Posted on by and filed under CSAW 2012.

This challenge required use of basic utilities. Using the strings would show the results:

>$ strings core
CORE
csaw2012forensi
./csaw2012forensics
/lib64/ld-linux-x86-64.so.2
k3y{this_should_be_pretty_hard_unless_you_use_grep}
/lib/x86_64-linux-gnu
libc.so.6
linux-vdso.so.1
tls/x86_64/
x86_64

Another method is by simply opening the file in Notepad in Windows, you can clearly see the k3y{this_should_be_pretty_hard_unless_you_use_grep}

Forensics 500