其他分享
首页 > 其他分享> > 2020年第六届 美亚杯电子取证 团体赛 wp

2020年第六届 美亚杯电子取证 团体赛 wp

作者:互联网

2020年第六届 美亚杯电子取证 团体赛 wp

一、案情简介

你的电子数据取证调查结果发现一个国际黑客组织牵涉这宗案件。经深入调查后,调查队伍相信该黑客组织入侵了一个名为Zello的本地网上商店官网,黑客组织也针对另一家网上商店Xeno发动网络攻击,使其系统产生故障。调查期间发现三名男子: 张伟华、冯启礼及罗俊杰疑与该案有关。警方在搜查他们的住宅及公司后扣押了数十台电子设备。请分析电子数据证据并重建入侵痕迹。


二、检材

  1. 由Zello提供的数据 1-21 Zello 21
编号详情档案路径
1Zello服务器的镜像文件/Meiya Cup 2020/Image/Zello-onlineshop webserver/Zello-onlineshop webserver.e01
  1. 由Xeno提供的数据 22-28 Xeno 7
编号详情档案路径
1Xeno 提供的web服务访问日志/Meiya Cup 2020/Image/xeno access.log_20200929-20201006.zip
  1. 与张伟华有关的资料 29-74 Bob 46
编号详情档案路径
1证物照片/Meiya Cup 2020/Photo/Bob
2一部桌上计算机的镜像文件/Meiya Cup 2020/Image/Bob/Bob Desktop
3一部笔记本计算机的镜像/Meiya Cup 2020/Image/Bob/Bob laptop
4从路由器提取的存取日志及原则/Meiya Cup 2020/Image/Bob/Router Log.xlsx
5一部iMac的镜像文件/Meiya Cup 2020/Image/Bob/Bob iMac_OS /Meiya Cup 2020/Image/Bob/Bob_iMac
6iPhone的镜像文件/Meiya Cup 2020/Image/Bob/Bob IPHONE 5/UFED Apple iPhone 5 (A1429) 2020_10_05 (001).zip
7安卓手机的镜像/Meiya Cup 2020/Image/Bob/Bob S2/DumpData.bin
8调查报告/Meiya Cup 2020/调查报告/案件调查报告- 被捕人张伟华 (Bob).docx
  1. 与冯启礼有关的资料 75-126 Cole 52
编号详情档案路径
1证物照片/Meiya Cup 2020/Photo/Cole
2一部桌上计算机的镜像文件/Meiya Cup 2020/Image/Cole/Cole_Desktop/Cole_Desktop.e01
3Raspberry Pi 4的镜像文件/Meiya Cup 2020/Image/Cole/Cole_PI/COLE_PI.e01
4网络储存装置的镜像文件/Meiya Cup 2020/Image/Cole/Cole NAS/Cole_NAS.e01
5笔记本计算机的内存镜像文件/Meiya Cup 2020/Image/Cole/Ram dump from Cole/coleramdump.mem
6笔记本计算机的镜像文件/Meiya Cup 2020/Image/Cole/Cole Laptop
7手机的镜像文件/Meiya Cup 2020/Image/Cole/Cole_Nexus 5/blk32_mmcblk0rpmb.bin
8调查报告/Meiya Cup 2020/调查报告/案件调查报告- 被捕人冯启礼 (Cole).docx
  1. 与罗俊杰有关的资料 127-140 Daniel 14
编号详情档案路径
1证物照片/Meiya Cup 2020/Photo/Daniel
2一部桌上计算机的镜像文件/Meiya Cup 2020/Image/Daniel/Daniel_Desktop/Daniel_Desktop.e01
3Macbook Pro的镜像文件/Meiya Cup 2020/Image/Daniel/Daniel_Macbook/Daniel_Macbook.e01
4手机的镜像文件/Meiya Cup 2020/Image/Daniel/Daniel_iPhone/iPhoneBackup.tar
5调查报告/Meiya Cup 2020/调查报告/案件调查报告- 被捕人罗俊杰 (Daniel).docx

三、题目

Zello

1.Zello服务器的哈希值(SHA256)是甚么?

A:ACC956EEE5121EDC2F9DC19ACFC8720E443810CBC5B83128EC62F9F4AAEA30B8;

B:30B856EEE5121EDC2F9DC19ACFC8720E443810CBC5B83128EC62F9F4AAEAACC9;

C:ACC930B856EEE5121EDC2F9DC19ACFC8720E443810CBC5B83128EC62F9F4AAEA;

D:56EEE5121EDC2F9DC19ACFC8720E443810CBC5B83128EC62F9F4AAEAACC930B8;

E:418856EEE5121EDC2F9DC19ACFC8720E443810CBC5B83128EC62F9F4AAEAACC6

img

2.卷组是何时创建的?

A:2020/09/01 10:22;

B:2020/09/02 10:22;

C:2020/09/03 05:22;

D:2020/09/03 16:22;

E:2020/09/03 10:22

使用 lvdisplay 命令(为啥是lvdisplay不是vgdisplay)

img

查看/etc/lvm/archive/ubuntu-vg_00000-1003936563.vg

img

这个记得还是lv的时间啊

还有个install安装日志

3.卷组的名称是甚么?

A:ubuntu;

B:Debian;

C:ubuntu-xp;

D:Kali-vg;

E:ubuntu-vg

img

4.物理卷的PV UUID是多少?

A:FF6neD-j49V-7o4g-Uugw-X;

B:IF6neD-j49V-555g-Uugw-XP;

C:EF6neO-j49V-704g-Uugw-X;

D:IF6neD-j49V-704g-Uugw-X;

E:F48neD-j49V-704g-Uugw-X

img

5.卷组的VG UUID是甚么?

A:AaJRmQ-tjaG-tmrX-Vnyu-xhS7-9zDttW;

B:ZaRRnQ-S7Tp-tjaG-tmr-Vnyu-xhS7-9zDttW;

C:JJJRmQ-S7Tp-tjaG-xhS7-9zDttW;

D:ZaJRmQ-S7Tp-tjaG-tmrX-Vnyu-xhS7-9zDttW;

E:Cannot be found

img

6.Zello服务器的Linux内核版本是甚么?

A:4.1-generic;

B:5.4.0-48-generic;

C:5.4-48-static;

D:6.4.0-generic;

E:Cannot be found

img

7.Zello服务器的操作系统版本是甚么?

A:20.03 LTS;

B:19.04.1 LTS;

C:18.04.1 LTS;

D:21.04.2 LTS;

E:20.04.1 LTS

img

8.Zello服务器的主机名是甚么?

A:zello;

B:zello-group;

C:zello-on;

D:zello-server;

E:server-zello

9.Zello服务器的计算器ID是甚么?

A:ff39cddc1d794eb6888962aafa17ab28;

B:ab28ff39cddc1d794eb6888962aafa17;

C:ff40cddc1d794eb6888962aafa17ab281;

D:df39cddc1d794eb6888962aafa17ab2B;

E:fdg39cddc1d794eb6888962aafa17ab28

img

机器码

10.Zello服务器中使用的wordpress版本是甚么?

A:5.4.2;

B:5.5.1;

C:5.5.0.3;

D:5.2.4;

E:2.5.5

img

11.Zello服务器与之同步的主机名是甚么?

A:NTP-server-based;

B:NTP-host;

C:Zello-server-host;

D:NTP-server-host-zello;

E:NTP-server-host

img

12.Zello服务器的时区是甚么?

A:Asia/Dhaka;

B:Asia/Hong Kong;

C:Asia/Bangkok;

D:Asia/Yangon;

E:Asia/Yekaterinburg

img

13.有多少个本地用户已登录到Zello服务器?

A:1;

B:2;

C:3;

D:4;

E:5

Lastlog可以看到只有一个用户登陆过

img

14.植入网络目录(Webdirectory)的网页壳层(Web Shell)的哈希值(MD5)是甚么?

A:FC0C5B5E56D56C6BBA6E1BAD595BECFD;

B:FC0CECFD5B5E56D56C6BBA6E1BAD595B;

C:CCFO585E56D56C6BBA6E1BAD595BFC0C;

D:ED455B5E56D56C6BBA6E1BAD595BFC8C;

E:ECFD5B5E56D56C6BBA6E1BAD595BFC0C

扫描

www\html\wordpress\wp-includes\sales\info\123.php

img

15.\var\www\html\wordpress\net\2020\Login\index.php’有甚么作用?

A:下载木马程序;

B:攻击目标服务器;

C:上载档案到服务器;

D:盗取资料;

E:这是个普通页面

img看看有之前泄露的资料log1ns.txt、R3ZZ.txt

img几个文件跳来跳去

2020-4-22植入木马123.php???(是不是改时间了

16.钓鱼网站伪装成甚么网站?

A:Yahoo;

B:Google;

C:Apple;

D:Netflix;

E:Spotify

img

17.下列哪个IP对Zello服务器进行了蛮力攻击?

A:213.186.93.68;

B:223.186.92.68;

C:221.186.91.68;

D:203.186.94.68;

E:203.186.90.50

img只有这个IP有好多东西(hydra是九头蛇啊)

24/Sep/2020:16:57:23

2020-9-24

18.Zello Web服务器的URL是甚么?

A:http://zello-online.net/;

B:http://zello-onlineshop.com/;

C:http://zello-onlineshop.sytes.net/;

D:http://zero-onlineshop.org/;

E:http://zello-onlineshops.com/

19.LVM2容器的第一个扇区是什么?

A:2101248;

B:2100049;

C:2101250;

D:5101246;

E:210222

img

20.Zello服务器中LVM2容器的大小(以字节为单位)是甚么?

A:21135367167;

B:31135367168;

C:3553536000;

D:64615367165;

E:42425367164

img

21.在Zello服务器以及Alice的装置中可以找到甚么共同文件?

A:login.txt;

B:inter.zip;

C:R3ZZ.txt;

D:password.txt;

E:Downloads.7z

见上

Xeno

22.2020年8月29日在Xeno服务器中发现的攻击类型是甚么?

A:HTTP GET/POST Flood;

B:NTP Amplification;

C:Ping of Death;

D:SYN Flood;

E:SNMP Flood

img可以发现他不停的timeout

他后面的状态码都变成304了(请求资源与本地缓存相同,未修改),但是之后也没有服务器出故障的返回值**….**黑客应该是攻击成功的

img

23.哪个IP地址在日志中条目数量最多?

A:14.102.184.0;

B:156.145.63.5;

C:14.200.184.10;

D:14.24.144.219;

E:45.133.180.5

img

24.这个登录次数最多的IP地址,它访问最多的是哪个页面?

A:listen.icepush.xml; 16026

B:risk.xhtml;

C:explorer.xhtml;

D:login.jsp;

E:listViewRisjs.xhtml

25.这个登录次数最多的IP地址来自哪个国家或地区?

A:Hong Kong;

B:Macau;

C:China(Mainland);

D:South Africa;E:United states

img

img

震撼了,要好好看背景资料

26.这个登录次数最多的IP地址,合共有多少次成功登录?

A:28;

B:18;

C:51;

D:0;

E:80

img

27.除DDoS之外,还可能涉及其他攻击吗?

A:SQL注入;

B:命令注入;

C:系统漏洞攻击;

D:跨站脚本攻击;

E:暴力破解攻击

不知道这个risk.xhtml是什么

28.从该网站下载了多少数据?

A:大概 20 MB;

B:大概 200 MB;

C:大概1 GB;

D:大概 5 GB;

E:现有资料不足以作推断

img

Bob 张伟华

29.Bob路由器的型号是甚么?

A:BL - WR740N;

B:TL - WR740N;

C:Archer c 1200;

D:archer c7;

E:TP - WRB41N

img

30.Bob家的IP地址是甚么?

A:15.111.174.91;

B:14.101.192.1;

C:27.111.174.91;

D:1.31.23.101;

E:182.11.21.31

img

31.使用路由器的装置的Mac地址是甚么- Alice?

A:00:BA:F5:89:89:FE;

B:A4:4E:31:EC:24:00;

C:60:67:20:3D:3B:OC;

D:00:0A:F5:89:89:FF;

E:00AA:F5:82:89:FD

img

好奇怪,只能对着这个

32.使用路由器的装置的Mac地址是甚么- Cole?

A:8C:3A:E3:93:80:09;

B:00:0A:F5:89:89:FF;

C:3C:BA:E3:93:80:09;

D:00:0A:F5:89:89:FC;

E:38:48:4C:17:9A:OC

33.谁到访过Bob的家?

A:Alice Cole;

B:只有Alice;

C:只有Cole;

D:只有David;

E:Alice, Cole 及David

34.他们甚么时候去过Bob的家?

A:2020/9/16;

B:2020/8/18;

C:2020/9/25;

D:2020/9/30;

E:2020/9/28

35.Bob的笔记本计算机的哈希值(SHA-1)是甚么?

A:57701AC2194A74804DEB0F7332532D39711C5DF0;

B:57705DF01AC2194A74804DEB0F7332532D39711C;

C:1AC2194A74804DEB0F7332532D39711C57705DF0;

D:5DF01AC2194A74804DEB0F7332532D39711C5770;

E:6DF01AC2194A74804DEB0F7332532D39711C5778

img

36.笔记本计算机中安装了甚么电子邮件程序?

A:Big Email Sender;

B:Super Email Sender;

C:Bulk Email Sender;

D:Super Email Sent;

E:Super Email Send

img

37.网络钓鱼电子邮件的接收者是储存在甚么文件?

A:NETFLIX.htm.dump;

B:NETFLIX.dump;

C:NETFLIXS.dump;

D:NETFLIX.htm.bak;

E:NETFLIX.CONTAINER

img

img

38.在Bob的笔记本, 有什么可疑APK及其功能?

A:检查虚拟货币的价格;

B:虚拟专用网络;

C:盗取登入名称及密码;

D:储存私人资料;

E:作为一个洋葱浏览器

img

39.该可疑APK 从什么网站获取资料?

A:https://coinapk.io/v1/exchangerate;

B:https://bit.coinapi.io/v1/exchange_rate;

C:https://rest.coinapi.io/v1/exchangerate;

D:https://rest.net/v1/exchangerates;

E:https://online.coinapi.io/v/exchangerate

40.上述APK中发现的Bitlocker密钥是甚么?

A:74785aaaa;

B:741852963;

C:72564529633;

D:bob052963;

E:522852693

img

41.网络钓鱼网站的网页寄存的网站地址是甚么?

A:http://zeta-onlineshop.sytes.net/wordpress/net/2019/Login;

B:http://zello-onlineshop.sytes.net/wordpress/net/2020/Login;

C:http://zello-onlineshop.sytes.net/nets/2020/Login;

D:http://zello-easyshop.sytes.net/wordpresss/net/2020/Login;

E:http://zello-onlinemet.sytes.net/wordpres/net/2020

Bob的桌上计算机

42.Bob的桌上计算机的哈希值(SHA-256)是甚么?

A:86C740D5FB096A18CC419AF74D7A55389F28D7F8E1CE6FABD17371E66E1C2673;

B:267340D5FB096A18CC419AF74D7A55389F28D7F8E1CE6FABD17371E66E1C86C7;

C:267386C740D5FB096A18CC419AF74D7A55389F28D7F8E1CE6FABD17371E66E1C;

D:40D5FB096A18CC419AF74D7A55389F28D7F8E1CE6FABD17371E66E1C267386C7;

E:B6C740D5F8096A18CC419AF74D7A55389F28D7F8E1CE6FABD17371E66E1C2673

img

43.Bob的桌上计算机的安装时间是几点?(本地时间)

A:2020/9/13 1:40:00;

B:2020/9/15 3:40:00;

C:2020/9/17 2:40:00;

D:2020/9/15 5:40:00;

E:2020/9/15 18:40:00

img

44.Bob桌上计算机内发现的网络钓鱼脚本是甚么?(某些字符被刻意用*遮盖)

A:d**nload.zip;

B:**ternal.zip;

C:i*t*r.zip;

D:out**.zip;

E:ex**rnal.zip

img直接找压缩包

45.该网络钓鱼脚本的功能是甚么?

A:摧毁目标电脑;

B:传播电脑病毒;

C:收集个人数据;

D:发送勒索信息;

E:自动化进行分布式拒绝服务攻击

Bob iphone

46.在Bob iphone, 与Alice和Cole通讯记录的完整路径是甚么?

A:File List\User App List\Application/ChatStorage.sqlite

Table:ZWAMESSAGE(ZCHATSESSION:4);

B:File List\Download File List\Temp/group.net.WhatsApp.shared/ChatStorage.sqlite

Table:ZWAMESSAGE(ZCHATSESSION:3)

C:File List\User File List/group.net.WhatsApps.shared/ChatStorage.sqlite

Table:MESSAGE(ZCHATSESSION:4);

D:File List\User File List\Applications/Group/group.net.WhatsApp.shared/ChatStorage.sqlite Table:ZW AMESSAGE(ZCHATSESSION:4)

iPhoneDump.tar/AppDomainGroup-group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite

img

img

UFED打包输的密码,配置文件里面就能看到

47.Bob的iPhone的苹果ID是甚么?

A:bobcheung123@gmail.com;

B:bobcheung@yahoo.com;

C:bobcheung@gmail.com;

D:bob23@gmail.com;

E:bobcheung123@hotmaillcom

img

48.Bob的iPhone的IMEI是甚么?

A:13421004458835;

B:23421224458835;

C:144410044508835;

D:934218004458888;

E:23421084450035

img

49.Bob iPhone的时区设置是甚么?

A:UTC +8;

B:UTC +0;

C:UTC -8;

D:UTC -10;

E:UTC + 6

img

img

50.文件" VIP.txt"的完整路径是甚么?

A:Bob/mobile/DCIM/Shared/AppGroup/group.whatsapp.WhatsApp.shared

/Message/Media//5/c56255d0-a407-4341-afef-7bf5accc52f0.txt;

B:Bob/Phone/Containers/Shared/AppGroup/group.net.whatsapps.WhatsApp.shared

/Message/Media/85262547937-1600392878@g.us/c/5/1230.txt;

C:Bob/Data/Containers/Shared/AppGroup/group.net.whatsapp.WhatsApps.shared

/Message/Media/85262547937-1600392878@g.us/c/5/c56255d0-a407-4341-afef-7bf5accc52f0.txt;

D:Bob/Text/Containers/Shared/AppGroup/group.net.whatsapp.WhatsApp.shared

/Messages/Media/85262547937-1600392878@g.us/c/5/c56255d0-a407-4341-afef-7bf5accc5000.txt;

E:Bob/mobile/Containers/Shared/AppGroup/group.net.whatsapp.WhatsApp.shared

/Message/Media/85262547937-1600392878@g.us/c/5/c56255d0-a407-4341-afef-7bf5accc52f0.txt

img

51.在Bob iphone, 谁是" 85262547937-1600392878@g.us"的聊天群组中的管理员?

A:Bob;

B:Cole;

C:Alice;

D:Alice 及 Bob;

E:Bob 及 Cole

85262547937

img

52." 85262547937-1600392878@g.us"聊天群组中有多少个附件?

A:6;

B:4;

C:2;

D:3;

E:6

img

这个可能有问题,可以翻数据库

img

四个文件一张图片

53.Bob iPhone的Airdrop ID是甚么?

A:66E7BBDE9F69;

B:Bob-airdrop-28455;

C:67E7BBDE9F69-BOB;

D:Air-Bob-66E7BBDE9F69;

E:Bob-iP-66E7BBDE9F69

img

54.Bob的iPhone的操作系统版本是甚么?

A:10.3.3;

B:10.2.1;

C:12.3.1;

D:13.3.2;

E:10.3.5

img

55.Bob在2020-09-17的1451时访问的连结是甚么?(UTC + 0)

A:https://www.apple.com;

B:https://www.hackertestinghelp.com/ddos-attack-tools/ (Title:8 Best DDoS Attack Tools (Free DDoS Tool Of The Year 2020));

C:https://www.textttestinghelp.com/ddos-attack-tool/amp/ (Title:8 Best DDoS Attack Tools (Free DDoS Tool Of The Year 2020));

D:https://www.softwaretestinghelp.com/bruteforce-attack-tools/amp/ (Title:8 Best DDoS Attack Tools (Free DDoS Tool Of The Year 2019));

E:https://www.softwaretestinghelp.com/ddos-attack-tools/amp/ (Title:8 Best DDoS Attack Tools (Free DDoS Tool Of The Year 2020))

img

Samsung S2

56.Bob的Samsung S2的Android ID是甚么?

A:072af229d1da3b3cd;

B:71af229d1da3b3cdd;

C:Bob72af229d1da3b3cd;

D:72af229d1da3b3cd;

E:Bob-72af229d1da3b3cd

57.Bob的Samsung S2的操作系统版本是甚么?

A:4.1.5;

B:4.0.1;

C:4.0.2;

D:4.2.3;

E:4.1.2

img

58.Bob Samsung S2的时区设置是甚么?

A:Asia/Hong_Kong;

B:Asia/Damascus;

C:Asia/Baku;

D:Asia/Bangkok;

E:Asia/Tokyo

img

59." bitcoin.PNG"的储存位置是甚么?

A:data (ExtX)/Root/media/DCIM/;

B:userdata (Ext)/Root/Download/;

C:userdata (ExtX)/Root/media/DCIM/;

D:userdata/Root//DCIM/;

E:userdata (ExtX)/Root/APK/

img

60.bitcoin.PNG的哈希值(SHA-256)是甚么?

A:b0d5adba030b9f1b0165760881eaeed48330cb3dccc807fe482985a8370b479a;

B:0d5b479aadba030b9f1b0165760881eaeed48330cb3dccc807fe482985a8370b;

C:adba030b9f1b0165760881eaeed48330cb3dccc807fe482985a8370b0d5b479a;

D:479aadba030b9f1b0165760881eaeed48330cb3dccc807fe482985a8370b0d5b;

E:450aadba030b9f1b0165760881eaeed48330cb3dccc807fe482985a8370b

img

61.Bob的Samsung S2的wifi mac地址是甚么?

A:21:60:C0:4B:75:11;

B:61:21:4B:C0:75:11;

C:60:21:C0:BB:11:75;

D:60:21:C0:4B:75:11;

E:DD:60:21:4B:75:11

img

62." userdata(ExtX)/ Root / media / Download / APK Testing"中的有多少APK檔?

A:7;

B:10;

C:8;

D:9;

E:6

img

63.Messagesecure.apk的哈希值(SHA-256)是甚么?

A:b4bf2eb1a59e9a8dc25ad02c15761532658747979e63ad356ec5b9c1f623ae57;

B:ae572eb1a59e9a8dc25ad02c15761532658747979e63ad356ec5b9c1f623b4bf;

C:de57ae572eb1a59e9a8dc25ad02c15761532658747979e63ad356ec5b9c1f623b4bf;

D:bd572eb1a59e9a8dc25ad02c15761532658747979e63ad356ec5b9c1f623b4bfb4bf;

E:ae025eb1a59e9a8dc25ad02c15761532658747979e63ad356ec5b9c1f623b4bfae57

img

64.私钥已在bitcoin.PNG中加密。私钥是甚么?

A:NpqGc6yaEjPd7NgBBRz9yUAf447Ei74K8rwuxoia8paBjzDNKzZU;

B:KzZUc6yaEjPd7NgBBRz9yUAf447Ei74K8rwuxoia8paBjzDNNpqG;

C:NpqGKzZUc6yaEjPd7NgBBRz9yUAf447Ei74K8rwuxoia8paBjzDN;

D:c6yaEjPd7NgBBRz9yUAf447Ei74K8rwuxoia8paBjzDNNpqGKzZU;

E:c6yaEjPd7NgBBRz9yUAf447Ei74K8rwuxoia8paBjzDNNpqG

img

是他的开机密码/贴在笔记本上的纸条

65.apk文件" flash_chat"的哈希值(SHA-256)是甚么?

A:479aadba030b9f1b0165760881eaeed48330cb3dccc807fe482985a8370b0d5b;

B:041a731249fa7bbaebd88651e0f5d2c4c3069c6ff8924b80579a2b160e387340;

C:ae572eb1a59e9a8dc25ad02c15761532658747979e63ad356ec5b9c1f623b4bf;

D:9eccf8ab9bf99a73df864c42ba813973d802c242a74cafeafac946ed43433d62;

E:fea06d7dc08152c8153c99ef4e654b683ba02f3679193ff1fd991625cabab10f

alicelg手机里面,真是见鬼

img img

66.哪个文件包含" flash_chat"聊天记录?

A:userdata (ExtX)/Root/data/co.splusbaby.flash_chat/databases/google_app_measurement_local.db;

B:userdata (ExtX)/Root/data/co.splusbaby.flash_chat/databases/firestore.%5BDEFAULT%5D.flash-chat-110d8.%28default%29;

C:userdata (ExtX)/Root/data/co.splusbaby.flash_chat/databases/google_app_measurement_local.db-journal;

D:userdata (ExtX)/Root/data/co.splusbaby.flash_chat/databases/firestore.%5BDEFAULT%5D.flash-chat-110d8.%28default%29-journal;

E:msgstore.db

67.从" flash_chat"找到的Bob的Windows密码是甚么?(某些字符被刻意用*遮盖)

A:44***6;

B:77***9;

C:11***3;

D:pa****rd;

E:ta****

img只有Alice的密码

68.消息的消息号码(Message ID)是甚么?

A:G2iytNuzajD4YU1MGVQz;

B:0x04CM9o69pmKByxwnRj;

C:j77xBc4hi8En7FTCPrDH;

D:diPO4Huk2aymv2SdIubI;

E:8XL2u5jIff5j1sKzGGvg

img

69." flash_chat"消息ID" aGqBnI5Bxutv24SQvrBL"中的密码是甚么?(某些字符被刻意用*遮盖)

A:P@ss****;

B:Hi***ld;

C:Hel***ll;

D:hel***ld;

E:we****ne

img

Bob iMAC

70.从Bob iMAC 桌面名为Wallet.dat 的档案中可以取得以下那一个比特币地址?(某些字符被刻意用*遮盖)

A:1L*WpEYvUi8FeG6BnXqfh1jgmJA1h1;

B:1MzCeNJHw5***J9vZexkweTtvKp8a1;

C:351Wm***npxKSWBwJQ3vXETVKFmus456kU;

D:***fnLp7P8Vu7EAUJzkngnXxGMZWwo;

E:以上都不对

结果是old wallet.datwallet.dat没有东西

img

img

71.从Wallet.dat档案中取得的比特币地址,那一个有接收及传送过比特币?(某些字符被刻意用*遮盖)

A:****p9c74rqN6ymzGwr9JB**8CPaX2458w;

B:1WmYyhnpxKSWBwJQ3vXETVKFm*56kU;

C:****UTiN5T7yrYXonCu54fWLHDK**Y7dS9;

D:3Q***qGRprZsWWCgLrLDKmwEcwYqX7J***;

E:以上都不对

img

72.以下那一个比特币接收或传送交易的哈希值与上述的比特币地址有直接关系?(某些字符被刻意用*遮盖)

A:ab*7eea6f1da83c0917602ba086e70b900b21c0067a96f88ec4775221f;

B:7e515***fea70dc29a07fbaf410d7fa610c2a4593d6d11b81b26f37da6db;

C:0f61e1b80cc1086445c4da8ec9bde6500e2850fc134860b82c97288e;

D:**yaE****NgBBRz9yUAf447Ei74K8rwuxo55k1aBjzDNNpq22U9Kk;

E:以上都不对

img

73.上述的比特币交易中所涉及多少比特币?

A:0.01282210 BTC;

B:0.01459400 BTC;

C:0.00175178 BTC;

D:0.00234500 BTC;

E:以上都不对.

74.Bob iMac数据磁盘的哈希值(SHA-256)是甚么?

A:29D4217939E37A4408FAE745363A4635A18CB0EE2E29771449E86F8BD7E7F839;

B:29D4217939E37A4408FAE745363A4635A18CB0EE2E29771449E86F8BD7E7;

C:D7E729D4217939E37A4408FAE745363A4635A18CB0EE2E29771449E86F8BF839;

D:D7E7F83929D4217939E37A4408FAE745363A4635A18CB0EE2E29771449E86F8B;

E:F83929D4217939E37A4408FAE745363A4635A18CB0EE2E29771449E86F8BD7E7.

img

Cole 冯启礼

Cole桌上计算机

75.Cole桌上计算机的哈希值(SHA-1)是甚么?

A:0D00A8A853B9001A9FC7BF89D9FBBA790C065CE2;

B:0D22A8A853B9001A9FC7BF89D9FBBA795CE2;

C:A8A853B9001A9FC7BF89D9FBBA790C065CE20D00;

D:5CE20D00A8A853B9001A9FC7BF89D9FBBA790C06;

E:5CE2A8A853B9001A9FC7BF89D9FBBA790C060D00.

img

76.Cole桌上计算机的用户名是甚么?

A:ADMIN;

B:COLE;

C:COLE-DESKTOP;

D:COLE-PC;

E:COLE-PC-841315.

img

77.在Cole的桌上计算机中发现了多少潜在的受害者?

A:100;

B:150;

C:200;

D:250;

E:300.

img

78.潜在受害者的数据被储存在哪里?(某些字符被刻意用*遮盖)

A:Partition 3\secret\doc**ent.txt;

B:Partition 3\secrets\c**tomer.txt;

C:Partition 3\secrets\vi**.txt;

D:Partition 3\secrets\vi**.zip;

E:Partition 3\sec*ets*ips.doc.

img

79.预设浏览器何时安装?

A:2019-10-01;

B:2019-12-01;

C:2019-12-07;

D:2020-09-24;

E:2020-09-28.

80.Cole桌上计算机上预设安装了甚么浏览器?

A:Chrome;

B:Edge;

C:Firefox;

D:Internet Explorer;

E:Opera.

imgimg

81.上述储存浏览记录的默认浏览器,该文件档案的类型是什么?

A:bat;

B:dat;

C:History;

D:places;

E:Web.

img

82.入侵Zello的证据文件是甚么?

A:Event log;

B:Email;

C:Pretech;

D:Ransome note;

E:WebCacheV01.dat.

img

83.受感染网站的网址是什么?

A:www.apple.com;

B:www.google.com;

C:www.vmware.com;

D:http://fortess.com;

E:http://zello-onlineshop.sytes.net.

84.Cole桌上计算机上的DDoS勒索字条是甚么?(某些字符被刻意用*遮盖)

A:license.txt;

*B:Ransome Note of *OS.txt;

C:Ransome Note of **OS.doc;

D:edb.log;

E:**inst.log.

img

85.在Cole桌上计算机上发现的DDoS勒索字条中,比特币钱包地址是甚么?

A:1L6fKWpEYvUi8FeG6BnXqfh1joAgmJA1h1;

B:2A6fKWpEYvUi8FeG6BnXqAA1joAgmJA1h1;

C:3F6fKWpEYvUi8FeG11nXqAA1joAgmJA1h1;

D:5C6fKWpEYvUi8FeG6BnXqAA1joAgfJA1h1;

E:A1h1KWpEYvUi8FeG6BnXqfh1joAgmJ1L6f.

Cole笔记本计算机

86.Cole笔记本计算机的哈希值(SHA-1)是甚么?

A:2EF559C89F2C5E6A2E02CFF13DBD61E423B89CD2;

B:2EF59CD259C89F2C5E6A2E02CFF13DBD61E423B8;

C:59C89F2C5E6A2E02CFF13DBD61E423B82EF59CD2;

D:8CO259C89F2C5E6A2E02CFF13DBD61E423B82EF5;

E:9CD259C89F2C5E6A2E02CFF13DBD61E423B82EF5.

img

87.Cole笔记本计算机有多少个用户帐户?

A:2;

B:3;

C:4;

D:5;

E:6.

img

88.当前登录用户帐户的用户名是甚么?

A:Administrator;

B:Bob;

C:Cole;

D:Daniel;

E:Guest.

唯一一个启用的

Cole笔记本的随机存取记忆体

89.在Cole笔记本的随机存取记忆体中, 是甚么Windows配置文件?

A:Win7SP1x64;

B:Win7SP1x64_25000;

C:Win7SP2x64;

D:Win2008R2SP1x64_24418;

E:Win2008R2SP2x64.

img

90.用户密码的前5个字符是甚么?

A:12345;

B:78945;

C:passw;

D:P@ssw;

E:qazws.

img

91.计算机中可疑的txt文件的名称是甚么?

A:abc.txt;

B:costomer.txt;

C:secret.txt;

D:vips.txt;

E:No suspicious file was found.

92.可疑txt文件曾经出现在哪个路径?

A:C:/Users/Cole;

B:C:/Users/Cole/Desktop/;

C:C:/Users/Cole/Desktop/Trade;

D:E:/USB16GB;

E:No suspicious file was found.

img

img

93.是否有任何证据表明该文件已执行?

A:是的,因为与此文件相关的lnk文件在内存偏移量 (Memory Offset) 0xcd40e382中找到;

B:是的,因为与此文件相关的lnk文件在内存偏移量 (Memory Offset) 0x117a86230中找到;

C:是的,因为在Cole \ AppData \ Roaming \ Microsoft \ Windows \ Recent *中找到了与此文件相关的lnk文件;*

D:找不到执行证据,因为没有与txt文件相关的预取文件;

E:找不到可疑文件和lnk文件.

img

img

94.以下哪个与上述可疑txt文件相关的发现是正确的?

A:在创建可疑txt文件之后,创建/访问了另一个txt文件;

B:在创建另一个txt文件之后创建/访问该文件;

C:Cole使用Microsoft Word打开文件;

D:无法确定与文件相关的时间事件;

E:该文件是通过内部网络ip下载的.

$FILE_NAME

Creation Modified MFT Altered Access Date Name/Path


2020-09-18 00:58:58 UTC+0000 2020-09-18 00:58:58 UTC+0000 2020-09-18 00:58:58 UTC+0000 2020-09-18 00:58:58 UTC+0000 Users\Cole\AppData\Roaming\Microsoft\Windows\Recent\customers.lnk

95.根据系统时间,Cole在2020-09-18 01:01:08 UTC + 0000左右用笔记本计算机做了甚么?

A:他创建了一个新的xls文件;

B:他从USB复制了一些文件;

C:他打开了一些txt文件;

D:他删除了一些文件;

E:没有.

还是要看$j

img

96.FTK Imager.exe的PID是甚么?

A:368;

B:660;

C:1288;

D:2224;

E:2456.

img

97.FTK Imager.exe的父应用程序是甚么?

A:592;

B:660;

C:1288;

D:2224;

E:2456.

img

98.FTK Imager.exe使用甚么DLL?

A:mmlang.dll;

B:Normal.dll;

C:sensapi.dll;

D:Secu.dll;

E:WINNS.dll.

img

要看pf文件

img

99.MpCmdRun.exe的PID是甚么?

A:660;

B:1288;

C:1388;

D:2240;

E:2456.

psscan

img

100.以下哪个与MpCmdRun.exe相关的项目是正确?

A:该进程于2020-09-17 11:15:57 UTC + 0000创建;

B:该过程于2020-09-18 01:20:57 UTC + 0000终止;

C:该进程由schost.exe启动;

D:该过程是通过网络驱动器启动的;

E:这不是合法程序.

0x000000011eaf69c0 MpCmdRun.exe 1288 1996 0x000000006284c000 2020-09-18 01:20:57 UTC+0000 2020-09-18 01:20:57 UTC+0000

101.上次启动后,笔记本计算机连接的外部IP是甚么?

A:31.12.82.1;

B:40.10.261.1;

C:218.112.79.1;

D:218.112.172.8;

E:未连接/未连接到任何外部IP.

img

102.上次启动后,笔记本计算机连接的网络驱动器路径是甚么?

A:E:/;

B:F:/;

C:G:/;

D:Z:/;

E:未连接/未连接到任何外部IP.

103.Cole公司的一位客户有一封电子邮件mb@ms**.z**.**.tw,可以在Cole的笔记本计算机中找到此数据吗? (某些字符被故意用*遮盖)

A:;

B:否;

C:无法确定,因为找不到这样的文件;

D:由于信息太有限,无法确定;

E:由于数据已加密,无法确定.

Vip.txt

img

104.收到上述电子邮件的客户名称是甚么?

A:陈志;

B:陈志林;

C:陈宜;

D:郭倍;

E:No customer data was found.

105.属于上述客户的电话号码是甚么? (某些字符被故意用*遮盖)

A:3225**1*;

B:61221;

*C:62*6*82*;

D:65257;

E:No customer data was found.

106.上述客户可能居住的区域是甚么?

A:Hong Kong Island;

B:Kowloon City ;

C:Tsuen Wan;

D:Tin Shui wai;

E:No customer data was found.

Cole的PI

107.Cole的PI的哈希值(SHA-256)是甚么?

A:0556EABC9BECCFA67E825864EBAB7B503EEC293C6209CDC931016D2F1D081F7C;

B:05569BECCFA67E825864EBAB7B503EEC293C6209CDC931016D2F1D081F7CEABC;

C:9BECCFA67E825864EBAB7B503EEC293C6209CDC931016D2F1D081F7C0556EABC;

D:AA8C9BECCFA67E825864EBAB7B503EEC293C6209CDC931016D2F1D081F7C0556;

E:EABC9BECCFA67E825864EBAB7B503EEC293C6209CDC931016D2F1D081F7C0556.

img

108.Cole PI 装置的操作系统是甚么?

A:Android;

B:Debian;

C:Mac;

D:Ubuntu24;

E:Windows.

img

109.操作系统是甚么版本?

A:20.1.1 LTS (Focal Fossa);

B:20.01.1 LTS (Focal Fossa);

C:20.02.1 LTS (Focal Fossa);

D:20.03.1 LTS (Focal Fossa);

E:20.04.1 LTS (Focal Fossa).

110.装置的文件系统是甚么?

A:Android;

B:Ext 4;

C:EXT;

D:iOS;

E:NTFS.

img

111.操作系统的时区是甚么?

A:Asia/Amman;

B:Asia/ Baku;

C:Asia/Shanghai;

D:Asia/Seoul;

E:Asia/Tokyo.

img

112.哪个文件包含儿童色情物品内容?(某些字符被故意用*遮盖)

A:“Partition 2*r\ptc1.jpg,Partition 2*r\ptc2.jpg,Partition 2*r\ptc3.jpg”;

B:“Partition 2\v*\ptha1.jpg,Partition 2\v*\ptha2.jpg,Partition 2\v**\ptha3.jpg”;

C:“Partition 2\mnt\pth**.jpg,Partition 2\mnt\pth**.jpg,Partition 2\mnt\pth**.jpg”;

D:“Partition 2**hc1.jpg,Partition 2**hc2.jpg,Partition 2**hc3.jpg”;

E:“Partition 2\media\pt**.jpg,Partition 2\media\pt**(1).jpg,Partition 2\media\pt**(2).jpg”.

img

113.Cole PI装置中的儿童色情物品的创建时间是甚么?

A:2020/09/15 11:21;

B:2020/09/15 17:21;

C:2020/09/15 18:21;

D:2020/09/16 19:21;

E:242020/09/15 20:21.

img

Cole NAS

114.Cole NAS的哈希值(SHA-256)是甚么?

A:28715B79890D90B661183F6849469FA2042D103D629A6BC9A4304E39B13C019D;

B:2871890D90B661183F6849469FA2042D103D629A6BC9A4304E39B13C019D5B79;

C:5B79890D90B661183F6849469FA2042D103D629A6BC9A4304E39B13C019D2871;

D:6879890D90B661183F6849469FA2042D103D629A6BC9A4304E39B13C019D2871;

E:890D90B661183F6849469FA2042D103D629A6BC9A4304E39B13C019D28715B79.

img

115.儿童色情数据存放在哪里?

A:Partition 3\cole-shared\media;

B:Partition 4\cole\media;

C:Partition 4\cole_shared\DCIM;

D:Partition 4\cole_shared\media;

E:Partition 4\cole_share\mnt.

img

img

116.设备中现有多少儿童色情数据?

A:1;

B:2;

C:3;

D:4;

E:5.

117.Cole NAS装置中的儿童色情物品的创建时间是甚么?

A:2020/09/13 16:51;

B:2020/09/14 16:50;

C:2020/09/14 16:51;

D:2020/09/15 16:51;

E:2020/09/15 17:57.

img

Cole手机

118.在Cole手机, 的用户个人资料是甚么?

A:colefung@gmail.com;

B:colefung99@gmail.com;

C:cole909@gmail.com;

D:colefung909@gmail.com;

E:colefung999@gmail.com.

img

119.Cole的手机上有社交媒体帐户吗?如有,那是甚么?

A:63766465@s.whatsapp.net;

B:85263766465@s.whatsapp.net;

C:852-62766465@s.whatsapp.net;

D:C85263766465@s.whatsapp.net;

E:COLE-63766465@s.whatsapp.net.

img

120.Cole与Bob和Alice在同一个小组中进行过交流吗?它是甚么?

**A:是的,在whatsappID****中的群聊消息:**85262547937-1600392878@g.us;

B:是的,在whatsapp组ID中的群聊消息:85262547937-1600392878@g.hk;

C:是的,在whatsapp组ID中的群聊消息:85252547937-1600392878@.us;

D:是的,在whatsapp组ID中的群聊消息:62547937-1600392878@g.us;

E:不,他们在Cole的设备中找不到公共聊天组.

img

121.Cole手机的Android ID是甚么?

A:a626a98cb2bb965ec;

B:606a98cb2bb965eca;

C:626a98cb2bb965ec;

D:65ec626a98cb2bb9;

E:626aa8cb2bb965ec626a.

img

122.已安装的WhatsApp APK文件的哈希值(SHA-256)是甚么?

A:06fa2cce80923de8646f835b72d1fb06a97343a5b7242bc3972627c78e1bb318;

B:8e1b06fa2cce80923de8646f835b72d1fb06a97343a5b7242bc3972627c7b318;

C:8e1bb31806fa2cce80923de8646f835b72d1fb06a97343a5b7242bc3972627c7;

D:b31806fa2cce80923de8646f835b72d1fb06a97343a5b7242bc3972627c78e1b;

E:b4l806fa2cce80923de8646f835b72d1fb06a97343a5b7242bc3972627c78elb.

123.列出Chrome的五个"关键词搜索"。

A:“bulk mailer, ddos creator, fortress online, parknshop, GitHub malware”;

B:“bulk mail, bulk mailers, ddos creator, fortress online, bitcoin”;

C:“bulk mail, bulk mai1er, ddos creator, fortress online, bitcoin”;

D:“bulk mai1, bulk mailer, ddos creator, parknshop, GitHub malware”;

E:“fortress on1ine, bitcoin, apple, parknshop, GitHub malware”.

img

124.在哪里可以找到"Cole的电话"的通话记录?

A:Table:call;

B:Table:calls;

C:Table:contact;

D:Table:contacts;

E:Table:sms.

img

125.2020-09-01至2020-09-30之间,"Cole"收到了多少条SMS讯息?

A:2;

B:3;

C:4;

D:5;

E:6.

img

126.在Cole的" whatsapp"联络人中,有多少用户正在使用" whatsapp"?

A:2;

B:3;

C:4;

D:5;

E:6.

img

Daniel 罗俊杰

Daniel的桌上计算机

127.Daniel的桌上计算机的哈希值(SHA-256)是甚么?

A:E588564CA7AAA5352F6A1215A9F1FBE4;

B:FBE4564CA7AAA5352F6A1215A9F1E588;

C:01DD40CF28603F421F3A09CD38F1C8AA40A2AC4BFB46ECF8299C38CE6AE44EO5;

D:07DD40CF28603F421F3A09CD38F1C8AA40A2AC4BFB46ECF8299C38CE6AE44ED5;

E:4ED540CF28603F421F3A09CD38F1C8AA40A2AC4BFB46ECF8299C38CE6AE407DD.

img

128.该桌上计算机操作系统储存在哪个分区上?

A:Partition 1;

B:Partition 2;

C:Partition 3;

D:Partition 4;

E:Partition 5.

img

129.在桌上计算器机中找到Daniel的电子邮件地址是甚么?

A:daniel43346@gmail.com;

B:daniellaw43346@gmail.com;

C:daniellaw43346@yahoo.com;

D:daniellaw43346@yahoo.com.hk;

E:daniellaw43346@ymail.com.

imgs

130.该恶意软件感染源是甚么?

A:“daniellaw43346@gmail.com - Daniel_Gmail.pst, Paypal updated:New Account update needs to be noticed”;

B:“daniellaw43346@gmail.com - Daniel_Gmails.pst, Paypal updated:New Account update needs to be noticed”;

C:“daniellaw@gmail.com - Daniel_Gmail.pst, Paypal updated:New Account update needs to be noticed”;

D:“danielaw43346@gmail.com - Daniel_Gmail.pst, Paypal updated:New Account update needs to be noticed”;

E:“daniellaw43346@yahoo.com - Daniel_Gmail.pst, Paypal updated:New Account update needs to be noticed”.

img

img

131.在Daniel的桌面上发现了甚么恶意软件?(某些字符被刻意用*遮盖)

A:wi**ows.bat;

B:ootd-4.0.**2.0.exe;

C:7z**00-x64.exe;

D:NDP452-KB290**07-x86-x64-AllOS-ENU.exe;

E:*deo_view*_3.1.2.4.zip.

是下载的文件夹

img

132.该恶意软件的哈希值(SHA-256)是甚么?

A:508972AFE67F7991F13212E1FE517F82BDC032DE0F5CDF15FDF641ED1FDD233D;

B:5089E67F7991F13212E1FE517F82BDC032DE0F5CDF15FDF641ED1FDD233D72AF;

C:72AFE67F7991F13212E1FE517F82BDC032DE0F5CDF15FDF641ED1FDD233D5089;

D:77AFB67F7991F13212E1FE517F82BDC032DE0F5CDF15FDF641ED1FDD233D50B9;

E:E67F7991F13212E1FE517F82BDC032DE0F5CDF15FDF641ED1FDD233D508972AF.

img

133.该恶意软件的功能是甚么?

A:远程桌面协议;

B:作为获得管理员级别访问权限的rootkit;

C:作为键盘侧录程序 (Keylogger);

D:作为抢夺者 (Snipper);

E: **作为特洛伊木马 **(Trojan Horse).

Daniel的MacBook

134.Daniel的MacBook 计算机的哈希值(SHA-1)是甚么?

A:B90D23B13560A619F682DE76991CD768;

B:B9OD23B13560A619F682DE76991CO768;

C:C71C21730461FC901FD99F76C3679C3FED0DFAB9;

D:C77C21730461FC901FD99F76C3679C3FED0DFA89;

E:FAB921730461FC901FD99F76C3679C3FED0DC71C.

img

135.Daniel的MacBook 计算机中有多少个分区?

A:2

B:3;

C:4;

D:5;

E:6;

img

Daniel的iPhone

136.Daniel的iPhone的操作系统是甚么版本?

A:12.0.0.1;

B:12.3.2;

C:12.4.7;

D:12.5.1;

E:13.4.6.

img

137.Daniel的iPhone的wifi mac地址是甚么?

A:22:9a:be:c4:99:7b;

B:44:9a:be:c4:99:7d;

C:50:9a:be:c9:99:7d;

D:64:9a:be:c4:99:7d;

E:7d:64:9a:be:c4:99.

img

img

138.Daniel的iPhone的IMEI是甚么?

A:256960065058545;

B:300960065055854;

C:359000065055845;

D:356960065055845;

E:456960065505845.

img

139.iPhone上次连接WIFI的SSID是甚么?

A:Netgear;

B:Netgear_5G;

C:Net24-5G;

D:Netgear24_4G;

E:Netgear24_5G.

140.根据调查结果,以下哪项关于Daniel的选项是正确的?

A:Daniel 认识 Alice;

B:Cole 入侵了 Daniel 的计算机**;**

C:Daniel知情地入侵了Xeno的服务器;

D:Daniel是犯罪团伙的一员;

E:以上都不对.

标签:甚么,09,美亚,Daniel,2020,wp,Bob,Cole
来源: https://blog.csdn.net/weixin_46081055/article/details/122616687