Jacob-dot-bit · Jacob-dot-bit · Jul 20, 2026 · Jul 20, 2026
diff --git a/.../Blue-Team-Memory-Forensics/.dockerignore → ...-Blue-Team-Memory-Forensics/.dockerignore b/.../Blue-Team-Memory-Forensics/.dockerignore → ...-Blue-Team-Memory-Forensics/.dockerignore
diff --git a/...ges/Blue-Team-Memory-Forensics/.gitignore → ...s/2-Blue-Team-Memory-Forensics/.gitignore b/...ges/Blue-Team-Memory-Forensics/.gitignore → ...s/2-Blue-Team-Memory-Forensics/.gitignore
diff --git a/...ges/Blue-Team-Memory-Forensics/Dockerfile → ...s/2-Blue-Team-Memory-Forensics/Dockerfile b/...ges/Blue-Team-Memory-Forensics/Dockerfile → ...s/2-Blue-Team-Memory-Forensics/Dockerfile
diff --git a/...nges/Blue-Team-Memory-Forensics/README.md → ...es/2-Blue-Team-Memory-Forensics/README.md b/...nges/Blue-Team-Memory-Forensics/README.md → ...es/2-Blue-Team-Memory-Forensics/README.md
@@ -20,7 +20,7 @@ L'investigation préliminaire suggère que **l'attaquant a déployé un implant
 ## 📁 Structure du Challenge
 
 ```
-Blue-Team-Memory-Forensics/
+2-Blue-Team-Memory-Forensics/
 ├── README.md                          ← Vous êtes ici
 ├── Dockerfile                         ← Image du challenge
 ├── docker-compose.yml                 ← Orchestration Docker

diff --git a/...-Team-Memory-Forensics/docker-compose.yml → ...-Team-Memory-Forensics/docker-compose.yml b/...-Team-Memory-Forensics/docker-compose.yml → ...-Team-Memory-Forensics/docker-compose.yml
diff --git a/...eam-Memory-Forensics/docker-entrypoint.sh → ...eam-Memory-Forensics/docker-entrypoint.sh b/...eam-Memory-Forensics/docker-entrypoint.sh → ...eam-Memory-Forensics/docker-entrypoint.sh
diff --git a/...Memory-Forensics/docs/ADMIN_DEPLOYMENT.md → ...Memory-Forensics/docs/ADMIN_DEPLOYMENT.md b/...Memory-Forensics/docs/ADMIN_DEPLOYMENT.md → ...Memory-Forensics/docs/ADMIN_DEPLOYMENT.md
@@ -1,7 +1,7 @@
 # Blue Team Memory Forensics - Guide Admin/Deploiement
 
 ## 1) Build de l'image
-Depuis `Challenge/Blue-Team-Memory-Forensics`:
+Depuis `challenges/2-Blue-Team-Memory-Forensics`:
 
 ```bash
 docker build -t blue-team-memory-forensics:latest .

diff --git a/challenges/2-Blue-Team-Memory-Forensics/docs/USER_GUIDE.md b/challenges/2-Blue-Team-Memory-Forensics/docs/USER_GUIDE.md
@@ -0,0 +1,60 @@
+# Blue Team Memory Forensics - Guide Joueur
+
+## Objectif
+Analyser un dump mémoire Windows compromis pour identifier le processus malveillant, le serveur C2 et récupérer le flag final.
+
+## Accès au challenge (via CTFd)
+
+1. Connectez-vous avec votre compte joueur.
+2. Ouvrez le challenge `Blue Team - Jakub - Memoire et analyse de malware (Volatility)`.
+3. Cliquez sur `Start Instance` et notez l'URL d'instance fournie par CTFd.
+4. Téléchargez les artefacts depuis l'URL d'instance :
+   ```
+   http://<instance>:8000/memory.dmp
+   http://<instance>:8000/network_capture.pcap
+   http://<instance>:8000/hints.txt
+   ```
+
+## Outils d'analyse
+
+> ⚠️ **Important** : le dump `memory.dmp` est dans un **format pédagogique dédié à ce
+> challenge**, pas une image mémoire brute standard. Le vrai Volatility 3 (`vol.py`) ne
+> sait pas le lire, et un `strings` classique ne révèle pas le flag (il est encodé).
+> Utilisez l'**outil fourni dans le conteneur** : `tools/vol_analyzer.py` (un
+> « mini‑Volatility » qui reproduit les commandes `windows.*` sur ce format).
+
+Depuis le terminal du challenge (ou après avoir récupéré les fichiers du dépôt) :
+
+```bash
+# Syntaxe générale
+python3 tools/vol_analyzer.py -f challenge/memory.dmp <commande>
+
+# Commandes disponibles :
+#   windows.info      windows.pslist     windows.pstree    windows.netscan
+#   windows.malfind   windows.dlllist    windows.handles   windows.dumpfiles
+#   windows.strings   windows.registry
+```
+
+Outils complémentaires :
+- **`tools/extract_strings.py`** — extraction/décodage des chaînes du binaire extrait.
+- **Wireshark / `tshark`** — analyse du PCAP réseau (`network_capture.pcap`) pour l'étape bonus.
+
+## Piste de résolution
+
+Toutes les commandes ci-dessous se lancent via `python3 tools/vol_analyzer.py -f challenge/memory.dmp <commande>`.
+
+1. `windows.pslist` / `windows.pstree` — cherchez un nom ou une hiérarchie suspecte.
+2. Identifiez le processus suspect en regardant son PPID et sa session.
+3. `windows.netscan` — vérifiez les connexions réseau associées à ce PID.
+4. `windows.malfind` — recherchez de l'injection mémoire.
+5. `windows.strings --pid <PID>` (ou `tools/extract_strings.py`) — extrayez et analysez les chaînes du binaire malveillant.
+6. Récupérez le flag caché dans la configuration du malware.
+
+## Format du flag
+`blue{...}`
+
+## Soumission
+Soumettez le flag final dans CTFd depuis la page du challenge.
+
+## Indices
+Si vous êtes bloqué, consultez `hints.txt` téléchargé depuis l'instance.
diff --git a/...emory-Forensics/report/report_template.md → ...emory-Forensics/report/report_template.md b/...emory-Forensics/report/report_template.md → ...emory-Forensics/report/report_template.md
diff --git a/...ory-Forensics/setup/generate_challenge.py → ...ory-Forensics/setup/generate_challenge.py b/...ory-Forensics/setup/generate_challenge.py → ...ory-Forensics/setup/generate_challenge.py
diff --git a/...m-Memory-Forensics/setup/generate_pcap.py → ...m-Memory-Forensics/setup/generate_pcap.py b/...m-Memory-Forensics/setup/generate_pcap.py → ...m-Memory-Forensics/setup/generate_pcap.py
diff --git a/...m-Memory-Forensics/setup/requirements.txt → ...m-Memory-Forensics/setup/requirements.txt b/...m-Memory-Forensics/setup/requirements.txt → ...m-Memory-Forensics/setup/requirements.txt
diff --git a/...eam-Memory-Forensics/solution/SOLUTION.md → ...eam-Memory-Forensics/solution/SOLUTION.md b/...eam-Memory-Forensics/solution/SOLUTION.md → ...eam-Memory-Forensics/solution/SOLUTION.md
diff --git a/...emory-Forensics/solution/validate_flag.py → ...emory-Forensics/solution/validate_flag.py b/...emory-Forensics/solution/validate_flag.py → ...emory-Forensics/solution/validate_flag.py
diff --git a/...Memory-Forensics/tools/extract_strings.py → ...Memory-Forensics/tools/extract_strings.py b/...Memory-Forensics/tools/extract_strings.py → ...Memory-Forensics/tools/extract_strings.py
diff --git a/...am-Memory-Forensics/tools/vol_analyzer.py → ...am-Memory-Forensics/tools/vol_analyzer.py b/...am-Memory-Forensics/tools/vol_analyzer.py → ...am-Memory-Forensics/tools/vol_analyzer.py
diff --git a/challenges/Blue-Team-Memory-Forensics/docs/USER_GUIDE.md b/challenges/Blue-Team-Memory-Forensics/docs/USER_GUIDE.md