CTF: MBR - C:\COPY *.* A: /V

MBR Capture the Flag Challenge

Album released: 07 Mar 2017

https://masterbootrecord.bandcamp.com/album/c-copy-a-v

Secret

+HVbtNTHntCsA5HtypmkB2Luk0ZWxzjqOCScRd/Zts+xU/TibjoNVjbgvXql4hyqJYtQT+S6y93dq39xLZNgKHw4qfYz+ZB0VZLP3BLvc87a6tR53kEoDEnoc01Wf2jVZFOmtqiRsovF44E8NplrWOhyGv8NmYc21Ni88U9dMCrxQzGRk45gTVkMrt44LzMNuhKSmS1tRYGFvG3na5thxMOqewuD9hLw4XWTYPxJtYlkIgAnrZ6qAYeaenrzJi+I9aOvT72oNVI8HtwbnrEw2GlyTjhL4/lpLRhX1/aaPbi7OBj4Auy7/GB9znZ0bmkvUSxElv0clTaS8AIYNOoz9A==

EnCt2559258b58f45ad5c5871c693b3c5eccccebc4f53559258b58f45ad5c5871c693Rew1MuvDTgB
YlR7qvVizRx37EFA2uik6LiDU9KjCCggTog==IwEmS

EnCt212656377efe453fee57c2312c89896cc914da70812656377efe453fee57c2312A0dZfcchcAP
Zhl3qvVjg9eQcJjZHLKJdgPM=IwEmS

Analysis

This appears to be 3 Base64 blobs. The first one decodes easily. It ends up being a 256-byte binary blob, with no discernable header. Perhaps the result of a block-cipher, and the other two blobs can decrypt it.

For those remaining 2 blobs, usually = characters at the end indicate Base64 encoding (it’s padding used to indicate the last 3-byte block had fewer than 3 bytes). But, they don’t seem to decode. They look familiar: they begin with EnCt and end with IwEmS.

This pattern was seen in the C​:​\​>CHKDSK /F album. It is used by https://encipher.it/.