ISO Image

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2026-04-05 | Status: Solved Techniques: 7z_extraction, ascii_decimal_decoding, binary_diff, iso_integrity_check, sha256_comparison

Summary

Task: modified Alpine Linux ISO from untrusted source, SHA256 doesn't match official. Solution: diff against official release reveals boot/amd-ucode.img replaced with decimal ASCII codes encoding the flag.

ISO Image — HackerLab

Description

As you know, we create Linux-based quests. Recently I reinstalled Windows and lost the image I used to create quests in this category. I couldn't find the version I needed on the official site - maybe I didn't look too carefully. However, it doesn't matter, because kind people from one forum provided me with exactly what I needed. I will clean my karma and share this image with you too :)

Given file iso_image.zip (~947 MB) containing alpine.iso (~957 MB) — a modified Alpine Linux Extended 3.21.2 ISO image. The challenge description explicitly hints at an untrusted source ("kind people from one forum"), suggesting the image has been tampered with. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

File: alpine.iso (1,003,380,736 bytes) Flag format: CODEBY{...}

Analysis

Step 1: File Identification

 bash read-only • copy allowed Copy
$ file alpine.iso
alpine.iso: ISO 9660 CD-ROM filesystem data 'ALPINE'

$ 7z l alpine.iso | grep alpine-release
# .alpine-release contains: alpine-extended-3.21.2 241230

The ISO is identified as Alpine Linux Extended 3.21.2, built on 2024-12-30.

Step 2: Integrity Check — SHA256 Mismatch

 bash read-only • copy allowed Copy
$ sha256sum alpine.iso
a7188034f921177dfc9e826d89e4b93db50b5d270fe57e9c6b83a4f42dcc161f  alpine.iso
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

$ curl -s https://dl-cdn.alpinelinux.org/alpine/v3.21/releases/x86_64/alpine-extended-3.21.2-x86_64.iso.sha256
95cf24ecf3ecbd63421852977592f30c444f37065ee34c3d9d5fa22001b32757  alpine-extended-3.21.2-x86_64.iso

Hashes don't match — the ISO was modified! This confirms the hint from the challenge description about an untrusted source.

Step 3: Download Official and Diff

Downloaded the official alpine-extended-3.21.2-x86_64.iso from dl-cdn.alpinelinux.org and extracted both ISOs with 7z x into separate directories: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
$ 7z x alpine.iso -o/tmp/extracted_modified
$ 7z x alpine-extended-3.21.2-x86_64.iso -o/tmp/extracted_original

$ diff -rq /tmp/extracted_modified /tmp/extracted_original
Files /tmp/extracted_modified/boot/amd-ucode.img and /tmp/extracted_original/boot/amd-ucode.img differ

Only ONE file differs: boot/amd-ucode.img — a boot-time AMD CPU microcode update file.

Step 4: Analyzing the Modified File

 bash read-only • copy allowed Copy
# Original file — legitimate AMD microcode in cpio format
$ file extracted_original/boot/amd-ucode.img
amd-ucode.img: ASCII cpio archive (SVR4 with no CRC)
$ wc -c extracted_original/boot/amd-ucode.img
81920
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Modified file — completely replaced with ASCII text!
$ file extracted_modified/boot/amd-ucode.img
amd-ucode.img: ASCII text
$ wc -c extracted_modified/boot/amd-ucode.img
99

$ cat extracted_modified/boot/amd-ucode.img
67 79 68 69 66 89 123 109 97 108 49 99 105 48 117 115 95 52 112 112 115 95 49 110 95 49 115 48 125

The 81,920-byte cpio archive was replaced with a 99-byte text file containing space-separated decimal numbers. These are clearly ASCII character codes (67='C', 79='O', etc.).

Step 5: Decoding the Flag

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
codes = [67, 79, 68, 69, 66, 89, 123, 109, 97, 108, 49, 99, 105, 48, 117, 115, 95, 52, 112, 112, 115, 95, 49, 110, 95, 49, 115, 48, 125]
print(''.join(chr(c) for c in codes))
# CODEBY{REDACTED}

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
solve_iso_image.py — Extract flag from modified Alpine Linux ISO.

Steps:
1. Compare SHA256 of provided ISO with official Alpine release → mismatch
2. Extract both ISOs and diff → only boot/amd-ucode.img differs
3. Modified file contains decimal ASCII codes → decode to get flag
"""
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# After extracting the modified amd-ucode.img:
with open('extracted_modified/boot/amd-ucode.img', 'r') as f:
    data = f.read().strip()

codes = list(map(int, data.split()))
flag = ''.join(chr(c) for c in codes)
print(flag)  # CODEBY{REDACTED}

Lessons

1. Always verify ISO integrity. Compare SHA256 with official checksums before using images from untrusted sources. This is both the forensic technique AND the security lesson the challenge teaches.

2. Diff against official release is the fastest approach. Downloading the original and running diff -rq on extracted contents instantly reveals all modifications — no need for complex analysis of a ~1 GB image. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Boot files are a common hiding spot. amd-ucode.img is a legitimate boot component that most users would never inspect manually. It loads CPU microcode during early boot — replacing it wouldn't prevent the system from booting (just skips AMD microcode updates).

4. The challenge description IS the hint. "Kind people from one forum" directly tells you the ISO is from an untrusted source and has been tampered with. The flag meaning ("malicious apps in ISO") reinforces the lesson.

5. Simpler variant of the Drakosha Ali pattern. Both tasks involve modified Linux ISOs with SHA256 mismatches, but this one uses trivial ASCII decimal encoding instead of AES encryption hidden in kernel modules. Good stepping stone before tackling harder ISO forensics. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍