CTFtime.org

Corrupted

by pywaseek / moskva4

Tags: image forensic 

Rating: 5.0

We have Corrupted.001 file without any extension.
When we try to figure out what is this using `file Corrupted.001` we just get 'data' instead of file type.
So, let's open it with Ghex

![](https://raw.githubusercontent.com/kperevoznikova/writeups/main/CrewCTF%202022/pics/corrupted1.png)

We see a lot of trash before a valid NTFS-header `EB 52 90 4E 54 46 ...`. We just delete this bytes and save files as "Corrupted". Next, mount it using `ntfs-3g` and see a flag inside a directory with pictures:

![](https://raw.githubusercontent.com/kperevoznikova/writeups/main/CrewCTF%202022/pics/corrupted2.png)
![](https://raw.githubusercontent.com/kperevoznikova/writeups/main/CrewCTF%202022/pics/corrupted3.jpg)

Original writeup (https://github.com/kperevoznikova/writeups/blob/main/CrewCTF%202022/Corrupted.md).

Comments