CTF Quals CSAW 2011 - Forensics EvilBurritos1 !

Hey !
On continue avec les writeups du CSAW CTF ! Un challenge "networking" encore, EvilBurritos1 ! à 300 pt.

1. What ?

   On nous fournit un core dump d'un programme : core.burritos
   Il nous faut retrouver l'adresse email du contact chez Evil Burritos :
   
   
   We're currently investigating a company named Evil Burritos,
   we recovered this from one of their suspected programmer's
   computers. If you can find evidence of their involvement
   with Evil Burritos that would help greatly! Please find an
   email address of someone from Evil Burritos!
   
   
   

2. Un peu de recherche

   Voyons les strings de notre fichier :
   
   
   1. strings core.burritos > strings.txt
   
   On cherche un peu dans les strings si on trouve "burritos" puis on tombe rapidement sur :
   
   
   1. [Gmail]/Drafts
   2. x* 1 FETCH (UID 6 BODY[] {1071}
   3. MIME-Version: 1.0
   4. Received: by 10.42.241.10 with HTTP; Sun, 28 Aug 2011 18:22:41 -0700 (PDT)
   5. To: shrlchn99@evil-inc.burritos
   6. Date: Sun, 28 Aug 2011 19:22:41 -0600
   7. Message-ID: <CAETwm9ZgPAwARUw34_Jy=LdP3WPTuU68UCQUBeVswu-9OkVUxA@mail.gmail.com>
   8. Subject: Evil Burritos
   9. From: Kim Jung <kmjng6@gmail.com>
   10. Content-Type: multipart/alternative; boundary=20cf30363ae736dd1204ab9abb2f
   11. --20cf30363ae736dd1204ab9abb2f
   12. Content-Type: text/plain; charset=UTF-8
   13. Shirly, I changed the name of the burrito making machine to KILLTHEPLANET.
   14. If you want to change it back fell-free, just log in and type:
   15. change-burrito-machine-name, if you forgot the password let me know.
   16. LONG LIVE THE EVIL BURRITOS!
   17. --20cf30363ae736dd1204ab9abb2f
   18. Content-Type: text/html; charset=UTF-8
   19. Shirly, I changed the name of the burrito making machine to KILLTHEPLANET. If you want to change it back fell-free, just log in and type: change-burrito-machine-name, if you forgot the password let me know.<br><br>LONG LIVE THE EVIL BURRITOS!<br>
   20. <br>
   21. --20cf30363ae736dd1204ab9abb2f--)
   22. a0007 OK Success
   
   Et voilà, l'adresse email de la personne de EvilBurritos est : shrlchn99@evil-inc.burritos