# Tabby's Date - CTF challenge
Table of Contents
Challenge informations
- Name:
Tabby's Date - Category:
🔍 Forensics
The walkthrough
We are presented with a zip file so after extracting its contents, we are presented with a lot of folders most of them are empty.
So to find the non-empty folders I ran the following command.
find ./C -type fThis returned the paths to all the files under the C folder.
..../C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/002d2531-9aff-42b1-b54d-b178c88063b4.bin./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/04165ca3-c82b-42ca-ab07-0c774ae66efd.bin./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/056941ef-d51d-4e57-9a55-b59d58bf3fcb.bin./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/14623d59-ad8c-43a8-b669-587f049a1516.bin./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/17de440f-3f69-4d8a-94fe-f3d4b9cf0c3f.bin./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/1aebb59c-5d51-41f1-918e-dec9e1a28ce1.bin./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/2d755c27-5840-47ad-a4ca-ed8041dd3047.bin./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/2e0dd6b6-ba93-4efc-9fd4-985dad74869a.bin./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/414e4071-60e6-4bb6-9a5a-f1e5bf6fe79c.bin./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/45dcdbe4-26b5-4e0b-ba2d-29e9e9c1e11b.bin./C/Users/Tabby/AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState/4f1c96a1-960c-4cee-9751-fe4b4f59fdd0.bin...Looking at the contents of one of these files it has a lot of null bytes since Windows uses UTF-16-LE encoding for texts.
for x in $(find ./C -type f); do strings -e l $x; doneThe command above will print the UTF-16-LE text in these files. All we need to add now is a lookup for the keyword flag.
for x in $(find ./C -type f); do strings -e l $x; done | grep flagAnd we get:
they told me the password is: flag{165d19b610c02b283fc1a6b4a54c4a58}