BreizhCTF 2023 - The Lost Key
Contents
The Lost Key
Difficulty: Easy
Author: Zeecka
States
The USB key of a Norman terrorist has been recovered. Investigate his support to prevent him from taking action!
Solve
tar xzvf the_lost_key.tar.gz
the_lost_key.imgA file & fdisk to get information about the dump :
file the_lost_key.img
the_lost_key.img: DOS/MBR boot sector; partition 1 : ID=0x7, start-CHS (0x4,4,1), end-CHS (0x3ff,254,2), startsector 2048, 3909632 sectorsfdisk -l the_lost_key.img
Disque the_lost_key.img : 1,87 GiB, 2003632128 octets, 3913344 secteurs
Unités : secteur de 1 × 512 = 512 octets
Taille de secteur (logique / physique) : 512 octets / 512 octets
taille d'E/S (minimale / optimale) : 512 octets / 512 octets
Type d'étiquette de disque : dos
Identifiant de disque : 0x7bdf73d0
Périphérique Amorçage Début Fin Secteurs Taille Id Type
the_lost_key.img1 2048 3911679 3909632 1,9G 7 HPFS/NTFS/exFATWe will open in Autopsy the dump, the dump does not contain many documents. We can recover a PDF with a rather interesting name protected by a password :
In the deleted files, we have a DB Keepass and its master key :
We open the keepass :
In the trash, we discover the password of the PDF :
We open the PDF document with the password and we have the flag :
Flag : BZHCTF{!LeMontSaintMichelEstNormand!}