_5_D0n3!!" and then proceed.
Hint: You'll get the stage 2 flag only when you have the stage 1 flag.
Challenge file: MemLabs_Lab5
Please follow the flag submission rules when sending the email for solution verification.
MemLabs/Lab 5 at f31c778aa5a24a6ee97f002bad25d696d16ade58 · stuxnet999/MemLabs · GitHub
This challenge is composed of 2 flags but do you really think so? Maybe a little flag is hiding somewhere.
Note: There was a small mistake when making this challenge. If you find any string which has the string "L4B_3_D0n3!!" in it, please change it to "L4B_5_D0n3!!" and then proceed.
Hint: You'll get the stage 2 flag only when you have the stage 1 flag.
Challenge file: MemLabs_Lab5
Please follow the flag submission rules when sending the email for solution verification.
Adding challenge descriptions · stuxnet999/MemLabs@ba1424b · GitHub
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
	
2	2		
3	3	
## **Challenge Description**
	
4	4		
	5	+
My sister's computer crashed. We were very fortunate to recover this memory dump. Your job is get all her important files from the system. From what we remember, we suddenly saw a black window pop up with some thing being executed. When the crash happened, she was trying to draw something. Thats all we remember from the time of crash.
	
	6	+	
5	7	
This challenge is composed of 3 flags.
	
6	8		
7	9	
**Challenge file**: [MemLabs_Lab1](https://mega.nz/#!6l4BhKIb!l8ATZoliB_ULlvlkESwkPiXAETJEF7p91Gf9CWuQI70)
	
	
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
	
2	2		
3	3	
## **Challenge Description**
	
4	4		
5		-
This challenge is composed of 3 flags.
	
	5	+
One of the clients of our company, lost the access to his system due to an unknown error. He is supposedly a very popular "environmental" activist. As a part of the investigation, he told us that his go to applications are browsers, his password managers etc. We hope that you can dig into this memory dump and find his important stuff and give it back to us.
	
6	6		
7	7	
**Challenge file**: [MemLabs_Lab2](https://mega.nz/#!ChoDHaja!1XvuQd49c7-7kgJvPXIEAst-NXi8L3ggwienE1uoZTk)
	
8	8		
	
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,11 @@
	
2	2		
3	3	
## **Challenge Description**
	
4	4		
5		-
This challenge is composed of only 1 flag.
	
	5	+
A malicious script encrypted a very secret piece of information I had on my system. Can you recover the information for me please?
	
	6	+	
	7	+
This challenge is composed of only 1 flag and split into 2 parts.
	
	8	+	
	9	+
**Hint**: You'll need the first half of the flag to get the second.
	
6	10		
7	11	
You will need this additional tool to solve the challenge,
	
8	12		
	
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,9 @@
	
2	2		
3	3	
## **Challenge Description**
	
4	4		
5		-
This challenge is composed of only 1 flag.
	
	5	+
My system was recently compromised. The Hacker stole a lot of information but he also deleted a very important file of mine. I have no idea on how to recover it. The only evidence we have, at this point of time is this memory dump. Please help me.
	
	6	+	
	7	+
**Note**: This challenge is composed of only 1 flag.
	
6	8		
7	9	
The flag format for this lab is: **inctf{s0me_l33t_Str1ng}**
	
8	10		
	
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ The flag format for this lab is: **inctf{s0me_l33t_Str1ng}**
	
8	8		
9	9	
**Challenge file**: [MemLabs_Lab6](https://mega.nz/#!C0pjUKxI!LnedePAfsJvFgD-Uaa4-f1Tu0kl5bFDzW6Mn2Ng6pnM)
	
10	10		
11		-
Please follow the [flag submission rules](https://github.com/stuxnet999/MemLabs#flag-submission) when sending the email for solution verification.
	
	11	+
Please follow the [flag submission rules](https://github.com/stuxnet999/MemLabs#flag-submission) when sending the email for solution verification.