$ cat writeup.md…
$ cat writeup.md…
ringzer0ctf
Task: a VMware4 monolithicSparse VMDK hides a ransomware victim; the flag is stored in an NTFS Alternate Data Stream. Solution: convert the VMDK to raw with qemu-img, extract the ADS with Sleuth Kit icat, and reverse the 9 KB PE to recover a constant XOR keystream (i-0x2D).
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar