Not So FAT - FCSC 2019

This section is the write-up for the Not So FAT forensics-challenge (FCSC 2019).

We have a disk image only named image.dd.

J'ai effacé mon flag par erreur, pourriez-vous le retrouver pour moi ?

Analysis of the disk image

$ file image.dd
image.dd: DOS/MBR boot sector, code offset 0x3c+2, OEM-ID "mkfs.fat", sectors/cluster 4, reserved sectors 4, root entries 512, sectors 32768 (volumes <=32 MB), Media descriptor 0xf8, sectors/FAT 32, sectors/track 32, heads 64, serial number 0x3be84c04, unlabeled, FAT (16 bit)

Read-Only Mount

# Mount in Read-Only
$ mkdir mount
$ sudo mount -r image.dd mount/
$ cd mount/
$ ls -lsqa
total 20
16 drwxr-xr-x 2 root    root    16384 Dec 31  1969 .
 4 drwxr-xr-x 3 clement clement  4096 Jun  9 07:55 ..
$ cd ..
$ sudo umount mount

Extraction deleted files

$ fls -r image.dd 
r/r * 4:	ziEuYrJW
r/r * 6:	flag.zip
v/v 523203:	$MBR
v/v 523204:	$FAT1
v/v 523205:	$FAT2
V/V 523206:	$OrphanFiles

$ icat image.dd 4 > ziEuYrJW
$ icat image.dd 6 > flag.zip
$ icat image.dd 523203 > MBR
$ icat image.dd 523204 > FAT1
$ icat image.dd 523205 > FAT2
$ icat image.dd 523206 > OrphanFiles
$ file *
FAT1:        ISO-8859 text, with no line terminators
FAT2:        ISO-8859 text, with no line terminators
flag.zip:    Zip archive data, at least v1.0 to extract
image.dd:    DOS/MBR boot sector, code offset 0x3c+2, OEM-ID "mkfs.fat", sectors/cluster 4, reserved sectors 4, root entries 512, sectors 32768 (volumes <=32 MB), Media descriptor 0xf8, sectors/FAT 32, sectors/track 32, heads 64, serial number 0x3be84c04, unlabeled, FAT (16 bit)
MBR:         DOS/MBR boot sector, code offset 0x3c+2, OEM-ID "mkfs.fat", sectors/cluster 4, reserved sectors 4, root entries 512, sectors 32768 (volumes <=32 MB), Media descriptor 0xf8, sectors/FAT 32, sectors/track 32, heads 64, serial number 0x3be84c04, unlabeled, FAT (16 bit)
OrphanFiles: empty
ziEuYrJW:    empty
  • Let’s try the string ziEuYrJW : 
    $ unzip flag.zip 
Archive:  flag.zip
[flag.zip] flag.txt password: 
password incorrect--reenter:
  • It is an incorrect password and unfortunately, we don’t have any others useful strings. So, we will bruteforce the password :
$ fcrackzip -v -u -D -p /usr/share/wordlists/rockyou.txt flag.zip 
found file 'flag.txt', (size cp/uc     59/    47, flags 9, chk 4eb7)


PASSWORD FOUND!!!!: pw == password
$ unzip flag.zip 
Archive:  flag.zip
[flag.zip] flag.txt password: 
 extracting: flag.txt                
$ ls
FAT1  FAT2  flag.txt  flag.zip  image.dd  MBR  OrphanFiles  ziEuYrJW
$ cat flag.txt 
ECSC{eefea8cda693390c7ce0f6da6e388089dd615379}
Written on June 10, 2020