Skip to main content

Disk, disk, sleuth!

  • Description: Use srch_strings from the sleuthkit and some terminal-fu to find a flag in this disk image
  • Difficulty: Medium

🔎 Solution​

This challenge provides a disk image file. For challenges involving disk images, a common approach is to use tools like strings to extract readable text, and combine it with grep to search for keywords such as pico. This method often leads directly to discovering the flag.

> strings dds1-alpine.flag.img | grep "pico" 
/home/kali/Desktop/pico-ctf/mnt
/home/kali/Desktop/pico-ctf/mnt
ffffffff81399ccf t pirq_pico_get
ffffffff81399cee t pirq_pico_set
ffffffff820adb46 t pico_router_probe
  SAY picoCTF{f0r3ns1c4t0r_n30phyt3_a69a712c}

🚩Flag​

picoCTF{f0r3ns1c4t0r_n30phyt3_a69a712c}