SlackSpace

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: Ext4 filesystem forensics with sleuthkit, Password-protected ZIP cracking, Unallocated space extraction and analysis, ZIP magic bytes reconstruction

Summary

Task: Disk image with hidden data. Solution: Extract unallocated space, find ZIP with corrupted magic bytes, restore header, crack password with john.

SlackSpace — HackerLab

Description

"Магические байты - наше всё. Особенно, когда они есть..." (Magic bytes are everything. Especially when they exist...)

File: slack_space.zip contains disk_image (52MB ext4 filesystem)

Analysis

1. Initial disk image analysis

 bash read-only • copy allowed Copy
# Filesystem information
fsstat disk_image
# Result: ext4 filesystem

# File listing
fls disk_image
# Result: only lost+found and one orphan file (inode 13) - deleted and empty

# Journal check
jls disk_image
# Nothing interesting

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The filesystem is practically empty — data is hidden in unallocated space.

2. Extracting unallocated space

 bash read-only • copy allowed Copy
# Extract unallocated space
blkls disk_image > unalloc.bin

# Search for ZIP signatures
strings unalloc.bin | grep -i "pk"
xxd unalloc.bin | grep "504b"

Found signatures:

• PK\x01\x02 — Central Directory Header
• PK\x05\x06 — End of Central Directory

But PK\x03\x04 — Local File Header is missing!

3. Locating ZIP in the image

 python read-only • copy allowed Copy
# Find ZIP position in disk image
with open('disk_image', 'rb') as f:
    data = f.read()
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Find Central Directory
cd_pos = data.find(b'PK\x01\x02')
print(f"Central Directory at: {cd_pos}")

# Find End of Central Directory  
eocd_pos = data.find(b'PK\x05\x06')
print(f"EOCD at: {eocd_pos}")

ZIP is located at offset 8913920 in the disk image.

4. Analyzing corrupted magic bytes

 bash read-only • copy allowed Copy
xxd -s 8913920 -l 16 disk_image

Result:

008810000: 00 4b 03 00 14 00 09 00 08 00 ...
           ^        ^
           |        |
           should be 50 ('P')
                    should be 04

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Two bytes are zeroed:

• Position 0: 00 instead of 50 ('P')
• Position 3: 00 instead of 04

This is the hint from the description — "magic bytes... when they exist"!

Solution

Step 1: Restoring the ZIP header

 python read-only • copy allowed Copy
#!/usr/bin/env python3

with open('disk_image', 'rb') as f:
    data = f.read()

# ZIP position in image
zip_start = 8913920

# Find ZIP end (after EOCD)
eocd_pos = data.find(b'PK\x05\x06', zip_start)
zip_end = eocd_pos + 22  # EOCD minimum 22 bytes

# Extract ZIP data
zip_data = bytearray(data[zip_start:zip_end])
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Fix corrupted magic bytes
zip_data[0] = 0x50  # 'P'
zip_data[3] = 0x04  # Fix 00 -> 04

# Save fixed ZIP
with open('fixed.zip', 'wb') as f:
    f.write(zip_data)

print("Fixed ZIP saved to fixed.zip")

Step 2: Verifying the ZIP

 bash read-only • copy allowed Copy
unzip -l fixed.zip
# Archive:  fixed.zip
#   Length      Date    Time    Name
# ---------  ---------- -----   ----
#        30  2024-XX-XX XX:XX   1
# ---------                     -------
#        30                     1 file

# Attempt extraction
unzip fixed.zip
# [fixed.zip] 1 password: 

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

ZIP is password-protected (ZipCrypto, general purpose flag 0x0009).

Step 3: Cracking the ZIP password

 bash read-only • copy allowed Copy
# Extract hash for John
zip2john fixed.zip > zip.hash

# Crack with rockyou.txt
john --wordlist=/usr/share/wordlists/rockyou.txt zip.hash

# Result:
# 999999999        (fixed.zip/1)

Password: 999999999

Step 4: Extracting the flag

 bash read-only • copy allowed Copy
unzip -P "999999999" fixed.zip
cat 1

Recovery Techniques

Common magic bytes for recovery

Sleuthkit commands for forensics

 bash read-only • copy allowed Copy
# Filesystem info
fsstat image.dd

# File listing (including deleted)
fls -r image.dd

# Extract file by inode
icat image.dd <inode> > recovered_file

# Extract unallocated space
blkls image.dd > unalloc.bin

# Extract specific block
blkcat image.dd <block_num> > block.bin

# ext3/ext4 journal
jls image.dd

Alternative Approaches

1. Foremost/Scalpel — automatic file carving

    bash read-only • copy allowed Copy
   foremost -i disk_image -o output/

2. Binwalk — search for embedded files

    bash read-only • copy allowed Copy
   binwalk -e disk_image

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. PhotoRec — signature-based recovery

    bash read-only • copy allowed Copy
   photorec disk_image

References

• Sleuthkit Documentation
• ZIP File Format Specification
• File Signatures (Gary Kessler) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍