Sleuthkit Intro

Challenge Overview

Download the disk image and use ${\color{orange}mmls}$ on it to find the size of

the Linux partition. Connect to the remote checker service to

check your answer and get the flag.

Note: if you are using the webshell, download and extract the

disk image into /tmp not your home directory.

  • Download disk image
  • Access checker program: ${\color{orange}nc}$ ${\color{orange}saturn.picoctf.net}$ ${\color{orange}52472}$

Solution

wget https://artifacts.picoctf.net/c/164/disk.img.gz

You first run the mmls command.

mmls disk.img

image

This gives you all the neccessary information to get the flag. Now just connected with netcat.

nc saturn.picoctf.net 52472

image

Then it gives the flag.

Flag: picoCTF{mm15_f...}