pugazhendii22/keepass-exfil-forensicsNetwork forensics writeup + tooling for a TryHackMe DFIR challenge: reverses a hex→Base64→XOR exfiltration chain from PCAP traffic, then recovers a KeePass master password from a process memory dump via CVE-2023-32784.
Recovers exfiltrated data from PCAP traffic by reversing a hex → Base64 → XOR obfuscation chain used in a real DFIR CTF scenario (TryHackMe), then exploits CVE-2023-32784 to recover a KeePass master password straight from a process memory dump.
Victim workstation Attacker C2 Server
------------------- -------------------
Malicious .ps1 downloaded over HTTP
|
v
Downloads ProcDump (legit Sysinternals tool)
|
v
Dumps KeePass process memory ----------------------> port 1337
(XOR 0x41 + Base64 encoded first)
Steals Database1337.kdbx --------------------------> port 1338
(XOR 0x42 + Base64 encoded first)
| Path | Description |
|---|
docs/writeup.md | Full step-by-step investigation writeup |
decoder.py | Generalized tool to reverse the hex → Base64 → XOR chain |
evidence/xxxmmdcclxxxiv.ps1 | The recovered malicious PowerShell script |
# 1. Extract the raw exfil stream from a pcap with tshark
tshark -r capture.pcapng -T fields -e data \
-Y "ip.dst == <C2_IP> and tcp.port == <PORT>" > payload.txt
# 2. Reverse the obfuscation
python3 decoder.py payload.txt recovered_file.bin --xor-key 0x41
tshark (GUI tools don't scale well past a few hundred MB)Investigation based on the TryHackMe room Extracted. Password-recovery technique made possible by keepass-dump-extractor by JorianWoltjer, based on the original CVE-2023-32784 research by vdohney.
This repo documents a CTF/lab exercise for educational purposes. No real credentials, systems, or data were involved. Flag values and specific captured passwords from the CTF room are intentionally omitted out of respect for TryHackMe's platform guidelines.