{"id":4962,"date":"2014-01-27T01:08:28","date_gmt":"2014-01-26T16:08:28","guid":{"rendered":"http:\/\/mimumimu.net\/blog\/?p=4962"},"modified":"2014-05-23T15:45:29","modified_gmt":"2014-05-23T06:45:29","slug":"seccon-ctfweb%e4%ba%88%e9%81%b8%e3%81%ab%e5%8f%82%e5%8a%a0%e3%81%97%e3%81%a6%e3%81%8c%e3%82%93%e3%81%b0%e3%81%a3%e3%81%9f","status":"publish","type":"post","link":"https:\/\/mimumimu.net\/blog\/2014\/01\/27\/seccon-ctfweb%e4%ba%88%e9%81%b8%e3%81%ab%e5%8f%82%e5%8a%a0%e3%81%97%e3%81%a6%e3%81%8c%e3%82%93%e3%81%b0%e3%81%a3%e3%81%9f\/","title":{"rendered":"SECCON CTF&ndash;Web\u4e88\u9078\u306b\u53c2\u52a0\u3057\u3066\u304c\u3093\u3070\u3063\u305f"},"content":{"rendered":"<p>\u306b\u3083\u3093\u3071\u3059\u30fc\u3002 \u3069\u3046\u3082\u307f\u3080\u3089\u3067\u3059\u3002<\/p>\n<p>\u6700\u8fd1\u3001\u4eca\u9803\u306b\u306a\u3063\u3066\u300c\u306e\u3093\u306e\u3093\u3073\u3088\u308a\u300d\u3092\u898b\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u3066\u3001    <br \/>\u81ea\u5b85\u4ed8\u8fd1\u306b\u3082\u7121\u4eba\u306e\u91ce\u83dc\u76f4\u58f2\u6240\u3068\u304b\u3042\u308b\u306a\u30fc\u3068\u3001\u898b\u3066\u3044\u3066\u307b\u306e\u307c\u306e\u3057\u3066\u3044\u308b\u4eca\u65e5\u3053\u306e\u9803\u3067\u3059\u3002<\/p>\n<p>&#160;<\/p>\n<p>\u3055\u3066\u3055\u3066\u3002\u4eca\u56de\u306f SECCON CTF \u306e Web\u4e88\u9078\u306b wasamusume \u3068\u3057\u3066\u53c2\u52a0\u3057\u307e\u3057\u305f\u3002<\/p>\n<p>\u521d\u65e5\u304c\u6240\u5c5e\u3059\u308b\u5927\u5b66\u306e\u4e2d\u9593\u767a\u8868\u65e5\u3067\u3042\u3063\u305f\u308a\u3001    <br \/>\u666e\u6bb5\u4f7f\u3063\u3066\u3044\u308b\u30e9\u30c3\u30d7\u30c8\u30c3\u30d7PC \u304c\u4e0d\u8abf\u306b\u306a\u3063\u305f\u308a\u3068\u3044\u308d\u3044\u308d\u3068\u3042\u308a\u307e\u3057\u305f\u304c\u3001     <br \/>\u3068\u3066\u3082\u697d\u3057\u304b\u3063\u305f\u3067\u3059\u3002<\/p>\n<p>\u904b\u55b6\u306e\u7686\u3055\u3093\u6bce\u5ea6\u6bce\u5ea6\u3001\u672c\u5f53\u306b\u3042\u308a\u304c\u3068\u3046\u3054\u3056\u3044\u307e\u3059\u3002<\/p>\n<p>&#160;<\/p>\n<p>\u4eca\u56de\u306f\u3044\u3064\u3082\u306e\u30e1\u30f3\u30d0\u30fc\u306b zip \u3055\u3093\u3092\u5165\u308c\u3066\u3002<\/p>\n<p>\u3084\u3063\u3071\u308a\u3053\u3046\u3044\u3046\u306e\u306f\u307f\u3093\u306a\u3067\u30ef\u30a4\u30ef\u30a4\u3068\u3084\u308b\u306e\u304c\u4e00\u756a\u3044\u3044\u3067\u3059\u306d\u3002    <br \/>\u7b2c\u4e00\u306b\u697d\u3057\u3044\u3067\u3059\u3057\u3001\u30c1\u30fc\u30e0\u5185\u306e\u89e3\u6cd5\u306f\u5168\u4f53\u3067\u5171\u6709\u3057\u3066\u3044\u308b\u306e\u3067     <br \/>\u65b0\u3057\u304f\u6765\u305f\u30e1\u30f3\u30d0\u30fc\u3084\u65e2\u5b58\u306e\u30e1\u30f3\u30d0\u30fc\u3069\u3063\u3061\u3082\u304a\u3044\u3057\u3044\u3002     <br \/>\u305d\u3057\u3066\u3001\u4ea4\u6d41\u3082\u6df1\u307e\u308b\u3002\u4e00\u77f3n\u9ce5\u3063\u3066\u3068\u3053\u308d\u3067\u3057\u3087\u3046\u304b\uff08<\/p>\n<p>&#160;<\/p>\n<p>\u79c1\u306f hyt \u3055\u3093\u3068\u4e00\u7dd2\u306b\u5927\u5b66\u5185\u306b\u7c21\u6613CTF\u4f1a\u5834\u3092\u8a2d\u7f6e\u3057\u3066\u53d6\u308a\u7d44\u307f\u307e\u3057\u305f\u3002<\/p>\n<p><a href=\"http:\/\/mimumimu.net\/blog\/wp-content\/uploads\/2014\/01\/BezbtJvCQAAyDn2.jpg\"><img loading=\"lazy\" decoding=\"async\" title=\"BezbtJvCQAAyDn2\" style=\"border-left-width: 0px; border-right-width: 0px; background-image: none; border-bottom-width: 0px; padding-top: 0px; padding-left: 0px; display: inline; padding-right: 0px; border-top-width: 0px\" border=\"0\" alt=\"BezbtJvCQAAyDn2\" src=\"http:\/\/mimumimu.net\/blog\/wp-content\/uploads\/2014\/01\/BezbtJvCQAAyDn2_thumb.jpg\" width=\"435\" height=\"327\" \/><\/a><\/p>\n<p>\u591c\u304b\u3089\u306f\u5404\u3005\u81ea\u5b85\u306b\u3066\u3002<\/p>\n<p>\u306a\u304a\u3001\u4e5d\u5dde\u7d44\u306f\u7814\u7a76\u5ba4\u6cca\u307e\u308a\u8fbc\u307f\u3067\u3084\u3063\u305f\u305d\u3046\u3067\u3059\u3002    <br \/>\u6b21\u56de\u306f\u30db\u30c6\u30eb\u3068\u304b\u3092\u501f\u308a\u3066\u3001\u6cca\u307e\u308a\u8fbc\u307f\u3067 CTF \u3084\u308a\u305f\u3044\u3067\u3059\u306d\u3002<\/p>\n<p>&#160;<\/p>\n<p>\u3055\u3066\u3001\u3053\u3046\u3044\u3046\u3076\u3063\u901a\u3057\u306e CTF \u3067\u305f\u307e\u306b\u601d\u3046\u306e\u306f\u3001    <br \/>\u201d\u4f11\u61a9\u201d \u3068 \u201c\u98df\u4e8b\u201d \u3068 \u201c\u7761\u7720\u201d \u3067\u3057\u3087\u3046\u304b\u3002\u52b9\u7387\u3088\u304f\u53d6\u3089\u306a\u3044\u3068\u3002<\/p>\n<p>\u3055\u3059\u304c\u306b\u521d\u65e5\u304c\u4e2d\u9593\u767a\u8868\u4f1a\u3067\u3042\u3063\u305f\u95a2\u4fc2\u3067\u65e9\u8d77\u304d\u3057\u305f\u3053\u3068\u3082\u3042\u308a\u3001    <br \/>\u7d42\u308f\u308a\u969b\u306f\u306a\u304b\u306a\u304b\u306b\u7720\u304f\u3066\u4eee\u7720\u3092\u5c11\u3057\u53d6\u308a\u307e\u3057\u305f\u3002<\/p>\n<p>\u30fb\u30fb\u3060\u304b\u3089\u3068\u3044\u3063\u3066\u3001\u3088\u304f\u89e3\u3051\u305f\u304b\u3068\u3044\u3046\u3068\u3001\u3046\u30fc\u3093\u3002<\/p>\n<p>&#160;<\/p>\n<p>\u305d\u3046\u3044\u3048\u3070\u3001\u4e00\u90e8\u3067\u306f\u306a\u3093\u3067\u3082 \u201c\u4eba\u6a29\u201d \u3068\u3044\u3046\u3053\u3068\u3067\u3001    <br \/>\u53d6\u5f97\u3057\u305f\u5f97\u70b9\u306b\u3088\u3063\u3066\u306f \u201c (CTF) \u793e\u4f1a\u7684\u306b\u4eba\u9593\u3068\u3057\u3066\u8a8d\u3081\u3089\u308c\u308b\u6a29\u5229\u201d \u304c\u8a8d\u3081\u3089\u308c\u306a\u3044\u3053\u3068\u304c\u3042\u308b\u305d\u3046\u3067\u3001\u6016\u3044\u4e16\u306e\u4e2d\u3067\u3059\u3002<\/p>\n<p>\u3082\u3061\u308d\u3093\u3001 wasamusume \u5185\u3067\u306f\u30c1\u30fc\u30e0\u5168\u54e1\u306b \u201cCTF \u793e\u4f1a\u7684\u306b\u4eba\u9593\u3068\u3057\u3066\u30fb\u30fb\u201d \u306f    <br \/>\u305f\u3068\u3048 0\u70b9\u3067\u3042\u308d\u3046\u3068\u8a8d\u3081\u307e\u3059\u3002 \u30fb\u30fb\u30fb\u3068\u3044\u3046\u304b\u3001\u3053\u308c\u304c\u5265\u596a\u3055\u308c\u308b\u30c1\u30fc\u30e0\u3001\u6016\u3059\u304e\u3067\u3059\u3002\u3002<\/p>\n<p>\u30fb\u30fb\u5197\u8ac7\u306f\u3055\u3066\u304a\u304d\u3002<\/p>\n<p>&#160;<\/p>\n<p>&#160;<\/p>\n<p>\u4eca\u56de\u7d39\u4ecb\u3059\u308b\u306e\u306f    <br \/>\u201cEnjoy the Game\u201d     <br \/>\u201c\u524a\u9664\u3055\u308c\u3066\u3044\u308b\u30d5\u30a1\u30a4\u30eb\u306e\u540d\u524d\u306f\u306a\u3093\u3067\u3059\u304b\uff1f\u201d     <br \/>\u201d\u30ed\u30b0\u30a4\u30f3\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u89e3\u660e\u305b\u3088\u201d     <br \/>\u306e\uff13\u3064\u3092\u3002<\/p>\n<hr \/>\n<h3>Enjoy the Game<\/h3>\n<p><a href=\"http:\/\/mimumimu.net\/blog\/wp-content\/uploads\/2014\/01\/image.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-left-width: 0px; border-right-width: 0px; background-image: none; border-bottom-width: 0px; padding-top: 0px; padding-left: 0px; display: inline; padding-right: 0px; border-top-width: 0px\" border=\"0\" alt=\"image\" src=\"http:\/\/mimumimu.net\/blog\/wp-content\/uploads\/2014\/01\/image_thumb.png\" width=\"405\" height=\"321\" \/><\/a><\/p>\n<p>\u3053\u3093\u306a\u611f\u3058\u306e\u30b2\u30fc\u30e0\u304c\u8d77\u52d5\u3057\u307e\u3059\u3002    <br \/>\u30b4\u30fc\u30eb\u307e\u3067\u884c\u3051\u3070\u30d5\u30e9\u30b0\u304c\u51fa\u308b\u3001\u3068\u306e\u3053\u3068\u3067\u3059\u304c\u30b4\u30fc\u30eb\u306b\u3044\u3064\u307e\u3067\u7d4c\u3063\u3066\u3082\u305f\u3069\u308a\u7740\u3051\u307e\u305b\u3093\u3002<\/p>\n<p>\u3067\u3082\u3063\u3066\u8272\u3005\u3068\u3044\u3058\u3063\u3066\u307f\u307e\u3059\u3002<\/p>\n<p><a href=\"http:\/\/mimumimu.net\/blog\/wp-content\/uploads\/2014\/01\/image1.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-left-width: 0px; border-right-width: 0px; background-image: none; border-bottom-width: 0px; padding-top: 0px; padding-left: 0px; display: inline; padding-right: 0px; border-top-width: 0px\" border=\"0\" alt=\"image\" src=\"http:\/\/mimumimu.net\/blog\/wp-content\/uploads\/2014\/01\/image_thumb1.png\" width=\"401\" height=\"318\" \/><\/a><\/p>\n<p>\u753b\u9762\u304c\u6697\u3044\u306e\u3067\u3059\u304c\u3001\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u9ad8\u3055\u3092\uff10\u306b\u3057\u3066\u307f\u307e\u3059\u3068\u3001    <br \/>\u672c\u6765\u305f\u3069\u308c\u306a\u3044\u5834\u6240\u306b\u30b4\u30fc\u30eb\u304c\u3042\u308b\u3053\u3068\u306b\u6c17\u3065\u304d\u307e\u3059\u3002<\/p>\n<p>&#160;<\/p>\n<p>\u3057\u3087\u3046\u304c\u7121\u3044\u306e\u3067\u3001 IDA \u3067\u52d5\u304d\u3092\u898b\u3066\u307f\u307e\u3059\u3068\u3001<\/p>\n<p><a href=\"http:\/\/mimumimu.net\/blog\/wp-content\/uploads\/2014\/01\/image2.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-left-width: 0px; border-right-width: 0px; background-image: none; border-bottom-width: 0px; padding-top: 0px; padding-left: 0px; display: inline; padding-right: 0px; border-top-width: 0px\" border=\"0\" alt=\"image\" src=\"http:\/\/mimumimu.net\/blog\/wp-content\/uploads\/2014\/01\/image_thumb2.png\" width=\"467\" height=\"485\" \/><\/a><\/p>\n<p>0x1400016C7 \u306b \u201ccmp al,1\u201d \u3068\u3057\u3066\u3001    <br \/>\u524d\u306b\u9032\u3081\u308b\u304b\u3069\u3046\u304b\u3092\u5224\u5b9a\u3057\u3066\u3044\u308b\u7b87\u6240\u304c\u307f\u3064\u304b\u308a\u307e\u3059\u306e\u3067\u3001     <br \/>\u3053\u306e\u5148\u306e jz \u3092 jmp \u306b\u66f8\u304d\u63db\u3048\u307e\u3059\u3002<\/p>\n<p>\u4e00\u756a\u30b7\u30f3\u30d7\u30eb\u306a\u65b9\u6cd5\u3068\u3044\u3046\u3053\u3068\u3067\u3001    <br \/><u>game.exe \u306e 0xAC9 \u306b\u3042\u308b 0x74 \u3092 0xEB \u306b\u66f8\u304d\u63db\u3048\u307e\u3059\u3002<\/u><\/p>\n<p>\u305d\u3046\u3059\u308b\u3068\u3001 <u>\u201c74 04\u201d<\/u>&#160;<u>( jz 0x1001006 ) \u304c \u201cEB 04\u201d ( jmp 0x1001006 ) <\/u>\u3068\u306a\u308a\u3001     <br \/>\u58c1\u306b\u5f53\u305f\u3063\u3066\u3044\u3088\u3046\u304c\u306a\u3093\u3067\u3042\u308d\u3046\u304c\u7a81\u9032\u3059\u308b\u3053\u3068\u304c\u51fa\u6765\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<p>\u30d1\u30c3\u30c1\u5f8c:<\/p>\n<p><a href=\"http:\/\/mimumimu.net\/blog\/wp-content\/uploads\/2014\/01\/image4.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-left-width: 0px; border-right-width: 0px; background-image: none; border-bottom-width: 0px; padding-top: 0px; padding-left: 0px; display: inline; padding-right: 0px; border-top-width: 0px\" border=\"0\" alt=\"image\" src=\"http:\/\/mimumimu.net\/blog\/wp-content\/uploads\/2014\/01\/image_thumb4.png\" width=\"333\" height=\"534\" \/><\/a><\/p>\n<p>\u3059\u3063\u304d\u308a\u3067\u3059\u306d\uff01<\/p>\n<p>&#160;<\/p>\n<p>&#160;<\/p>\n<p>\u3067\u3082\u3063\u3066\u3001\u30b4\u30fc\u30eb\u306e\u5834\u6240\u306b\u76f4\u884c\u3059\u308b\u3068\u3001<\/p>\n<p><a href=\"http:\/\/mimumimu.net\/blog\/wp-content\/uploads\/2014\/01\/image3.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-left-width: 0px; border-right-width: 0px; background-image: none; border-bottom-width: 0px; padding-top: 0px; padding-left: 0px; margin: 0px; display: inline; padding-right: 0px; border-top-width: 0px\" border=\"0\" alt=\"image\" src=\"http:\/\/mimumimu.net\/blog\/wp-content\/uploads\/2014\/01\/image_thumb3.png\" width=\"158\" height=\"159\" \/><\/a><\/p>\n<p>\u3053\u306e\u30c0\u30a4\u30a2\u30ed\u30b0\u304c\u3002<\/p>\n<p>&#160;<\/p>\n<p>\u3053\u306e\u30d7\u30ed\u30b0\u30e9\u30e0\u306e\u30c7\u30d0\u30c3\u30b0\u60c5\u5831\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u304c    <br \/>\u201d3D_GameAAA_is_NOT_password_Enjoy_HackingAAAAAAAA\u2026\u201d \u306b\u306a\u3063\u3066\u3044\u308b\u3068\u3053\u308d\u304b\u3089\u3082     <br \/>\u5206\u304b\u308b\u3068\u304a\u308a\u3001\u3053\u3044\u3064\u306f\u7b54\u3048\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002<\/p>\n<p>&#160;<\/p>\n<p>\u3050\u308b\u3050\u308b\u56de\u3063\u3066\u7b54\u3048\u306e\u5834\u6240\u306b\u884c\u304d\u307e\u3059\u3068\u3001 \u201c3D_dUNGEAN\u201d \u306a\u3069\u3044\u308d\u3044\u308d\u3068\u5909\u5316\u3057\u307e\u3059\u3002<\/p>\n<p>\u305d\u306e\u4f55\u308c\u3082 NG \u3067\u3057\u305f\u306e\u3067\u3001\u3046\u30fc\u3093\u3068\u60a9\u3093\u3067\u3044\u305f\u3068\u3053\u308d \u3086\u3063\u305f\u3093\u304c    <br \/><u><strong>\u201d3D_dUnGEoN\u201d<\/strong><\/u> \u3068\u3057\u3066\u9001\u4fe1\u3057\u305f\u3068\u3053\u308d\u6b63\u89e3\u3002<\/p>\n<p>\u30fb\u30fb\u30fb\u3069\u3046\u3044\u3046\u30eb\u30fc\u30c8\u3092\u901a\u3063\u305f\u3089\u6b63\u3057\u3044\u3093\u3060\u308d\u3046\u30fb\u30fb\u3002\u3067\u3082\u7b54\u3048\u306f\u898b\u3064\u304b\u3063\u305f\u3057\u30fb\u30fb\u3068\u3002    <br \/>\u305a\u3044\u3076\u3093\u3068\u3082\u3084\u3082\u3084\u3002<\/p>\n<hr \/>\n<h3>\u524a\u9664\u3055\u308c\u3066\u3044\u308b\u30d5\u30a1\u30a4\u30eb\u306e\u540d\u524d\u306f\u306a\u3093\u3067\u3059\u304b\uff1f<\/h3>\n<p>\u554f\u984c\u3068\u3057\u3066\u3001MFT \u306e\u30c7\u30fc\u30bf\u304c\u3082\u3089\u3048\u307e\u3059\u3002<\/p>\n<p><a title=\"http:\/\/malware-hunters.net\/2012\/09\/13\/mftdump-v-1-3-0-released\/\" href=\"http:\/\/malware-hunters.net\/2012\/09\/13\/mftdump-v-1-3-0-released\/\">http:\/\/malware-hunters.net\/2012\/09\/13\/mftdump-v-1-3-0-released\/<\/a><\/p>\n<p>\u3053\u3053\u306b\u3042\u308b MFTDump \u3092\u4f7f\u3044\u307e\u3059\u3068\u3001\u3044\u3044\u611f\u3058\u306b tsv \u5f62\u5f0f\u3067\u51fa\u3057\u3066\u304f\u308c\u307e\u3059\u306e\u3067    <br \/>\u5f8c\u306f\u305d\u306e\u8868\u3092 Excel \u306a\u3093\u304b\u306b\u5165\u308c\u3066\u691c\u7d22\u3002<\/p>\n<p>\u7b54\u3048\u306f SkyhookParser.exe<\/p>\n<p>&#160;<\/p>\n<hr \/>\n<h3>\u30ed\u30b0\u30a4\u30f3\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u89e3\u660e\u305b\u3088<\/h3>\n<p>\u554f\u984c\u3068\u3057\u3066\u3001 1GB \u306e\u30e1\u30e2\u30ea\u30c0\u30f3\u30d7\u304c\u6e21\u3055\u308c\u307e\u3059\u3002<\/p>\n<p>\u307e\u305a Volatility \u3092\u4f7f\u7528\u3057\u3066\u3001 hivelist \u3092\u51fa\u529b\u3057\u3066\u76ee\u7684\u306e\u30d5\u30a1\u30a4\u30eb\u306e\u5834\u6240\u3092\u898b\u3064\u3051\u307e\u3059\u3002<\/p>\n<div id=\"scid:f32c3428-b7e9-4f15-a8ea-c502c7ff2e88:f05d0952-4b27-47b0-b876-80f1555ae447\" class=\"wlWriterSmartContent\" style=\"float: none; padding-bottom: 0px; padding-top: 0px; padding-left: 0px; margin: 0px; display: inline; padding-right: 0px\">\n<pre class=\"brush: python;\"># volatility hivelist -f memorydump2.bin --profile=Win7SP1x86\n\nVolatility Foundation Volatility Framework 2.3.1\nVirtual    Physical   Name\n---------- ---------- ----\n0x9ff5a3c0 0x37fbb3c0 \\SystemRoot\\System32\\Config\\SECURITY\n0x9ffc03a0 0x30e243a0 \\SystemRoot\\System32\\Config\\SAM\n0x8f60c568 0x04bbc568 [no name]\n0x8f61c008 0x005d2008 \\REGISTRY\\MACHINE\\SYSTEM\n0x8f6448d8 0x04b3c8d8 \\REGISTRY\\MACHINE\\HARDWARE\n0x90659650 0x199c0650 \\??\\C:\\Windows\\ServiceProfiles\\NetworkService\\NTUSER.DAT\n0x906d8008 0x13200008 \\??\\C:\\Windows\\ServiceProfiles\\LocalService\\NTUSER.DAT\n0x93cf5008 0x38814008 \\Device\\HarddiskVolume1\\Boot\\BCD\n0x93d479d0 0x388c19d0 \\SystemRoot\\System32\\Config\\SOFTWARE\n0x989bc008 0x37920008 \\SystemRoot\\System32\\Config\\DEFAULT\n0x9e6e69d0 0x005469d0 \\??\\C:\\Users\\forensics\\ntuser.dat\n0x9efe5650 0x028aa650 \\??\\C:\\Users\\forensics\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat <\/pre>\n<\/div>\n<p>&#160;<\/p>\n<p>\u6b21\u306b\u3001SYSTEM \u3068 SAM \u306e\u30c7\u30fc\u30bf\u3092\u7528\u3044\u3066 hashdump \u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>\n<div id=\"scid:f32c3428-b7e9-4f15-a8ea-c502c7ff2e88:5f1683ea-bd8e-451a-830b-4b9d5a5e9cd6\" class=\"wlWriterSmartContent\" style=\"float: none; padding-bottom: 0px; padding-top: 0px; padding-left: 0px; margin: 0px; display: inline; padding-right: 0px\">\n<pre class=\"brush: text;\">#volatility hashdump -f Memorydump2.bin --profile=Win7SP1x86 -y 0x8f61c008 -s 0x9ffc03a0\n\nAdministrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::\nGuest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::\nforensics:1000:aad3b435b51404eeaad3b435b51404ee:98ffdb1b29e7c88954326cd4011141d8:::<\/pre>\n<\/div>\n<p>\u3053\u3053\u307e\u3067\u6765\u308c\u3070\u3001\u5f8c\u306f Ophcrack ( <a title=\"http:\/\/ophcrack.sourceforge.net\/\" href=\"http:\/\/ophcrack.sourceforge.net\/\">http:\/\/ophcrack.sourceforge.net\/<\/a> ) \u3092\u5229\u7528\u3057\u3066\u3001<\/p>\n<p>\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u6c42\u3081\u307e\u3059\u3002<\/p>\n<p>\u624b\u5143\u306e\u30ce\u30fc\u30c8PC\u3067\u6570\u79d2\u3002 \u7b54\u3048\u306f \u201cKani3\u201d<\/p>\n<hr \/>\n<p>\u4eca\u56de\u306e CTF \u3092\u901a\u3057\u3066\u3001\u731b\u52c9\u5f37\u3057\u306a\u3044\u3068\u30de\u30ba\u3044\u306a\u3068\u5f37\u304f\u5b9f\u611f\u3057\u305f\u4eca\u65e5\u3053\u306e\u9803\u3067\u3059\u3002\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u306b\u3083\u3093\u3071\u3059\u30fc\u3002 \u3069\u3046\u3082\u307f\u3080\u3089\u3067\u3059\u3002 \u6700\u8fd1\u3001\u4eca\u9803\u306b\u306a\u3063\u3066\u300c\u306e\u3093\u306e\u3093\u3073\u3088\u308a\u300d\u3092\u898b\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3057\u3066\u3001 \u81ea\u5b85\u4ed8\u8fd1\u306b\u3082\u7121\u4eba\u306e\u91ce\u83dc\u76f4\u58f2\u6240\u3068\u304b\u3042\u308b\u306a\u30fc\u3068\u3001\u898b\u3066\u3044\u3066\u307b\u306e\u307c\u306e\u3057\u3066\u3044\u308b\u4eca\u65e5\u3053\u306e\u9803\u3067\u3059\u3002 &#160; \u3055\u3066\u3055\u3066\u3002\u4eca\u56de\u306f SE [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[486,487],"class_list":["post-4962","post","type-post","status-publish","format-standard","hentry","category-other","tag-seccon-ctfndash","tag-web"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/mimumimu.net\/blog\/wp-json\/wp\/v2\/posts\/4962","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mimumimu.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mimumimu.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mimumimu.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/mimumimu.net\/blog\/wp-json\/wp\/v2\/comments?post=4962"}],"version-history":[{"count":0,"href":"https:\/\/mimumimu.net\/blog\/wp-json\/wp\/v2\/posts\/4962\/revisions"}],"wp:attachment":[{"href":"https:\/\/mimumimu.net\/blog\/wp-json\/wp\/v2\/media?parent=4962"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mimumimu.net\/blog\/wp-json\/wp\/v2\/categories?post=4962"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mimumimu.net\/blog\/wp-json\/wp\/v2\/tags?post=4962"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}