RingZero CTF - Forensics – File Recovery

RingZero CTF - Forensics – File Recovery

Objective:

This problem is a tar file

Get the key

Solution:

Download the tar file

Untar it

We get two files in here a file name flag.enc and a file called private.pem

This is what’s in the flag.enc file

”RøµìZ_ÝÎb0ž~“ ñ

This is what’s in the private.pem

-----BEGIN RSA PRIVATE KEY-----

MIICXAIBAAKBgQDFDxrLz/lBabo/JrRvKN47IRzUgm/LzG9zbn3g8HMnPIpy4ZOF

fhjblvb8iNeFMbUIDAT2QmsqDRJhHH7xUVfC6DiYB3YuKJC/RBIHzqlBsxWXI5DF

ikyS3yT6ThQap3JZEKE7fVXHHJmea4VrsRVhWG6ztoPYf+OfiMyzj0IV3QIDAQAB

AoGAX1QnSmGZ2yMijlpS/1Nt7nzeTY+sNZL4d4cELkUj799BusGVdAbET7aAVTp9

yFl7kiD+ZYNMBFO+iGwYnPUU1sPSlFcS1YNu2S+4ds2ym1VfZu2drTN5qUIGIm22

2mgyOG1CSx421Ns4X5qIexkQ1gOnqaBuD7Mi3D19c5mK66ECQQDlt99Jcw7Jh1Gd

TMy8cQ7EBI82YPedRP5SnAv0/sCIgcsBmbABO6WwCeS1BVjoicf+pPmIy3YkyiyO

8JIa9GJLAkEA25qwREClnm+2qIBRLal+pG8t7xZlEya+HrlX3ogThf/9GybfImzK

ZQagbom3sDmRTeu6PhDhu4XZS7D4gfIPdwJANlDrsupJrM0aNx9ZqZTx8NdDJZB3

+++8Urwi96Lk02IdJhu4yhHYc29jbIn/I7ywVT2c4wN4w+op7wJjCYyPUQJAaVEo

U7NFOlSNHwZa6DEvQSDowI7W7nZYG1f74gcUheEcu5bK0DGoZwbkjd6SL3uMSfhR

G07xUwOAEKLQq1ExRQJBAJouci7CVIbd8XqZEBaBAqIEVKCff+qHsHzoZo1ryog8

vIgevI9e/01CqyuKIRs9WmM+DU/QnZtLJHUqgkpSCag=

-----END RSA PRIVATE KEY-----

OK so it looks like we have an encrypted file with a private key that we can use to decrypt it.

Let’s use openssl to decrypt the file

First thing to point out is that you see the private key is RSA that will be useful info when we try to decrypt it.

root@kali:# openssl rsautl -decrypt -in flag.enc -out flag.txt -inkey private.pem

With this command we are telling openssl to decrypt a file called flag.enc using rsa and with the private key of private.pem and output the decrypted file to flag.txt

root@kali # cat flag.txt

FLAG-vOAM5ZcReMNzJqOfxLauakHx