Adding minor changes · stuxnet999/MemLabs@a7eb26f · GitHub
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,19 @@
	
1	1	
# **MemLabs Lab 1 - Beginner's Luck**
	
2	2		
3		-
## **Challenge Description**
	
	3	+
## **Challenge description**
	
4	4		
5	5	
My sister's computer crashed. We were very fortunate to recover this memory dump. Your job is get all her important files from the system. From what we remember, we suddenly saw a black window pop up with some thing being executed. When the crash happened, she was trying to draw something. Thats all we remember from the time of crash.
	
6	6		
7	7	
**Note**: This challenge is composed of 3 flags.
	
8	8		
9	9	
**Challenge file**: [MemLabs_Lab1](https://mega.nz/#!6l4BhKIb!l8ATZoliB_ULlvlkESwkPiXAETJEF7p91Gf9CWuQI70)
	
10	10		
	11	+
## **Challenge file hash**
	
	12	+	
	13	+
The commpressed archive
	
	14	+
+ MD5 hash: 919a0ded944c427b7f4e5c26a6790e8d
	
	15	+	
	16	+
The memory dump
	
	17	+
+ MD5 hash: b9fec1a443907d870cb32b048bda9380
	
	18	+	
11	19	
Please follow the [flag submission rules](https://github.com/stuxnet999/MemLabs#flag-submission) when sending the email for solution verification.
	
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,19 @@
	
1	1	
# **MemLabs Lab 2 - A New World**
	
2	2		
3		-
## **Challenge Description**
	
	3	+
## **Challenge description**
	
4	4		
5	5	
One of the clients of our company, lost the access to his system due to an unknown error. He is supposedly a very popular "environmental" activist. As a part of the investigation, he told us that his go to applications are browsers, his password managers etc. We hope that you can dig into this memory dump and find his important stuff and give it back to us.
	
6	6		
7	7	
**Note**: This challenge is composed of 3 flags.
	
8	8		
9	9	
**Challenge file**: [MemLabs_Lab2](https://mega.nz/#!ChoDHaja!1XvuQd49c7-7kgJvPXIEAst-NXi8L3ggwienE1uoZTk)
	
10	10		
	11	+
## **Challenge file hash**
	
	12	+	
	13	+
The commpressed archive
	
	14	+
+ MD5 hash: 75d2ee1fcf2bc8a25329723e6ce2be93
	
	15	+	
	16	+
The memory dump
	
	17	+
+ MD5 hash: ddb337936a75153822baed718851716b
	
	18	+	
11	19	
Please follow the [flag submission rules](https://github.com/stuxnet999/MemLabs#flag-submission) when sending the email for solution verification.
	
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
	
4	4		
5	5	
A malicious script encrypted a very secret piece of information I had on my system. Can you recover the information for me please?
	
6	6		
7		-
**Note**: This challenge is composed of only 1 flag and split into 2 parts.
	
	7	+
**Note-1**: This challenge is composed of only 1 flag. The flag split into 2 parts.
	
8	8		
9		-
**Hint**: You'll need the first half of the flag to get the second.
	
	9	+
**Note-2**: You'll need the first half of the flag to get the second.
	
10	10		
11	11	
You will need this additional tool to solve the challenge,
	
12	12		
@@ -18,4 +18,13 @@ The flag format for this lab is: **inctf{s0me_l33t_Str1ng}**
	
18	18		
19	19	
**Challenge file**: [MemLabs_Lab3](https://mega.nz/#!2ohlTAzL!1T5iGzhUWdn88zS1yrDJA06yUouZxC-VstzXFSRuzVg)
	
20	20		
	21	+
## **Challenge file hash**
	
	22	+	
	23	+
The commpressed archive
	
	24	+
+ MD5 hash: c41a03bc57b6965ce3f9dbc9df19ba10
	
	25	+	
	26	+
The memory dump
	
	27	+
+ MD5 hash: ce4e7adc4efbf719888d2c87256d1da3
	
	28	+	
	29	+	
21	30	
Please follow the [flag submission rules](https://github.com/stuxnet999/MemLabs#flag-submission) when sending the email for solution verification.
	
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,12 @@ The flag format for this lab is: **inctf{s0me_l33t_Str1ng}**
	
10	10		
11	11	
**Challenge file**: [MemLabs_Lab4](https://mega.nz/#!Tx41jC5K!ifdu9DUair0sHncj5QWImJovfxixcAY-gt72mCXmYrE)
	
12	12		
	13	+
## **Challenge file hash**
	
	14	+	
	15	+
The commpressed archive
	
	16	+
+ MD5 hash: 85418d442070afd787abcd7fb51ebd61
	
	17	+	
	18	+
The memory dump
	
	19	+
+ MD5 hash: d2bc2f671bcc9281de5f73993de04df3
	
	20	+	
13	21	
Please follow the [flag submission rules](https://github.com/stuxnet999/MemLabs#flag-submission) when sending the email for solution verification.
	
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,24 @@
	
2	2		
3	3	
## **Challenge Description**
	
4	4		
5		-
This challenge is composed of 2 flags but do you really think so? Maybe a little flag is hiding somewhere.
	
	5	+
We received this memory dump from our client recently. Someone accessed his system when he was not there and he found some rather strange files being accessed. Find those files and they might be useful. I quote his exact statement,
	
6	6		
7		-
**Note**: There was a small mistake when making this challenge. If you find any string which has the string "**_L4B_3_D0n3_!!**" in it, please change it to "**_L4B_5_D0n3_!!**" and then proceed.
	
	7	+
> The names were not readable. They were composed of alphabets and numbers but I wasn't able to make out what exactly it was.
	
8	8		
9		-
**Hint**: You'll get the stage 2 flag only when you have the stage 1 flag.
	
	9	+
Also, he noticed his most loved application that he always used crashed every time he ran it. Was it a virus?
	
	10	+	
	11	+
**Note-1**: There was a small mistake when making this challenge. If you find any string which has the string "**_L4B_3_D0n3_!!**" in it, please change it to "**_L4B_5_D0n3_!!**" and then proceed.
	
	12	+	
	13	+
**Note-2**: You'll get the stage 2 flag only when you have the stage 1 flag.
	
10	14		
11	15	
**Challenge file**: [MemLabs_Lab5](https://mega.nz/#!Ps5ViIqZ!UQtKmUuKUcqqtt6elP_9OJtnAbpwwMD7lVKN1iWGoec)
	
12	16		
	17	+
## **Challenge file hash**
	
	18	+	
	19	+
The commpressed archive
	
	20	+
+ MD5 hash: d72a2141baa6670d46c77b5f452f09f7
	
	21	+	
	22	+
The memory dump
	
	23	+
+ MD5 hash: 9dd6cb1134c9b018020bad44f27394db
	
	24	+	
13	25	
Please follow the [flag submission rules](https://github.com/stuxnet999/MemLabs#flag-submission) when sending the email for solution verification.
	
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,20 @@
	
2	2		
3	3	
## **Challenge Description**
	
4	4		
5		-
**Note**: This challenge is composed of 1 flag.
	
	5	+
We received this memory dump from the Intelligence Bureau Department. They say this evidence might hold some secrets of the underworld gangster David Benjamin. This memory dump was taken from one of his workers whom the FBI busted earlier this week. Your job is to go through the memory dump and see if you can figure something out. FBI also says that David communicated with his workers via the internet so that might be a good place to start.
	
	6	+	
	7	+
**Note**: This challenge is composed of 1 flag split into 2 parts.
	
6	8		
7	9	
The flag format for this lab is: **inctf{s0me_l33t_Str1ng}**
	
8	10		
9	11	
**Challenge file**: [MemLabs_Lab6](https://mega.nz/#!C0pjUKxI!LnedePAfsJvFgD-Uaa4-f1Tu0kl5bFDzW6Mn2Ng6pnM)
	
10	12		
	13	+
## **Challenge file hash**
	
	14	+	
	15	+
The commpressed archive
	
	16	+
+ MD5 hash: e657a2aec85a66dafa828cde25528116
	
	17	+	
	18	+
The memory dump
	
	19	+
+ MD5 hash: 405985dc8ab7651c65cdbc04cb22961c
	
	20	+	
11	21	
Please follow the [flag submission rules](https://github.com/stuxnet999/MemLabs#flag-submission) when sending the email for solution verification.