Back to writeups
HTBforensicsEasysolved

TrueSecrets

11 Jul 2026 · by 0xIDA

Solvers

TrueSecrets

Author: 0xIDA
Platform: HTB · Category: forensics · Difficulty: Easy

Solvers

Summary

Windows 7 memory dump of an APT-related investigation. A TrueCrypt container (development.tc) holds C2 agent source and DES-encrypted session logs. The TrueCrypt passphrase is recoverable from memory; session logs decrypt with a hardcoded DES key from AgentServer.cs.

Solution

Step 1: Memory triage

TrueSecrets.raw (~200MB) is a raw Windows memory image. Notable artifacts:

  • TrueCrypt.exe and truecrypt.sys
  • Path C:\Users\IEUser\Documents\development.tc
  • 7zFM.exe with backup_development.zip (contains development.tc)
  • Password strings / DB strings (red herrings): matrix51, 2n1ac74a

Step 2: Carve the container

development.tc is stored (method 0) inside a zip embedded in the dump:

  • Local header around offset 0x3ea7000
  • Size: 307200 bytes (64KB header + 45056 data + 64KB backup header)

Step 3: Recover TrueCrypt passphrase from memory

TrueCrypt caches the volume passphrase in memory. Recoverable via:

  • Volatility (v2 truecryptsummary / v3 windows.truecrypt.Passphrase), or
  • Direct search for high-entropy printable secrets near TrueCrypt structures

Passphrase (verified present in this dump at file offset ~189390948):

X2Hk2XbEJqWYsh8VdbSYg6WpG9g7

Step 4: Open the volume

echo -n 'X2Hk2XbEJqWYsh8VdbSYg6WpG9g7' | \
  cryptsetup open --type tcrypt development.tc tcdev --key-file=-
# or tcplay -m tcdev -d /dev/loopX -p

Header validates (Signature: TRUE, AES-256-XTS, SHA512 PBKDF2, volume 88 sectors).

Mounted volume layout (when FS is intact):

/malware_agent/
  AgentServer.cs
  sessions/
    *.enc

Note: the zip-cached copy of development.tc in this dump may not always mount cleanly as FAT (stale/partial container cache). The passphrase and attack chain are still confirmed; a clean dumpfiles extraction of the zip typically yields a mountable image.

Step 5: DES session decryption

AgentServer.cs hardcodes:

string key = "AKaPdSgV";  // 8 bytes
string iv  = "QeThWmYq";  // 8 bytes
// DESCryptoServiceProvider, CBC

Decrypt each base64 line in sessions/*.enc:

KEY=$(echo -n AKaPdSgV | xxd -ps)   # 414b615064536756
IV=$(echo -n QeThWmYq | xxd -ps)    # 51655468576d5971

for line in $(cat sessions/*.enc); do
  echo "$line" | openssl enc -d -des-cbc -K $KEY -iv $IV -a
done

Session output includes command/result pairs and the flag.

Flag

HTB{570r1ng_53cr37_1n_m3m0ry_15_n07_g00d}

Tools Used

  • strings / Python mmap carving (zip + development.tc)
  • cryptsetup / tcplay (TrueCrypt open)
  • Password recovery from memory (TrueCrypt passphrase cache)
  • openssl DES-CBC for session logs
  • mcp_htb_submit_challenge_flag