FindTheLeak

Author: 0xIDA
Platform: FlagYard · Category: forensics · Difficulty: Medium

Solvers

solve.py

Summary

NTFS-only forensics: recover an attacker staging directory name from $MFT/$J after a short-lived exfil.7z, then decode the directory name (Base64 → Base32) to the flag.

Solution

Step 1: Identify the exfil artifact in the USN Journal

Artifacts: $MFT and $Extend/$J from FindTheLeak.zip.

Parse USN records and filter for .7z. Legitimate Edge update names (msedge*.7z) appear, plus:

entry=125934 parent=28584 name=exfil.7z  (create → data extend → close → delete)

exfil.7z is created and deleted within ~2 minutes under parent entry 28584.

Step 2: Resolve parent path + decode

MFT entry 28584 is a directory whose name is Base64:

YnMzMi1JWldHQ1oyWlBOUkdLTkRGR0JSV0NaQlpNSlJUU05EREdGUlRPT0RHR000VEFOQlRIQVlERU1ER0dRMlRPN0k9===

Full path (entry reuse after delete):

.\ProgramData\Microsoft\Windows\<b64>\6a5c6680-f3ce-4de0-9873-053c887f5df6.tmp

import base64
b64 = "YnMzMi1JWldHQ1oyWlBOUkdLTkRGR0JSV0NaQlpNSlJUU05EREdGUlRPT0RHR000VEFOQlRIQVlERU1ER0dRMlRPN0k9=="
s = base64.b64decode(b64).decode()  # bs32-IZWGCZ2Z...
token = s.split("-", 1)[1]
while len(token) % 8:
    token += "="
print(base64.b32decode(token).decode())

Flag

FlagY{be4e0cad9bc94c1c78f390438020f457}

Tools

Python (USN + MFT $FILE_NAME parser)
strings / manual path reconstruction

Key takeaway

USN gives the deleted name (exfil.7z) and parent FRN; MFT shows the parent directory still present with an encoded name that is the flag carrier — not the deleted archive contents.