Contest: ECSC Romanian Quals 2018
The attached archive contains an USB key image with NTFS. The file we’re most interested in is an Alternate Data Stream which makes mounting the image or using 7zip, photorec or binwalk to extract the files either not work at all or only extract the other, irrelevant files.
Autopsy worked, though, and we can use it
vlc-3.0.3-win32.exe:rockbands.exe (the colon indicates that it’s
an ADS). Running the extracted executable (which is a self extracting archive)
created a pcap file named
A brief look through the packets was enough to spot the flag which was encoded