Operation Oni

Download this disk image, find the key and log into the remote machine.
Note: if you are using the webshell, download and extract the disk image into /tmp not your home directory.
Download disk image
Remote machine: ssh -i key_file -p [port #] ctf-player@saturn.picoctf.net

We are given a file disk.img.gz
The .gz file extension indicates that the file is a gzip compressed file → gunzip disk.img.gz decompresses the file
SleuthKit is a useful tool for disk forensics
mmls disk.img

1
DOS Partition Table
2
Offset Sector: 0
3
Units are in 512-byte sectors
4

5
      Slot      Start        End          Length       Description
6
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
7
001:  -------   0000000000   0000002047   0000002048   Unallocated
8
002:  000:000   0000002048   0000206847   0000204800   Linux (0x83)
9
003:  000:001   0000206848   0000471039   0000264192   Linux (0x83)

Checking the first partition with fls -o 2048 disk.img

1
d/d 11: lost+found
2
r/r 12: ldlinux.sys
3
r/r 13: ldlinux.c32
4
r/r 15: config-virt
5
r/r 16: vmlinuz-virt
6
r/r 17: initramfs-virt
7
l/l 18: boot
8
r/r 20: libutil.c32
9
r/r 19: extlinux.conf
10
r/r 21: libcom32.c32
11
r/r 22: mboot.c32
12
r/r 23: menu.c32
13
r/r 14: System.map-virt
14
r/r 24: vesamenu.c32
15
V/V 25585:      $OrphanFiles

Checking the second partition with fls -o 206848 disk.img

1
d/d 458:        home
2
d/d 11: lost+found
3
d/d 12: boot
4
d/d 13: etc
5
d/d 79: proc
6
d/d 80: dev
7
d/d 81: tmp
8
d/d 82: lib
9
d/d 85: var
10
d/d 94: usr
11
d/d 104:        bin
12
d/d 118:        sbin
13
d/d 464:        media
14
d/d 468:        mnt
15
d/d 469:        opt
16
d/d 470:        root
17
d/d 471:        run
18
d/d 473:        srv
19
d/d 474:        sys
20
V/V 33049:      $OrphanFiles

The second partition looks promising. Checking home with fls -o 206848 disk.img 458 returns nothing.
Checking root with fls -o 206848 disk.img 470 returns

1
r/r 2344:       .ash_history
2
d/d 3916:       .ssh

.ash_history is a file (identified by r/r)
.ssh is a directory (identified by d/d)
icat -o 206848 disk.img 2344 outputs the .ash_history

1
ssh-keygen -t ed25519
2
ls .ssh/
3
halt

Thus, we know the directory .ssh is a result of an ssh-keygen of type ed25519
fls -o 206848 disk.img 3916 outputs the files of .ssh

1
r/r 2345:       id_ed25519
2
r/r 2346:       id_ed25519.pub

icat -o 206848 disk.img 2345 outputs the id_ed25519 file

1
-----BEGIN OPENSSH PRIVATE KEY-----
2
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZWQyNTUxOQAAACBgrXe4bKNhOzkCLWOmk4zDMimW9RVZngX51Y8h3BmKLAAAAJgxpYKDMaWCgwAAAAtzc2gtZWQyNTUxOQAAACBgrXe4bKNhOzkCLWOmk4zDMimW9RVZngX51Y8h3BmKLAAAAECItu0F8DIjWxTp+KeMDvX1lQwYtUvP2SfSVOfMOChxYGCtd7hso2E7OQItY6aTjMMyKZb1FVmeBfnVjyHcGYosAAAADnJvb3RAbG9jYWxob3N0AQIDBAUGBw==
3
-----END OPENSSH PRIVATE KEY-----

icat -o 206848 disk.img 2346 outputs the id_ed25519.pub file

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGCtd7hso2E7OQItY6aTjMMyKZb1FVmeBfnVjyHcGYos root@localhost

This appears to show the private key and public key, respectively.

icat -o 206848 disk.img 2345 > private_key saves the private key to a file in your local machine

ssh -i private_key -p [port #] ctf-player@saturn.picoctf.net returns

1
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
2
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
3
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
4
Permissions 0664 for 'private_key' are too open.
5
It is required that your private key files are NOT accessible by others.
6
This private key will be ignored.
7
Load key "private_key": bad permissions

This is telling us that private_key’s access permissions are too open since others can read and write files, which we can confirm with the command ls -ld private_key, which shows the permissions of -rw-rw-r--. Essentially, we want to modify this into -rw-------. We can do this via chmod 600 private_key. Using ls -ld private_key again confirms that the permissions of the file is now -rw-------.

ssh -i private_key -p [port #] ctf-player@saturn.picoctf.net now gets us into the file system.

ls  
cat flag.txt  
picoCTF{k3y_5l3u7h_339601ed}