PicoCTF: Disk, disk, sleuth! II
This write-up outlines the approach I used to solve the PicoCTF challenge Disk, disk, sleuth! II. The objective is to find the flag inside a file called down-at-the-bottom.txt.
Task description
All we know is the file with the flag is named `down-at-the-bottom.txt`… Disk image: dds2-alpine.flag.img.gz.
The Sleuth Kit
TSK (The Sleuth Kit) is a collection of tools that allows you to investigate disk images. For this task we need to use mmls to identify the start sector, followed by fls to identify the inode number of the file called down-at-the-bottom.txt. Lastly, we will use icat to extract the file.
An inode number is basically a number that uniquely identifies the file; since several files can have the same name, we need a number that uniquely identifies each file.
Before moving on, remember to decompress the disk image with gunzip.
Identifying the start sector
First, we will use mmls to identify the start sector of the partition. The structure for the command is mmls <disk-image>. As we can see below, the start sector for the Linux partition is 2048.
Finding the inode number
Now that we know the start sector of the partition, we can use fls to identify the inode number of the file down-at-the-bottom.txt.
Get ColdByte’s stories in your inbox
Join Medium for free to get updates from this writer.
To find the file, we can use the -r parameter in fls and pipe the result to grep. Why? The -r parameter will force fls to recursively display all folders, while with the grep command we can force the output to only display lines containing down-at-the-bottom.txt.
The resulting command is fls -o 2048 -r dds2-alpine.flag.img | grep down-at-the-bottom.txt. After running this command, we see that the inode number of the file is 18291; let’s move on to extraction.
Extracting the file
Now that we have identified the inode number for down-at-the-bottom.txt, we can use icat to extract the file.
To extract the file, the resulting command is icat -o 2048 dds2-alpine.flag.img 18291 > down-at-the-bottom.txt. By using > down-at-the-bottom.txt, we redirect the output of the command to a file that will be stored in the current directory (pwd).
After extracting the file, the next step is cat to print the file’s content.
The flag is picoCTF{f0r3ns1c4t0r_n0v1c3_f5565e7b}.
That’s it, thanks for reading! Feedback is appreciated :-)
