Skip to content

Instantly share code, notes, and snippets.

@Jinmo

Jinmo/README.md Secret

Last active December 25, 2016 05:32
Show Gist options
  • Save Jinmo/62395abcecc1bf05266741c8e21273ef to your computer and use it in GitHub Desktop.
Save Jinmo/62395abcecc1bf05266741c8e21273ef to your computer and use it in GitHub Desktop.
Download ZIP
Christmas CTF 2016 USB Disk Last Connected Time
Raw
README.md

On system.log and gzipped system.log files:

$ (cat *.log; zcat *.gz)|grep USBMSC|sort|tail -5
2016-12-22 20:53:50.025584+0900 0xc214     Default     0x0                  0      kernel: (IOUSBFamily) USBMSC Identifier (non-unique): 4C530006070617103092 0x781 0x5576 0x127, 2
2016-12-22 21:16:01.842416+0900 0xc230     Default     0x0                  0      kernel: (IOUSBFamily) USBMSC Identifier (non-unique): FF05080500133 0xf5f 0x1325 0x100, 2
2016-12-22 21:34:42.581755+0900 0xdecb     Default     0x0                  0      kernel: (IOUSBFamily) USBMSC Identifier (non-unique): FF05080500133 0xf5f 0x1325 0x100, 2
2016-12-22 21:44:24.957199+0900 0xde9d     Default     0x0                  0      kernel: (IOUSBFamily) USBMSC Identifier (non-unique): 4C530006070617103092 0x781 0x5576 0x127, 2
2016-12-22 21:47:07.436727+0900 0xdecb     Default     0x0                  0      kernel: (IOUSBFamily) USBMSC Identifier (non-unique): FF05080500133 0xf5f 0x1325 0x100, 2

Flag: 2016-12-22-21:47:07

Reference

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment