Google CTF 2019
Home Computer
Blunderbussing your way through the decision making process, you figure that one is as good as the other and that further research into the importance of Work Life balance is of little interest to you. You’re the decider after all. You confidently use the credentials to access the “Home Computer.” Something called “desktop” presents itself, displaying a fascinating round and bumpy creature (much like yourself) labeled “cauliflower 4 work – GAN post.” Your 40 hearts skip a beat. It looks somewhat like your neighbors on XiXaX3. ..Ah XiXaX3… You’d spend summers there at the beach, an awkward kid from ObarPool on a family vacation, yearning, but without nerve, to talk to those cool sophisticated locals. So are these “Cauliflowers” earthlings? Not at all the unrelatable bipeds you imagined them to be. Will they be at the party? Hopefully SarahH has left some other work data on her home computer for you to learn more.
You can find my all CTF solution in here
In the attachment I saw the NTFS file named by family.ntfs.
I mount that ntfs file to my computer
That partition is simulate windows computer. I spent time in that partition and I notice the credentiatls.txt in /Users/Family/Documetns
in that text tile i saw bellow message
I keep pictures of my credentials in extended attributes.
After research, I figure out the extended attributes is tecnique of hiding information.
I try to get attributes with using getfattr command. I receive that message.
1 2 |
# file: credentials.txt user.FILE0 |
Than, I try to reach that file with bellow command
1 |
getfattr --only-values credentials.txt > image.png |
dadaaa
Flag: CTF{congratsyoufoundmycreds}
solver.sh
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
mkdir Home_Computer cd Home_Computer wget https://storage.googleapis.com/gctf-2019-attachments/86863db246859897dda6ba3a4f5801de9109d63c9b6b69810ec4182bf44c9b75 mv 86863db246859897dda6ba3a4f5801de9109d63c9b6b69810ec4182bf44c9b75 Home_Computer.zip unzip Home_Computer.zip mkdir family sudo mount -o loop family.ntfs family/ cd family/Users/Family/Documents getfattr --only-values credentials.txt > image.png eog image.png |