> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2025/forensics/bitlocker-1-medium.md).

# Bitlocker-1 (Medium)

<figure><img src="/files/WeJzFnuaIyTri2aXDmgm" alt=""><figcaption></figcaption></figure>

The disk image gives us a dd file which is a disk image used in Unix and Linux systems. This means that this is a File Carving challenge.

***

I first tried my usual process, of using strings, binwalk, etc... I tried to extract but that didn't work out at all. I read the hint and it said to do some hash cracking. I previously thought, "No way I'm going to use hashcat for this...", and turns out I needed to use hashcat.&#x20;

Just like any other cryptography challenge, we needed a attack mode and a hash type. Since most challenges just did a -a (bruteforce) type with the rockyou list, the real puzzle was the hashtype. And conviently enough, if you go on hashcat's wiki, there's a hash just for encrypted Bitlocker files.&#x20;

<figure><img src="/files/pRlStHS20mzAZf5SM5DA" alt=""><figcaption></figcaption></figure>

But first was to create the hash from the database. To do this, we'll use one of the tools john has. bitlocker2john. This website tells on how to do it.

{% embed url="<https://www.networkdatapedia.com/post/decrypting-bitlocker-with-hashcat-a-beginner-friendly-guide-casey-mullis>" %}

```
sudo apt install john      #### I needed to download johhn                                                        
```

After installing and using bitlocker2john, I got a txt file of hashes. ( using >)&#x20;

<figure><img src="/files/6yyv6EtJSuRunYqWxD9f" alt=""><figcaption></figcaption></figure>

```
hashcat -m 22100 -a 0 hash.txt wordlist.txt
```

<figure><img src="/files/n5FioTTK09bi6Sw6RYe4" alt=""><figcaption></figcaption></figure>

After a minute, the password is supposedly "hercules". I'll find out this won't work until much later, but we'll save that for later.&#x20;

***

Now its to mount the file so we could to test the file. We'll be using dislocker since that's pretty much the only tool specfic for this situation.

{% hint style="info" %}
Mounting a DD file (or any disk image) in Linux means making the contents of that image file accessible through your filesystem, just like plugging in a USB drive.
{% endhint %}

{% hint style="info" %}
Dislocker has been designed to read BitLocker encrypted partitions under a Linux system. The driver used to read volumes encrypted in Windows system versions of the Vista to 10 and BitLocker-To-Go encrypted partitions, that’s USB/FAT32 partitions.
{% endhint %}

```

Usage: dislocker [-hqrsv] [-l LOG_FILE] [-O OFFSET] [-V VOLUME DECRYPTMETHOD -F[N]] [-- ARGS...]
    with DECRYPTMETHOD = -p[RECOVERY_PASSWORD]|-f BEK_FILE|-u[USER_PASSWORD]|-k FVEK_FILE|-K VMK_FILE|-c

Options:
    -c, --clearkey        decrypt volume using a clear key (default)
    -f, --bekfile BEKFILE
                          decrypt volume using the bek file (on USB key)
    -F, --force-block=[N] force use of metadata block number N (1, 2 or 3)
    -h, --help            print this help and exit
    -k, --fvek FVEK_FILE  decrypt volume using the FVEK directly
    -K, --vmk VMK_FILE    decrypt volume using the VMK directly
    -l, --logfile LOG_FILE
                          put messages into this file (stdout by default)
    -O, --offset OFFSET   BitLocker partition offset, in bytes (default is 0)
    -p, --recovery-password=[RECOVERY_PASSWORD]
                          decrypt volume using the recovery password method
    -q, --quiet           do NOT display anything
    -r, --readonly        do not allow one to write on the BitLocker volume
    -s, --stateok         do not check the volume's state, assume it's ok to mount it
    -u, --user-password=[USER_PASSWORD]
                          decrypt volume using the user password method
    -v, --verbosity       increase verbosity (CRITICAL errors are displayed by default)
    -V, --volume VOLUME   volume to get metadata and keys from

    --                    end of program options, beginning of FUSE's ones

  ARGS are any arguments you want to pass to FUSE. You need to pass at least
the mount-point.

```

There's a process to mount the file that goes by this.

{% embed url="<https://rtech.support/disks/encryption/dislocker/>" %}

```
1. sudo apt install dislocker

2. sudo mkdir -p /mnt/dislocker  #### Creates Mount Point

3. sudo mkdir -p /mnt/bitlocker  #### Creates Second Mount Point 

4. sudo dislocker -v -V bitlocker-1.dd -u(password) -- /mnt/dislocker 
### -v shows debugging messages, -V treats the file suceeding it as a BitLocker Volume
### -u specifies a user password flag, include the password from hashcat
### "--" makrs the end of dislocker options
### "/mnt/dislocker" the mount point where dislocker will create the decrypted file, stores as diclocker.file

5. sudo mount -o loop /mnt/dislocker/dislocker-file /mnt/bitlocker
### "mount" linux command to attacha filesystem to a directory 
### -o is a option flag followed by the option "loop", treats the file as a hardrive 
### /mnt/dislocker/dislocker-file the source file
### /mnt/bitlocker the destination directory you want to mount to 

6. cd /mnt/bitlocker
```

***

I previously tried hercules, but that didn't work. I then searched up some write ups, and the actual password is "jacqueline". I'm not sure what went wrong, but I wasn't feeling to wait another 2-3 minutes to run hashcat. (If I had to guess it's that I needed to provide the exact user hash)&#x20;

```
bitlocker2john -i /path/to/bitlocker-image.dd > hash.txt ### My Version

python3 john/run/bitlocker2john.py bitlocker-1.dd > hashes.txt ### Their Version
```

Anyways, once you mount it you can just cat the flag.

<figure><img src="/files/ja3Sn3Q81VEFbVj5DIQZ" alt=""><figcaption></figcaption></figure>