DEFCON 18 CTF quals - Forensic 200 writeup

Posted on July 01, 2010 in Blog • Tagged with CTF, DEFCON, quals • 6 min read

Second forensic challange of the DEFCON 18 CTF qualifications: the suggestion was “find the key” and the related file is here. (Mirrors: #1)

Trying to identify the file.

$ file f200_02b7b50f575759cff7.tar.lzma
f200_02b7b50f575759cff7.tar.lzma: data

So we can try to trust the file extension.

$ unlzma -d f200_02b7b50f575759cff7.tar.lzma

$ tar xvf f200_02b7b50f575759cff7.tar
IMG_0001.png
IMG_0002.png
IMG_0003.png
IMG_0004.png
IMG_0005.png
IMG_0006.png
IMG_0007.png
IMG_0008.png
IMG_0009.png
IMG_0010.png
IMG_0011.png
IMG_0012.png
IMG_0013.png
IMG_0014.png
IMG_0015.png
IMG_0016.png
IMG_0017.png
IMG_0018.png
IMG_0019.png
IMG_0020.png
IMG_0021.png
IMG_0022.png
IMG_0023.png …

Continue reading

DEFCON 18 CTF quals - Forensic 100 writeup

Posted on June 19, 2010 in Blog • Tagged with CTF, DEFCON, quals • 6 min read

Some times ago i get a lot of fun at DEFCON 18 CTF qualifications with a group of really skilled friends. Now a bit later, here is my writeup for some challenges.

First forensic challange of the DEFCON 18 CTF qualifications: the suggestion was “find the key” and the related file is here. (Mirrors: #1, #2)

$ file f100_6db079ca91c4860f.bin
f100_6db079ca91c4860f.bin: x86 boot sector; partition 1: ID=0x7,
starthead 0, startsector 31, 31558 sectors, extended partition table
(last)11, code offset 0x0

Now take a look at the partition table.

$ xxd -l 512 f100_6db079ca91c4860f.bin
0000000: 0000 0000 0000 0000 …

Continue reading