1. unzip the file ```shell ┌──(kali㉿kali)-[~/code] └─$ gunzip -d dds2-alpine.flag.img.gz ``` 2. use `mmls` to see the structure first ```shell ┌──(kali㉿kali)-[~/code] └─$ mmls dds2-alpine.flag.img DOS Partition Table Offset Sector: 0 Units are in 512-byte sectors Slot Start End Length Description 000: Meta 0000000000 0000000000 0000000001 Primary Table (#0) 001: ------- 0000000000 0000002047 0000002048 Unallocated 002: 000:000 0000002048 0000262143 0000260096 Linux (0x83) ``` 3. use `fls` to list file and directory names in a disk image. (usage: `fls [-adDFlhpruvV] [-f fstype] [-i imgtype] [-b dev_sector_size] [-m dir/] [-o imgoffset] [-z ZONE] [-s seconds] image [images] [inode] If [inode] is not given, the root directory is used`) ```shell ┌──(kali㉿kali)-[~/code] └─$ fls -o 2048 dds2-alpine.flag.img d/d 26417: home d/d 11: lost+found r/r 12: .dockerenv d/d 20321: bin d/d 4065: boot d/d 6097: dev d/d 2033: etc d/d 8129: lib d/d 14225: media d/d 16257: mnt d/d 18289: opt d/d 16258: proc d/d 18290: root d/d 16259: run d/d 18292: sbin d/d 12222: srv d/d 16260: sys d/d 18369: tmp d/d 12223: usr d/d 14229: var V/V 32513: $OrphanFiles ``` 3. Since `root` is somewhat suspicious, set `inode` to `18290` to examine what's going on inside ```shell ┌──(kali㉿kali)-[~/code] └─$ fls -o 2048 dds2-alpine.flag.img 18290 r/r 18291: down-at-the-bottom.txt ``` 4. then use `icat` to output the contents of a file based on its inode number. ```shell ┌──(kali㉿kali)-[~/code] └─$ icat -o 2048 dds2-alpine.flag.img 18291 _ _ _ _ _ _ _ _ _ _ _ _ _ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ ( p ) ( i ) ( c ) ( o ) ( C ) ( T ) ( F ) ( { ) ( f ) ( 0 ) ( r ) ( 3 ) ( n ) \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ _ _ _ _ _ _ _ _ _ _ _ _ _ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ ( s ) ( 1 ) ( c ) ( 4 ) ( t ) ( 0 ) ( r ) ( _ ) ( n ) ( 0 ) ( v ) ( 1 ) ( c ) \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ _ _ _ _ _ _ _ _ _ _ _ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ ( 3 ) ( _ ) ( 0 ) ( b ) ( a ) ( 8 ) ( d ) ( 0 ) ( 2 ) ( d ) ( } ) \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ ``` 5. use Python to remove the redudant letters in `down-at-the-bottom.txt ` ```python= instr="p ) ( i ) ( c ) ( o ) ( C ) ( T ) ( F ) ( { ) ( f ) ( 0 ) ( r ) ( 3 ) ( n s ) ( 1 ) ( c ) ( 4 ) ( t ) ( 0 ) ( r ) ( _ ) ( n ) ( 0 ( v ) ( 1 ) ( c 3 ) ( _ ) ( 0 ) ( b ) ( a ) ( 8 ) ( d ) ( 0 ) ( 2 ) ( d ) ( }" outstr="" for i in instr: if i not in " ()": outstr+=i print(outstr) ``` output: ```shell ┌──(kali㉿kali)-[~] └─$ /bin/python /home/kali/code/test.py picoCTF{f0r3ns1c4t0r_n0v1c3_0ba8d02d} ```
×
Sign in
Email
Password
Forgot password
or
By clicking below, you agree to our
terms of service
.
Sign in via Facebook
Sign in via Twitter
Sign in via GitHub
Sign in via Dropbox
Sign in with Wallet
Wallet (
)
Connect another wallet
New to HackMD?
Sign up