Home CTFs | HeroCTF2023 | Forensic | Heap
Post
Cancel

CTFs | HeroCTF2023 | Forensic | Heap

Heap

image

In this chall we are given a .hprof file (available here). HPROF is capable of presenting CPU usage, heap allocation statistics, and monitor contention profiles. In addition, it can also report complete heap dumps and states of all the monitors and threads in the Java virtual machine.

After trying to install MTA on Eclipse without success to open the file… I found this website.

It allowed us to read its content. When searching the word hero in the search bar of the Dominator Tree we can find the following result:

image

Looking closely to what we just found out, we can find in com.hero.cryptedsecret.AESEncrypt @ 0x13323638 the variable message and the KEY:

image

We see that it was an AESEncrypt. So I created a simple python program to decode it and we find:

image

This post is licensed under CC BY 4.0 by the author.