Zeecka zeecka

The Lost Key

BreizhCTF 2023 - Forensics

March 17, 2023 · Forensics

BreizhCTF 2023 - The Lost Key

Challenge details

EventChallengeCategoryPointsSolves
BreizhCTF 2023The Lost KeyForensics??????

USB

The USB drive of a Norman terrorist has been recovered. Investigate its storage medium to stop him from going through with his plan!

Author: Zeecka

TL;DR

This is a dump of a USB drive with an NTFS file system. It contains an encrypted PDF along with 2 deleted files: a KeePass file and its key.

Extracting the various files, for example with Autopsy, allows opening the KeePass and recovering a working password for the PDF, and by extension access to the flag.

Methodology

We start by extracting the archive:

$ tar xvf the_lost_key.tar.gz

the_lost_key.img

$ md5sum the_lost_key.img

3daec81dae1d07d700288a096dcf0bad  the_lost_key.img

The file and fdisk commands let us verify the type of the recovered file.

$ file the_lost_key.img

the_lost_key.img: DOS/MBR boot sector; partition 1 : ID=0x7, start-CHS (0x4,4,1), end-CHS (0x3ff,254,2), startsector 2048, 3909632 sectors

$ fdisk -l the_lost_key.img

Disque the_lost_key.img : 1,87 GiB, 2003632128 octets, 3913344 secteurs
Unités : secteur de 1 × 512 = 512 octets
Taille de secteur (logique / physique) : 512 octets / 512 octets
taille d'E/S (minimale / optimale) : 512 octets / 512 octets
Type d'étiquette de disque : dos
Identifiant de disque : 0x7bdf73d0

Périphérique      Amorçage Début     Fin Secteurs Taille Id Type
the_lost_key.img1           2048 3911679  3909632   1,9G  7 HPFS/NTFS/exFAT

We can therefore confirm the presence of a single NTFS partition.

We can then use the The Sleuth Kit suite and its GUI Autopsy to carry out the investigation.

We start by recovering an encrypted PDF “PlanTipTopSecret.pdf” (right click > export files).

1

Then, in the deleted files section, we find 2 interesting files:

2

So we extract Database.kdbx and Database.keyx.

We then open the KeePass database using the key.

3

Then, we recover the PDF password (9b4W3jl@gQ7z) from the KeePass recycle bin:

4

Opening the PDF using the password then gives access to the flag.

5

Flag

BZHCTF{!LeMontSaintMichelEstNormand!}

Author: Zeecka