Skip to main content

Sleuthkit Intro

  • Description: Download the disk image and use mmls on it to find the size of the Linux partition. Connect to the remote checker service to check your answer and get the flag.
  • Difficulty: Medium

🔎 Solution​

The challenge provides clear instructions in the description. First, we extract the given file and use mmls to analyze the partition layout. We identify a Linux partition with a length of 0000202752.

> mmls disk.img      
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000000   0000002047   0000002048   Unallocated
002:  000:000   0000002048   0000204799   0000202752   Linux (0x83)

Next, we connect to the server and submit this partition length as the answer - which successfully returns the flag.

What is the size of the Linux partition in the given disk image?
Length in sectors: 202752
202752
Great work!
picoCTF{mm15_f7w!}

🚩Flag​

picoCTF{mm15_f7w!}