Weird Disk Image

Incognito 6.0 CTF

Info
Details

Category

Digital Forensics

Points

150

Challenge Overview

The challenge is based on analyzing a .iso file in order to get the flag. I highly recommend using Autopsy or FTK Imager for challanges like this.

Upon opening the ISO using 7-Zip, we notice a folder named [SYS], which contains a file called Journal.txt. Viewing this file in Kali Linux, we discover a string that appears to be a key — possibly meant for decryption or decoding later on.

all files (opened with 7zip)
encryption key

Next, after searching and went in a lot of useless file, I discovered in bin directoy that we have a binary string at the end of unusually_long_ls file, which could be helpful.

binary string

Analyzing the Data

Up to this point, we now have two critical pieces of information:

  • A binary string

  • A key (likely ASCII)

After inspecting both carefully, I tried to XOR the binary string with that key and get the final flag.

Final Flag

ictf{f477r_cr4ck3d_1n_s3c0nd5}

made by k0d

Last updated