From 5b168253c1e4420bf0ee7324c0a33632d3002e06 Mon Sep 17 00:00:00 2001 From: Jakub WERLINSKI Date: Mon, 20 Jul 2026 16:58:46 +0200 Subject: [PATCH] refactor(blue): renommage 2-Blue-Team-Memory-Forensics + correction de l'outil d'analyse dans le guide joueur --- .../.dockerignore | 0 .../.gitignore | 0 .../Dockerfile | 0 .../README.md | 2 +- .../docker-compose.yml | 0 .../docker-entrypoint.sh | 0 .../docs/ADMIN_DEPLOYMENT.md | 2 +- .../docs/USER_GUIDE.md | 60 +++++++++++++++++++ .../report/report_template.md | 0 .../setup/generate_challenge.py | 0 .../setup/generate_pcap.py | 0 .../setup/requirements.txt | 0 .../solution/SOLUTION.md | 0 .../solution/validate_flag.py | 0 .../tools/extract_strings.py | 0 .../tools/vol_analyzer.py | 0 .../docs/USER_GUIDE.md | 40 ------------- 17 files changed, 62 insertions(+), 42 deletions(-) rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/.dockerignore (100%) rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/.gitignore (100%) rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/Dockerfile (100%) rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/README.md (99%) rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/docker-compose.yml (100%) rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/docker-entrypoint.sh (100%) rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/docs/ADMIN_DEPLOYMENT.md (98%) create mode 100644 challenges/2-Blue-Team-Memory-Forensics/docs/USER_GUIDE.md rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/report/report_template.md (100%) rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/setup/generate_challenge.py (100%) rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/setup/generate_pcap.py (100%) rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/setup/requirements.txt (100%) rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/solution/SOLUTION.md (100%) rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/solution/validate_flag.py (100%) rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/tools/extract_strings.py (100%) rename challenges/{Blue-Team-Memory-Forensics => 2-Blue-Team-Memory-Forensics}/tools/vol_analyzer.py (100%) delete mode 100644 challenges/Blue-Team-Memory-Forensics/docs/USER_GUIDE.md diff --git a/challenges/Blue-Team-Memory-Forensics/.dockerignore b/challenges/2-Blue-Team-Memory-Forensics/.dockerignore similarity index 100% rename from challenges/Blue-Team-Memory-Forensics/.dockerignore rename to challenges/2-Blue-Team-Memory-Forensics/.dockerignore diff --git a/challenges/Blue-Team-Memory-Forensics/.gitignore b/challenges/2-Blue-Team-Memory-Forensics/.gitignore similarity index 100% rename from challenges/Blue-Team-Memory-Forensics/.gitignore rename to challenges/2-Blue-Team-Memory-Forensics/.gitignore diff --git a/challenges/Blue-Team-Memory-Forensics/Dockerfile b/challenges/2-Blue-Team-Memory-Forensics/Dockerfile similarity index 100% rename from challenges/Blue-Team-Memory-Forensics/Dockerfile rename to challenges/2-Blue-Team-Memory-Forensics/Dockerfile diff --git a/challenges/Blue-Team-Memory-Forensics/README.md b/challenges/2-Blue-Team-Memory-Forensics/README.md similarity index 99% rename from challenges/Blue-Team-Memory-Forensics/README.md rename to challenges/2-Blue-Team-Memory-Forensics/README.md index 4039426..b02f7a4 100644 --- a/challenges/Blue-Team-Memory-Forensics/README.md +++ b/challenges/2-Blue-Team-Memory-Forensics/README.md @@ -20,7 +20,7 @@ L'investigation préliminaire suggère que **l'attaquant a déployé un implant ## 📁 Structure du Challenge ``` -Blue-Team-Memory-Forensics/ +2-Blue-Team-Memory-Forensics/ ├── README.md ← Vous êtes ici ├── Dockerfile ← Image du challenge ├── docker-compose.yml ← Orchestration Docker diff --git a/challenges/Blue-Team-Memory-Forensics/docker-compose.yml b/challenges/2-Blue-Team-Memory-Forensics/docker-compose.yml similarity index 100% rename from challenges/Blue-Team-Memory-Forensics/docker-compose.yml rename to challenges/2-Blue-Team-Memory-Forensics/docker-compose.yml diff --git a/challenges/Blue-Team-Memory-Forensics/docker-entrypoint.sh b/challenges/2-Blue-Team-Memory-Forensics/docker-entrypoint.sh similarity index 100% rename from challenges/Blue-Team-Memory-Forensics/docker-entrypoint.sh rename to challenges/2-Blue-Team-Memory-Forensics/docker-entrypoint.sh diff --git a/challenges/Blue-Team-Memory-Forensics/docs/ADMIN_DEPLOYMENT.md b/challenges/2-Blue-Team-Memory-Forensics/docs/ADMIN_DEPLOYMENT.md similarity index 98% rename from challenges/Blue-Team-Memory-Forensics/docs/ADMIN_DEPLOYMENT.md rename to challenges/2-Blue-Team-Memory-Forensics/docs/ADMIN_DEPLOYMENT.md index f4bbc2f..b5d4543 100644 --- a/challenges/Blue-Team-Memory-Forensics/docs/ADMIN_DEPLOYMENT.md +++ b/challenges/2-Blue-Team-Memory-Forensics/docs/ADMIN_DEPLOYMENT.md @@ -1,7 +1,7 @@ # Blue Team Memory Forensics - Guide Admin/Deploiement ## 1) Build de l'image -Depuis `Challenge/Blue-Team-Memory-Forensics`: +Depuis `challenges/2-Blue-Team-Memory-Forensics`: ```bash docker build -t blue-team-memory-forensics:latest . diff --git a/challenges/2-Blue-Team-Memory-Forensics/docs/USER_GUIDE.md b/challenges/2-Blue-Team-Memory-Forensics/docs/USER_GUIDE.md new file mode 100644 index 0000000..4c0e31f --- /dev/null +++ b/challenges/2-Blue-Team-Memory-Forensics/docs/USER_GUIDE.md @@ -0,0 +1,60 @@ +# Blue Team Memory Forensics - Guide Joueur + +## Objectif +Analyser un dump mémoire Windows compromis pour identifier le processus malveillant, le serveur C2 et récupérer le flag final. + +## Accès au challenge (via CTFd) + +1. Connectez-vous avec votre compte joueur. +2. Ouvrez le challenge `Blue Team - Jakub - Memoire et analyse de malware (Volatility)`. +3. Cliquez sur `Start Instance` et notez l'URL d'instance fournie par CTFd. +4. Téléchargez les artefacts depuis l'URL d'instance : + ``` + http://:8000/memory.dmp + http://:8000/network_capture.pcap + http://:8000/hints.txt + ``` + +## Outils d'analyse + +> ⚠️ **Important** : le dump `memory.dmp` est dans un **format pédagogique dédié à ce +> challenge**, pas une image mémoire brute standard. Le vrai Volatility 3 (`vol.py`) ne +> sait pas le lire, et un `strings` classique ne révèle pas le flag (il est encodé). +> Utilisez l'**outil fourni dans le conteneur** : `tools/vol_analyzer.py` (un +> « mini‑Volatility » qui reproduit les commandes `windows.*` sur ce format). + +Depuis le terminal du challenge (ou après avoir récupéré les fichiers du dépôt) : + +```bash +# Syntaxe générale +python3 tools/vol_analyzer.py -f challenge/memory.dmp + +# Commandes disponibles : +# windows.info windows.pslist windows.pstree windows.netscan +# windows.malfind windows.dlllist windows.handles windows.dumpfiles +# windows.strings windows.registry +``` + +Outils complémentaires : +- **`tools/extract_strings.py`** — extraction/décodage des chaînes du binaire extrait. +- **Wireshark / `tshark`** — analyse du PCAP réseau (`network_capture.pcap`) pour l'étape bonus. + +## Piste de résolution + +Toutes les commandes ci-dessous se lancent via `python3 tools/vol_analyzer.py -f challenge/memory.dmp `. + +1. `windows.pslist` / `windows.pstree` — cherchez un nom ou une hiérarchie suspecte. +2. Identifiez le processus suspect en regardant son PPID et sa session. +3. `windows.netscan` — vérifiez les connexions réseau associées à ce PID. +4. `windows.malfind` — recherchez de l'injection mémoire. +5. `windows.strings --pid ` (ou `tools/extract_strings.py`) — extrayez et analysez les chaînes du binaire malveillant. +6. Récupérez le flag caché dans la configuration du malware. + +## Format du flag +`blue{...}` + +## Soumission +Soumettez le flag final dans CTFd depuis la page du challenge. + +## Indices +Si vous êtes bloqué, consultez `hints.txt` téléchargé depuis l'instance. diff --git a/challenges/Blue-Team-Memory-Forensics/report/report_template.md b/challenges/2-Blue-Team-Memory-Forensics/report/report_template.md similarity index 100% rename from challenges/Blue-Team-Memory-Forensics/report/report_template.md rename to challenges/2-Blue-Team-Memory-Forensics/report/report_template.md diff --git a/challenges/Blue-Team-Memory-Forensics/setup/generate_challenge.py b/challenges/2-Blue-Team-Memory-Forensics/setup/generate_challenge.py similarity index 100% rename from challenges/Blue-Team-Memory-Forensics/setup/generate_challenge.py rename to challenges/2-Blue-Team-Memory-Forensics/setup/generate_challenge.py diff --git a/challenges/Blue-Team-Memory-Forensics/setup/generate_pcap.py b/challenges/2-Blue-Team-Memory-Forensics/setup/generate_pcap.py similarity index 100% rename from challenges/Blue-Team-Memory-Forensics/setup/generate_pcap.py rename to challenges/2-Blue-Team-Memory-Forensics/setup/generate_pcap.py diff --git a/challenges/Blue-Team-Memory-Forensics/setup/requirements.txt b/challenges/2-Blue-Team-Memory-Forensics/setup/requirements.txt similarity index 100% rename from challenges/Blue-Team-Memory-Forensics/setup/requirements.txt rename to challenges/2-Blue-Team-Memory-Forensics/setup/requirements.txt diff --git a/challenges/Blue-Team-Memory-Forensics/solution/SOLUTION.md b/challenges/2-Blue-Team-Memory-Forensics/solution/SOLUTION.md similarity index 100% rename from challenges/Blue-Team-Memory-Forensics/solution/SOLUTION.md rename to challenges/2-Blue-Team-Memory-Forensics/solution/SOLUTION.md diff --git a/challenges/Blue-Team-Memory-Forensics/solution/validate_flag.py b/challenges/2-Blue-Team-Memory-Forensics/solution/validate_flag.py similarity index 100% rename from challenges/Blue-Team-Memory-Forensics/solution/validate_flag.py rename to challenges/2-Blue-Team-Memory-Forensics/solution/validate_flag.py diff --git a/challenges/Blue-Team-Memory-Forensics/tools/extract_strings.py b/challenges/2-Blue-Team-Memory-Forensics/tools/extract_strings.py similarity index 100% rename from challenges/Blue-Team-Memory-Forensics/tools/extract_strings.py rename to challenges/2-Blue-Team-Memory-Forensics/tools/extract_strings.py diff --git a/challenges/Blue-Team-Memory-Forensics/tools/vol_analyzer.py b/challenges/2-Blue-Team-Memory-Forensics/tools/vol_analyzer.py similarity index 100% rename from challenges/Blue-Team-Memory-Forensics/tools/vol_analyzer.py rename to challenges/2-Blue-Team-Memory-Forensics/tools/vol_analyzer.py diff --git a/challenges/Blue-Team-Memory-Forensics/docs/USER_GUIDE.md b/challenges/Blue-Team-Memory-Forensics/docs/USER_GUIDE.md deleted file mode 100644 index 2e54c81..0000000 --- a/challenges/Blue-Team-Memory-Forensics/docs/USER_GUIDE.md +++ /dev/null @@ -1,40 +0,0 @@ -# Blue Team Memory Forensics - Guide Joueur - -## Objectif -Analyser un dump mémoire Windows compromis pour identifier le processus malveillant, le serveur C2 et récupérer le flag final. - -## Accès au challenge (via CTFd) - -1. Connectez-vous avec votre compte joueur. -2. Ouvrez le challenge `Blue Team - Jakub - Memoire et analyse de malware (Volatility)`. -3. Cliquez sur `Start Instance` et notez l'URL d'instance fournie par CTFd. -4. Téléchargez les artefacts depuis l'URL d'instance : - ``` - http://:8000/memory.dmp - http://:8000/network_capture.pcap - http://:8000/hints.txt - ``` - -## Outils recommandés (sur votre machine) -- **Volatility3** — analyse du dump mémoire (`vol.py`) -- **strings** — extraction de chaînes depuis un binaire -- **Wireshark** — analyse du PCAP réseau -- Ghidra / Radare2 (optionnel, pour l'analyse binaire avancée) - -## Piste de résolution - -1. Listez les processus (`pslist` / `pstree`) et cherchez un nom ou une hiérarchie suspecte. -2. Identifiez le processus suspect en regardant son PPID et sa session. -3. Vérifiez les connexions réseau (`netscan`) associées à ce PID. -4. Recherchez de l'injection mémoire (`malfind`). -5. Extrayez et analysez les strings du binaire malveillant. -6. Récupérez le flag caché dans la configuration du malware. - -## Format du flag -`blue{...}` - -## Soumission -Soumettez le flag final dans CTFd depuis la page du challenge. - -## Indices -Si vous êtes bloqué, consultez `hints.txt` téléchargé depuis l'instance.