PicoCTF: Sleuthkit Apprentice

This write-up outlines the two approaches I used to solve the PicoCTF challenge Sleuthkit Apprentice. The objective is to find the flag inside the disk image.

Task description

Download this disk image and find the flag.

Using The Sleuth Kit

TSK (The Sleuth Kit) is a collection of tools that allows you to investigate disk images. For this task we need to use mmls to determine the start sector for each partition in the disk image, followed by flsto list the files.

Remember to decompress the downloaded image before moving on.

Listing the partitions

Let’s get started by using mmls to list all partitions in the disk image, and find the start sectors. Command: mmls disk.flag.img.

Results of running mmls disk.flag.img.

In the results above, we see three partitions highlighted. However, only the ones with “Linux (0x83)” in the description are relevant for us. Why? This is because the third partition is a swap partition, and won’t normally contain files.

The relevant sectors are therefore 2048 and 360448.

Looking for the flag

Now that we have identified the start sectors for the relevant partitions, let’s use fls to list the files in each partition. However, there are many folders and files in an operating system, and we don’t know where the flag file is located.

The default behavior of fls is to only display the folders in the root folder.

To solve this problem, we can use the -r parameter in fls and pipe the result to grep. Why? The -r parameter will force fls to recursively display all folders, while with the grep command we can force the output to only display lines containing “flag”.

If we used the -r parameter without using grep, flswould output many, many lines. In most cases, too many to work with efficiently.

The resulting command is fls -o <start of sector> -r <disk image> | grep flag, assuming that the file containing the flag contains “flag” in its name. Below is the output of running this command on both start sectors.

As we can see above, we see two relevant files in the partition with 360448 as the start sector. Now we need to extract the files (or mount) to see their content. To do this, we can the icat tool from TSK.

Extracting the flag

The icat tool from TSK is used to output the contents of a file based on its inode number. An inode number is basically a number that uniquely identifies the file; since several files can have the same name, we need a number that uniquely identifies each file.

Get ColdByte’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

To extract the files, the resulting command is icat -o <start of sector> <disk image> <inode number> > <output file>. By using > <output file>, we redirect the output of the command to a file that will be stored in the current directory (pwd).

Let’s start with extracting the file called flag.txt and reading its content: icat -o 360448 disk.flag.image 2082 > flag.txt. This file does not contain the flag, as we can see below.

So let’s move on to the next file: icat -o 360448 disk.flag.image 2371 > flag.uni.txt. As we can see below, this is the correct file!

That’s it! The flag is picoCTF{by73_5urf3r_2f22df38}.

What if we have no idea what the file is called?

You might wonder what to do if you have no idea what the file is called, but you know the string pattern you’re looking for (picoCTF{random_content}). Luckily for us, TSK’s blkls tool combined with strings can be used for this purpose.

blkls is used to list or output the file system data units. The default behavior of blkls is to only dump the contents of unallocated data blocks. Therefore, we have to use the -a parameter to also dump the allocated data blocks. The resulting commad is blkls -a -o 360448 disk.flag.img > <output file>.

Finding the flag

Now, to find the flag we can use the strings command. The logical first try is strings all_data.txt | grep "picoCTF". However, this does not return any results. Why? The encoding of the text..

The default behavior of strings is to only search for single-7-bit-byte characters, but text can be encoded in several ways. To find the flag, we need to search for the same pattern with different encodings; which can be done with the -e parameter.

From the manual page for the strings command:
-e encoding
       --encoding=encoding
           Select the character encoding of the strings that are to be
           found.  Possible values for encoding are: s =
           single-7-bit-byte characters (default), S = single-8-bit-byte
           characters, b = 16-bit bigendian, l = 16-bit littleendian, B =
           32-bit bigendian, L = 32-bit littleendian.  Useful for finding
           wide character strings. (l and b apply to, for example,
           Unicode UTF-16/UCS-2 encodings).

Since we don’t know the encoding of the text, we can combine all the different character encodings by using parentheses to execute the different strings commands in subshells:

(
  strings all_data.txt 
  strings -eS all_data.txt 
  strings -eb all_data.txt
  strings -eB all_data.txt
  strings -el all_data.txt
  strings -eL all_data.txt
) | grep "picoCTF"

If we run the command above, we will see the flag:

That’s it, thanks for reading! Any feedback is greatly appreciated!