Challenge description

Download this disk image and find the flag. Note: if you are using the webshell, download and extract the disk image into /tmp not your home directory.

• Download compressed disk image

Category: Forensics

Solution

Following the same steps as from the previous challenge of this type, Operation Oni, I extracted the disk image. First, I tried to find a flag-related file with find | grep flag.

Navigating to the folder above, flag.txt.enc seemed to be the only thing there. But I felt that there was more to be seen.

Let’s try ls -la to list out even hidden files and directories.

This could be an important clue, let’s see.

This gave us all we needed. The original flag was encrypted with openssl aes256. We also know the password, unbreakablepassword1234567. After encrypting, the original flag was disposed of with shred to ensure we cannot recover it easily, if at all. But that doesn’t matter, as we can simply decode the file we do have: