Diskimage

Problem

Disk "image"

diskimage.png

Solution

Since the description says that there must be an "image" we start by looking into the hex values and after looking a bit you might see a a DOS sector in there. For OTA @unblvr did this process, actually he solved the whole challenge by himself :tada:

So using zsteg we can extract that DOS/MBR sector

➜ zsteg -a diskimage.png -e 'b8,rgb,lsb,xy' > diskimage.dat

Now using testdisk you can analyse the diskimage.dat and when you'll get into the undelete option you'll notice lots of icon

There's a deleted file named _LAG.ICO you can copy that file using testdisk option.

Then you can simply run stegoveritas on the _LAG.ICO and you'll see the flag.

FLAG: CTF{FAT12_FTW}

Original writeup (https://github.com/mzfr/ctf-writeups/tree/master/BsidesSF_2019/diskimage).