Info
  • Name: Minecraft
  • Difficulty: Easy
  • Points: 200
  • Category: Misc

 

 

Description

I just started playing Minecraft for my computer science class and forgot to remove a sign with my password before exiting the world. Could you please check what my password is.

Download Attachments here

 

Approach

The file was named bucketctfMC.mcworld and had a file extension of .mcworld However, upon checking the file type, I discovered that it was actually a zip file in disguise. To access its contents, I simply renamed the file extension to .zip and extracted it.

 

┌──(kali㉿iasad)-[~/CTFs/BucketCTF]
└─$ file bucketctfMC.mcworld                   
bucketctfMC.mcworld: Zip archive data, at least v4.5 to extract

┌──(kali㉿iasad)-[~/CTFs/BucketCTF]
└─$ mv bucketctfMC.mcworld bucketctfMC.zip     

┌──(kali㉿iasad)-[~/CTFs/BucketCTF]
└─$ unzip bucketctfMC.zip 
Archive:  bucketctfMC.zip
  inflating: db/000003.log           
  inflating: db/CURRENT              
  inflating: db/MANIFEST-000002      
  inflating: level.dat               
  inflating: level.dat_old           
  inflating: levelname.txt           
  inflating: world_icon.jpeg

 

one particularly interesting file was db/000003.log so I checked its contents using glogg tool. I just searched for bucket in the logs and got the flag

 

logs

 


Flag: bucket{1L0V3MIN3CRAFT_1c330e9105f1}