Writeup by iv3l for Layer Cake 1/3

intro forensics docker

April 13, 2025

Once we downloaded the container and ran it, simply runnning a Docker history command without truncation reveals the first flag.

┌──(kali㉿kali)-[/bin]
└─$ sudo docker history --no-trunc anssi/fcsc2024
IMAGE                                            REATED         CREATED BY                                                                SIZE
sha256:0faa62781dd1db0ebb6cd83836bb4ba24f8b58b0cd4 months ago   CMD ["/bin/sh"]                                                           0B
<missing>                                        4 months ago   USER guest                                                                0B
<missing>                                        4 months ago   ARG FIRST_FLAG=FCSC{a1240d90ebeed7337efe51432e49b1a27c6ad2}               0B
<missing>                                        4 months ago   /bin/sh -c #(nop)  CMD ["/bin/sh"]                                        0B
<missing>                                        4 months ago   /bin/sh -c #(nop) ADD file:37a76ec7431fc4085097bb6a09d81b41775473 in /    7.38MB
FCSC{a1240d90ebeed7337efe51432e49b1a27c6ad2}