CTF Write-up: BitLocker
Computer Chip (TPM - automatic unlock if you're the owner) In CTF Challenges (What You're Dealing With): You got this file bitlocker-1.dd → It's a copy of a locked hard drive.
What BitLocker Actually Is:#
Okay so, you know how when you lock your phone with a PIN? BitLocker is like that, but for your whole computer's hard drive.
When BitLocker is on:#
Your files get scrambled (like a puzzle mixed up) Without the key → everything looks like gibberish With the key → everything goes back to normal
How It Actually Works (Simple Version):#
Imagine your computer's files are a secret diary:
Without lock: Anyone can read it With BitLocker: Diary written in invisible ink (need special light/key to read)
The "Keys" to Open It: There's usually 3 ways in:
Password (Normal password like "MyCatFluffy123")
Recovery Key (48 numbers like: 12345678-1234-1234-1234-123456789012)
Computer Chip (TPM - automatic unlock if you're the owner)In CTF Challenges (What You're Dealing With): You got this file bitlocker-1.dd → It's a copy of a locked hard drive.
The game is: Find the hidden key somewhere, unlock the drive, find the flag inside.
In this challenge we use the tool bitlocker2john The Tool's Job: bitlocker2john is like a lock picker's information extractor. It doesn't crack the lock, but it gets all the technical details about the lock so you can try to crack it.
bitlocker2john -i bitlocker-1.dd the result ===
User Password hash:
$bitlocker$0$16$cb4809fe9628471a411f8380e0f668db$1048576$12$d04d9c58eed6da010a000000$60$68156e51e53f0a01c076a32ba2b2999afffce8530fbe5d84b4c19ac71f6c79375b87d40c2d871ed2b7b5559d71ba31b6779c6f41412fd6869442d66d
Hash type: User Password with MAC verification (slower solution, no false positives)
$bitlocker$1$16$cb4809fe9628471a411f8380e0f668db$1048576$12$d04d9c58eed6da010a000000$60$68156e51e53f0a01c076a32ba2b2999afffce8530fbe5d84b4c19ac71f6c79375b87d40c2d871ed2b7b5559d71ba31b6779c6f41412fd6869442d66d
Hash type: Recovery Password fast attack
$bitlocker$2$16$2b71884a0ef66f0b9de049a82a39d15b$1048576$12$00be8a46ead6da0106000000$60$a28f1a60db3e3fe4049a821c3aea5e4ba1957baea68cd29488c0f3f6efcd4689e43f8ba3120a33048b2ef2c9702e298e4c260743126ec8bd29bc6d58
Hash type: Recovery Password with MAC verification (slower solution, no false positives)
$bitlocker$3$16$2b71884a0ef66f0b9de049a82a39d15b$1048576$12$00be8a46ead6da0106000000$60$a28f1a60db3e3fe4049a821c3aea5e4ba1957baea68cd29488c0f3f6efcd4689e43f8ba3120a33048b2ef2c9702e298e4c260743126ec8bd29bc6d58Next ..let's Try Cracking the Password
first this is for user password
User Password hash:
$bitlocker$0$16$cb4809fe9628471a411f8380e0f668db$1048576$12$d04d9c58eed6da010a000000$60$68156e51e53f0a01c076a32ba2b2999afffce8530fbe5d84b4c19ac71f6c79375b87d40c2d871ed2b7b5559d71ba31b6779c6f41412fd6869442d66d
Hash type: User Password with MAC verification (slower solution, no false positives)
$bitlocker$1$16$cb4809fe9628471a411f8380e0f668db$1048576$12$d04d9c58eed6da010a000000$60$68156e51e53f0a01c076a32ba2b2999afffce8530fbe5d84b4c19ac71f6c79375b87d40c2d871ed2b7b5559d71ba31b6779c6f41412fd6869442d66dlike this ,,,
secret123
mypassword
flag{bla_bla_bla}
adminthe two last is for Recovery Password
Hash type: Recovery Password fast attack
$bitlocker$2$16$2b71884a0ef66f0b9de049a82a39d15b$1048576$12$00be8a46ead6da0106000000$60$a28f1a60db3e3fe4049a821c3aea5e4ba1957baea68cd29488c0f3f6efcd4689e43f8ba3120a33048b2ef2c9702e298e4c260743126ec8bd29bc6d58
Hash type: Recovery Password with MAC verification (slower solution, no false positives)
$bitlocker$3$16$2b71884a0ef66f0b9de049a82a39d15b$1048576$12$00be8a46ead6da0106000000$60$a28f1a60db3e3fe4049a821c3aea5e4ba1957baea68cd29488c0f3f6efcd4689e43f8ba3120a33048b2ef2c9702e298e4c260743126ec8bd29bc6d58like this ,,,
12345678-1234-1234-1234-123456789012
XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXXso let's crack them
## Save all hashes
bitlocker2john -i bitlocker-1.dd > bitlocker.hashes
## Crack with wordlist
john --wordlist=/usr/share/wordlists/rockyou.txt bitlocker.hashesor using hashcat
## Save recovery hash
echo '$bitlocker$2$16$2b71884a0ef66f0b9de049a82a39d15b$1048576$12$00be8a46ead6da0106000000$60$a28f1a60db3e3fe4049a821c3aea5e4ba1957baea68cd29488c0f3f6efcd4689e43f8ba3120a33048b2ef2c9702e298e4c260743126ec8bd29bc6d58' > rec_hash.txt
and as we can see after 7 minutes
the password is
$bitlocker$0$16$cb4809fe9628471a411f8380e0f668db$1048576$12$d04d9c58eed6da010a000000$60$68156e51e53f0a01c076a32ba2b2999afffce8530fbe5d84b4c19ac71f6c79375b87d40c2d871ed2b7b5559d71ba31b6779c6f41412fd6869442d66d:jacqueline
Session..........: hashcat
Status...........: Cracked
Next we need create to folders :
sudo mkdir /mnt/bitlocker /mnt/decrypted/mnt/bitlocker = where to put the disk that is unlocked but still cannot be read (where to put the "unlocked but not readable yet" disk)
/mnt/decrypted = where to put the content that is inside it
Unlock with password#
## Use dislocker with found password
sudo dislocker -V bitlocker-1.dd -u"jacqueline" -- /mnt/bitlockerThis does: Takes the disk (bitlocker-1.dd), uses password (jacqueline), puts it in /mnt/bitlocker
next :
sudo mount -o loop /mnt/bitlocker/dislocker-file /mnt/decryptedbut The system said: "The disk contains an unclean file system" == cannot read and write the windows deja khlla infos in the momory refused to mount means refused open the disk read-only mount
so
mount -o rw /mnt/bitlocker/dislocker-file /mnt/decrypted # FAILED
mount -o ro /mnt/bitlocker/dislocker-file /mnt/decrypted # WORKED!
## rw = read write
## ro = read only so
ls -la /mnt/decrypted
total 13
drwxrwxrwx 1 root root 0 Jul 15 2024 '$RECYCLE.BIN'
drwxrwxrwx 1 root root 4096 Jul 15 2024 .
drwxr-xr-x 7 root root 4096 Feb 6 16:36 ..
drwxrwxrwx 1 root root 4096 Jul 15 2024 'System Volume Information'
-rwxrwxrwx 1 root root 43 Jul 15 2024 flag.txt
anas@Anas:~/Desktop/CTF/Forensics/Bitlocker-1$ ls -la /mnt/decrypted/flag.txt
-rwxrwxrwx 1 root root 43 Jul 15 2024 /mnt/decrypted/flag.txt
anas@Anas:~/Desktop/CTF/Forensics/Bitlocker-1$ cat /mnt/decrypted/flag.txt
flag{test}
```bash
## All the workflow
```bash
## Step-by-step:
1. bitlocker2john -i bitlocker-1.dd > hash.txt
2. hashcat -m 22100 hash.txt --show # لقينا: jacqueline
3. sudo dislocker -V bitlocker-1.dd -u"jacqueline" -- /mnt/bitlocker
4. sudo mount -o loop /mnt/bitlocker/dislocker-file /mnt/decrypted
5. cat /mnt/decrypted/flag.txt