map dealer#

We have confiscated a USB drive from sahuang, whom we were informed was trying to sell a beatmap containing some confidential data of the community to the dark web. However, the beatmap was nowhere to be found from the drive when we mounted it to our computer. Can you help recover it?

File#

From the challenge we get a file

1
❯ file *
2
SanDisk.E01: EWF/Expert Witness/EnCase image file format

Based on the clues we know that this was a usb drive file that probably has some deleted data

We can use sleuthkit fls to list the files that are in the drive:

1
❯ fls SanDisk.E01
2
r/r 8195:       SanDisk (Volume Label Entry)
3
r/r 8196:       $ALLOC_BITMAP
4
r/r 8197:       $UPCASE_TABLE
5
d/d 8198:       System Volume Information
6
r/r * 8202:     sahuang - secret map.osz
7
v/v 3911034883: $MBR
8
v/v 3911034884: $FAT1
9
V/V 3911034885: $OrphanFiles

We see that there is a secret map file so lets extract that with icat SanDisk.E01 8202 > "sahuang - secret map.osz"

Now if you have ever played osu you know that the .osz files are actually just zip files we can unzip this and look at the contents

1
❯ unzip sahuang\ -\ secret\ map.osz
2
Archive:  sahuang - secret map.osz
3
  inflating: audio.MP3
4
  inflating: flag.png
5
  inflating: sahuang - secret map (hollow) [flag{osu_is_really_fun!}].osu

Now got the flag.png all we do is open it up and get the flag: