• URL: https://play.picoctf.org/practice/challenge/456
• Title: Event-Viewing
• Tags: Medium, Forensics, picoCTF 2025, browser_webshell_solvable
• Author: Venax
• Started: 16 July 2025
• Solved: 16 July 2025
• Description:

One of the employees at your company has their computer infected by malware! Turns out every time they try to switch on the computer, it shuts down right after they log in. The story given by the employee is as follows:

1. They installed software using an installer they downloaded online
2. They ran the installed software but it seemed to do nothing
3. Now every time they bootup and login to their computer, a black command prompt screen quickly opens and closes and their computer shuts down instantly.

See if you can find evidence for the each of these events and retrieve the flag (split into 3 pieces) from the correct logs! Download the Windows Log file here

…

• URL: https://play.picoctf.org/practice/challenge/506
• Title: DISKO 2
• Tags: Medium, Forensics, picoGym Exclusive
• Author: Darkraicg492
• Started: 15 July 2025
• Solved: 15 July 2025
• Description:

Can you find the flag in this disk image? The right one is Linux! One wrong step and its all gone! Download the disk image here.

This one is similar to DISKO1 with extra steps.

After downloading and inflating, I checked the disk image using fdisk -l

strikingsoul@ramones:~/Downloads$ fdisk -l disko-2.dd 
Disk disko-2.dd: 100 MiB, 104857600 bytes, 204800 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x8ef8eaee

Device      Boot Start    End Sectors Size Id Type
disko-2.dd1       2048  53247   51200  25M 83 Linux
disko-2.dd2      53248 118783   65536  32M  b W95 FAT32

According to the description, I had to grab the linux partition.