Bitlocker-1 picoCTF 2025 Solution

Description

1. Step 1Extract the hash

   Observation

   The image is a BitLocker volume, and BitLocker keeps a password-verification hash in its Volume Boot Record metadata. Pull that out with bitlocker2john before any cracking can start.

   Run which bitlocker2john. If it returns a path, use that. Otherwise locate the bitlocker2john binary in the John Jumbo build tree (often /opt/john/run/) and call it by full path. Save the $bitlocker$... output to hashes.txt for cracking.

   What didn't work first

   Tried: Trying to mount the .dd image directly with mount -o loop bitlocker-1.dd /mnt/test without extracting a hash first.

   mount cannot read a BitLocker volume; it sees an unrecognized filesystem and errors out. The order is fixed: extract the hash with bitlocker2john, crack it for the password, decrypt with dislocker, then mount.

   Tried: Running john bitlocker-1.dd directly instead of using the bitlocker2john extraction step.

   John does not read BitLocker metadata out of a raw disk image on its own. bitlocker2john is a separate step that parses the Volume Boot Record and writes the hash out in $bitlocker$ format. Only then can John or Hashcat work on it.

   Learn more

   The end-to-end flow has four layers stacked: BitLocker encrypts the volume with AES, the disk image holds the encrypted volume, bitlocker2john extracts the password-verification hash from the volume metadata, cracking the hash gives the password, and dislocker uses the password to decrypt the volume back into a readable filesystem.

   BitLocker is Microsoft's full-volume encryption feature built into Windows. It encrypts entire drive volumes using AES (typically 128-bit or 256-bit) and protects the encryption key with one of several authentication methods: a password, a PIN, a USB key, or a TPM chip. The drive image in this challenge is protected by a user-supplied password.

   bitlocker2john is a utility from the John the Ripper Jumbo project that parses a BitLocker-protected disk image and extracts a hash line in the $bitlocker$... format. This hash encodes the password-derived key protection record, which BitLocker stores in the Volume Boot Record metadata. The hash can then be fed to offline password crackers like John or Hashcat without mounting the actual drive.

   The .dd file extension denotes a raw disk image created by tools like dd, a byte-for-byte copy of the original storage media. Forensic investigators create these images to preserve evidence without altering the original disk. Raw images can be analyzed, mounted, and cracked just like the original media, making them central to digital forensics workflows.

2. Step 2Recover the password

   Observation

   The description says the drive uses a weak password, and the extracted hash targets the user-password protector. That is a dictionary attack: hashcat mode 22100 against rockyou.txt.

   Run hashcat -m 22100 hashes.txt /usr/share/wordlists/rockyou.txt (or john --wordlist=...). bitlocker2john often emits multiple hash lines (one per protector); -m 22100 is the user-password protector. Hashcat prints the cracked line as <hash>:<plaintext>. For this challenge it cracks as jacqueline.

   What didn't work first

   Tried: Using the wrong hashcat mode, such as -m 9000 (Password Safe) or -m 13400 (KeePass), because BitLocker is also a volume-encryption tool.

   Hashcat picks the hash format by mode number, and every tool produces a structurally different hash. BitLocker with a user password is mode 22100. The wrong mode makes hashcat misparse the input and report nothing cracked. Match the $bitlocker$ prefix against hashcat's --help list to confirm.

   Tried: Running hashcat against the raw .dd file instead of the extracted hashes.txt file.

   Hashcat wants a text file with one hash per line, in the format bitlocker2john writes. Hand it a binary disk image and it reports an invalid hash or skips everything silently.

   Learn more

   Hashcat is the world's fastest password recovery tool, capable of leveraging GPU parallelism to test billions of hash candidates per second. Mode -m 22100 targets the BitLocker-with-user-supplied-password format. Hashcat supports dozens of attack modes: dictionary attacks (wordlist), brute-force, rule-based mutations, combinator attacks, and mask attacks.

   rockyou.txt is the most famous password wordlist in security research, containing approximately 14 million real passwords leaked from the 2009 RockYou data breach. Weak passwords like common first names appear early in the list, which is why the password "jacqueline" cracks quickly. This demonstrates why dictionary words - even uncommon ones - should never be used as encryption passwords.

   Proper BitLocker protection requires a complex, randomly generated recovery key (a 48-digit numeric code that BitLocker can generate) rather than a user-chosen password. The recovery key is stored in Active Directory or Microsoft account in enterprise environments. Using a strong random recovery key makes offline dictionary attacks computationally infeasible. The Hash Cracking guide covers hashcat mode lookups, rule-based mutation, and mask attacks for cases where rockyou alone isn't enough.

3. Step 3Mount with dislocker

   Observation

   With the password in hand, there is still a BitLocker layer over the NTFS volume. dislocker handles that, and a second loop-mount exposes the filesystem and flag.txt.

   mkdir the two mountpoints first. Point dislocker at the image with -u "jacqueline", then loop-mount the generated dislocker-file as NTFS. flag.txt sits at the root of the mounted volume.

   What didn't work first

   Tried: Trying to read flag.txt directly from /mnt/dd_image/ after dislocker finishes, without running the second mount command.

   After dislocker runs, the mountpoint holds one virtual file called dislocker-file, not a browsable tree. That file is itself a raw image of the decrypted NTFS volume, so loop-mount it at a second mountpoint before you can list anything.

   Tried: Omitting sudo on the dislocker or mount commands and getting a permission denied error.

   Mounting block devices and FUSE filesystems needs root, so both dislocker and the loop-mount take sudo. If your account is not in the sudo group, switch to root or add yourself first.

   Learn more

   Dislocker is an open-source Linux tool that decrypts BitLocker volumes. Given a password, recovery key, or BEK file, it decrypts the volume and presents it as a virtual FUSE filesystem containing a file called dislocker-file - which is the decrypted raw partition image. This file can then be mounted normally using the mount command with a loop device.

   The two-step mount process is necessary because dislocker operates at the encryption layer while mount operates at the filesystem layer. BitLocker wraps an NTFS (or FAT32/exFAT) filesystem, so after dislocker strips the encryption, the underlying filesystem still needs to be interpreted by the kernel's NTFS driver (provided by the ntfs-3g package on Linux).

   This workflow - extract hash, crack password, mount and read - is standard in digital forensics and incident response (DFIR). Investigators frequently encounter BitLocker-encrypted drives on seized hardware. Commercial tools like FTK and EnCase have built-in BitLocker support, while open-source workflows like this one demonstrate the same capability without licensing costs.

Flag

Remember to install dislocker and ntfs-3g if your distro lacks them.