The president’s cat was kidnapped by separatists. A suspect carrying a USB key has been arrested. Berthier, once again you have to save the Republic! Analyze this key and find out in which city the cat is retained!
The md5sum of the archive is edf2f1aaef605c308561888079e7f7f7. Input the city name in lowercase.
Download evidence file and run these commands.
First of all, we will get information about evidence.
Command: file chall9
Command: fdisk -l chall9
Write the partition as separate image
Command: dd if=chall9 of=chall9_p1 bs=512 skip=2048 count=260096
Mount the image:
Command: sudo mount chall9_p1 /dev/disk
Command: ls /dev/disk
Command: ls /dev/disk/Documentations
Command: sudo umount /dev/disk
Alas. Maybe deleted?
Command: testdisk chall9_p1
enter – enter – enter – list – enter
Select Files and Enter
select this file – -rwxr-xr-x 0 0 2341273 23-Jul-2013 04:20 revendications.odt
press c for copy this file and select location and press again c for paste
than press q for exit
go to save location and go to file folder
now extract this file – revendications.odt
Command: unzip revendications.odt
after extract go to picture folders
rename this image name any and upload to this website or use exiftool for extract information
command: mv 1000000000000CC000000990038D2A62.jpg cat.jpg
upload this image to this website – https://www.pic2map.com
We have got the address – 1, Rue Principale, Helfrantzkirch, Mulhouse, Haut-Rhin, Grand Est, Metropolitan France, 68510, France
Flag – helfrantzkirch
