> For the complete documentation index, see [llms.txt](https://gabriels-ctf-stuff.gitbook.io/tisc-2023/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gabriels-ctf-stuff.gitbook.io/tisc-2023/level-1-disk-archaelogy.md).

# Level 1 - Disk Archaelogy

Unknown to the world, the sinister organization PALINDROME has been crafting a catastrophic malware that threatens to plunge civilization into chaos. 

Your mission, if you choose to accept it, is to infiltrate their secret digital lair, a disk image exfiltrated by our spies. This disk holds the key to unraveling their diabolical scheme and preventing the unleashing of a suspected destructive virus.

{% file src="/files/PDs8lnuaOKR3zBiMWIrn" %}
Challenge file 1
{% endfile %}

First, decompress the file.

```bash
tar -xvf challenge.tar.xz
```

![](/files/H6W0BPrJgKEj1icdyf8v)

We see an **.img** file that appears to contain Linux filesystem data.

```bash
file challenge.img
```

![](/files/PMpn6S20FqHIW4Cvx3V4)

We can use Autopsy to look through the files in **challenge.img** and look for any files left in the unallocated space.

Create a case on Autopsy using the **challenge.img** file we just extracted, and enable the **PhotoRec file carver** extension.

<figure><img src="/files/tczsuu891mzYMFUMICE6" alt="" width="382"><figcaption></figcaption></figure>

You should be able to see that a file named **f00000008.elf** was carved. Right click and extract the file. As it is a linux binary, run the binary on linux and the flag is printed out. You may have to install some dependencies with the following command first.

```bash
apt-get install musl-dev
```

<figure><img src="/files/ojw4hp8jMzxJFDAhho4p" alt=""><figcaption></figcaption></figure>

Flag: `TISC{w4s_th3r3_s0m3th1ng_l3ft_ubrekeslydsqdpotohujsgpzqiojwzfq}`