CTFs | 404CTF_2024 | Investigation Numerique | Un boulevard pour pointer

Un boulevard pour pointer

In this challenge, we are given a zip file containing two PDF and a disk image. The two PDF contains linux forensic commands like file, strings, fdisk -l or mmls.

First lets run the fdisk -l command to get more information on the disk image:

As we can see, there are three partitions and one of the (Linux root (x86-64)) is 5.5G big. Lets mount this partitions on local directories:

Now if we look into the partition2 folder we can see the following structure:

We can now go into the /root folder and read the .bash_history file we can see the following information:

As we can see, we have a backup file that was saved using xfsdump. After a bit of research, I found this blog about xfsdump and xfsrestore so I used the following command to recover the original home folder:

Now we can navigate to the backup_folder and list the files:

And now, we have the flag in the last PDF:

So the flag is 404CTF{bi1_joué_br4vo_c_le_fl4g}.