Friday, May 20, 2016

MCSC2016-Forensics (FIND MY PASSWORD)

neeeeed help

i forgot my password , if u can help me
i have the memory dump
try to analyze this file and find the password :

my username is : challenge2016
The file command inform us that is a MDMP core dump report
This MDMP core dump is a windows proces memory dump
We use windbg or visual studio under windows 7 machine and we see that is lsass.exe dump


Lets download mimikatz tools

start a  console cmd (admin ) and start mimikatz.exe

mimikatz # sekurlsa::minidump memory.dmp
Switch to MINIDUMP
mimikatz # sekurlsa::logonPasswords


 as you can see the password for user  challenge2016 is : MoroCco2016@McSc

1 comment:

  1. I can see all details but in my case tspkg: is empty no data inside.

    ReplyDelete