Ulli Weichert/ April 5, 2022/ IT-Security, Write-Ups/ 0Kommentare

Operation Oni

Description

Download this disk image, find the key and log into the remote machine.
Note: if you are using the webshell, download and extract the disk image into /tmp not your home directory.
Download disk image
Remote machine:
ssh -i key_file -p 60303 ctf-player@saturn.picoctf.net

Solving

1. Mounting the disk image (it is a msdos mbr partition... whole disk)

2. Create temporary dir for mounting mkdir test

3. Look into the partitiontable fdisk -l <file>

4. After calculating the offset mount:

   mount -o loop,ro,offset=105906176 disk.img test

5. Look for ssh keyfiles

   find . -name '*id*'

6. Use the ssh key and try to login.

   ssh -i root/.ssh/id_ed25519  -p 60303 ctf-player@saturn.picoctf.net

7. You will get the flag.