Aes Memory Keyschedule

Category: FORENSICS · Difficulty: Advanced · Points: 500 · Challenge: 492

Background

A live RAM acquisition preserved the runtime memory of an active OpenSSL cryptographic routine during an active TLS tunnel. Extract the expanded round keys directly from the key schedule buffer to recover the session master secret.

Analysis

The evidence file is 590 bytes and carries a generator marker followed by a single configuration line. Reading printable runs across the file recovers the value directly:

$ strings -n 8 evidence-050.raw
[FORENSIC_TRIAGE_TARGET_050]
CONFIDENTIAL_FLAG=FLAG{cwa2026_282d7fcff2c843b9}

The file holds no filesystem image, no archive structure and no encoded payload beyond the plaintext line above, so the key schedule recovery work described in the brief was not required. At 590 bytes the acquisition is far smaller than any realistic process address space, and it contains no AES round key words, no TLS record structure and no session material, so no expanded key schedule was present to extract.

Result

FLAG{cwa2026_282d7fcff2c843b9}