This project just follows this excellent write-up from MDSec: Analysing LastPass, Part 1.
https://www.google.com/chrome/
https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer
https://mh-nexus.de/en/hxd/
https://www.lastpass.com/Click the "Get LastPass Free" button.
Fill in the form, as shown below.
Use a disposable email address, such as YOURNAME@mailinator.com.
Click the "Sign Up-It's Free" button.
Add a fake password with these values, as shown below:
There are several Chrome processes, as shown below.
Hover the mouse over a Chrome process to see its command line.
Find the process with this switch, outlined in red in the image below:
-- extension-process
In the Properties sheet, click the Job tab.
Find the PID (Process ID). When I did it, the PID was 2684, as shown below.
From the menu bar, click Tools, "Open main memory...".
Find the Process ID of the process containing the LastPass extension, as shown below, and double-click it.
In the "Search for" field, enter testpassword1234, as shown below.
F 211.1: Password Label (15 pts)
The flag is the word before your unencrypted password, covered by a green rectangle in the image below.
https://getfirefox.com
https://www.keepersecurity.comAt the top right, click "Try it Free".
Click "Personal and Family".
Enter a disposable email address ending in mailinator.com and click "Try it Free Now".
Create an account, log in, and add a password to your Vault containing the string CCSF#.
Install the Browser Extension.
F 211.2: Finding the Process Containing Private Data (10 pts)
It's difficult to find the correct Firefox process. You don't always see the same indicator. Look for one of these clues:In HxD, search that Firefox process for the string "CCSF#" in Unicode, as shown below.
- A DLL with a name containing "keepersecurity" or "formautofill"
- A handle to File \Device\KsecDD
The flag is covered by a green rectangle in the image below.
Posted 10-23-2021
Keeper added 11-3-22
Lastpass link fixed 11-29-22
Flag 2 changed 12-3-22
Flag 1 changed and video added 4-24-23
Flag 2 changed 5-4-23