# Space Stream
Forensics, 500- pts
> Our recon troops gathered information about the enemy territory and reported back to our Planetary Fortress. However, Zerg's Red team hackers infiltraded our database and hid all information about where their main Lair is located. Can you recover the missing image for us?
The `starstream.vhd` file is a virtual hard disk file used in VMs. Initially I did the basics for reading a disk image file with `mmls`:
```$ mmls starstream.vhd
GUID Partition Table (EFI)Offset Sector: 0Units are in 512-byte sectors
      Slot      Start        End          Length       Description000:  Meta      0000000000   0000000000   0000000001   Safety Table001:  -------   0000000000   0000000127   0000000128   Unallocated002:  Meta      0000000001   0000000001   0000000001   GPT Header003:  Meta      0000000002   0000000033   0000000032   Partition Table004:  000       0000000128   0000036991   0000036864   Basic data partition005:  -------   0000036992   0000040960   0000003969   Unallocated```
Usually, data partitions are what we're interested in. Let's learn more about partition 4 with `fsstat`:
```$ fsstat -o 128 starstream.vhd
FILE SYSTEM INFORMATION--------------------------------------------File System Type: NTFSVolume Serial Number: FA9EAF5F9EAF12E5OEM Name: NTFS    Volume Name: New VolumeVersion: Windows XP
[...]```
This is an NTFS partition, which utilises alternate data streams, hence the name of the challenge. To see the file structure in this folder, I use `fls`:
```$ fls -o 128 -r starstream.vhd
[...]d/r 38-128-4:   data_streams:stream5.zipd/d 38-144-1:   data_streams+ d/r 38-128-4: .:stream5.zip+ r/r 39-128-3: stream1.jpg+ r/r 39-128-5: stream1.jpg:sarah_kerrigan+ r/r 40-128-3: stream2.jpg+ r/r 40-128-5: stream2.jpg:hint1.txt+ r/r 41-128-3: stream3.jpg+ r/r 41-128-5: stream3.jpg:hint2.txt+ r/r 42-128-3: stream4.jpg+ r/r 42-128-5: stream4.jpg:hint3.txt```
Many images and text files, which can be extracted using `icat`. I used the `-f ntfs` flag for NTFS data stream support. When it's done I also unzipped the `stream5.zip` file, which contained a password-protected PDF. Looking into the `sarah_kerrigan` text file, it says:
```I should stop using my name as password. Maybe I can just hide my file, they will never find it.```
So I tried `sarah_kerrigan` as the password of the PDF, which unlocked it, and revealed the flag.
`shctf{r1ver_styx}`