# Weird Disk Image

| Info     | Details           |
| -------- | ----------------- |
| Category | Digital Forensics |
| Points   | 150               |

## Challenge Overview

![](https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2Fy09uhYOQjlQAJ0AibOQa%2Foverview.png?alt=media\&token=7c2f620c-697f-4fbd-8968-6ac57cc46c8f)

> The challenge is based on analyzing a `.iso` file in order to get the flag. I highly recommend using Autopsy or FTK Imager for challanges like this.

Upon opening the ISO using **7-Zip**, we notice a folder named `[SYS]`, which contains a file called `Journal.txt`. Viewing this file in **Kali Linux**, we discover a string that appears to be a **key** — possibly meant for decryption or decoding later on.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FjUpawnheCGLz9xGp1w0W%2Fall%20files.png?alt=media&#x26;token=be6218a6-3621-4b4b-86d3-baa355a9d19e" alt=""><figcaption><p>all files (opened with 7zip)</p></figcaption></figure>

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2F51pI9HF9JIBfYc0WCAXc%2Fstrings.png?alt=media&#x26;token=3fd3ce39-2ab8-482b-8d6a-a4e450c79ae9" alt=""><figcaption><p>encryption key</p></figcaption></figure>

Next, after searching and went in a lot of useless file, I discovered in `bin` directoy that we have a binary string at the end of `unusually_long_ls` file, which could be helpful.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2Fx6sCfiL7W3mMxQer6NaT%2Fbinary%20string.png?alt=media&#x26;token=35d99af9-660b-4acb-8226-66f89c2a84cc" alt=""><figcaption><p>binary string</p></figcaption></figure>

### Analyzing the Data

Up to this point, we now have two critical pieces of information:

* A **binary string**
* A **key** (likely ASCII)

After inspecting both carefully, I tried to XOR the binary string with that key and get the final flag.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FNgqTrlsjegPMUy7P9oWE%2Fxor.png?alt=media&#x26;token=4149b4de-1997-46a6-9471-32a22130e1ef" alt=""><figcaption></figcaption></figure>

## Final Flag

`ictf{f477r_cr4ck3d_1n_s3c0nd5}`&#x20;

*made by k0d*
