I Heard You Like Files – TAMUCTF’19

So this is a pretty basic but confusing challenge. Let us look at the description of the challenge and then proceed to solve it.

Challenge File:  ART.png

Description:

Screenshot from 2019-04-05 14-15-57

So the clue that description gives us is that the given challenge file “art.png” may not be a PNG. It turns out that it is true. PNGCHECK proves this

Screenshot from 2019-04-05 14-18-47.png

Looking at the hex-dump of the image provides us with more clues.

Screenshot from 2019-04-05 14-19-33

We see a lot of data after IEND, as I observed it, I saw some base64 text and after that %PDF. So yeah, we have a pdf file after the bytes of the image. But what is this base64 text that I am seeing? Let’s decode it.

Screenshot from 2019-04-05 14-39-58

Shit!! Looks like this was a rabbit hole 😦

Okay, time to check the PDF. Opening the PDF, I saw a lot of text which was not in English but in the end, we see some text which doesn’t at all make sense with the context of the challenge

Screenshot from 2019-04-05 14-42-56

Finally, I decided to you use binwalk on the PDF file. Skipping the unnecessary steps, we directly go into the extracted directory. We go into the word/media directory and we find an image1.png

I tried strings on this image. I found a particular base64-encoded string at the end. Decoding it gives us the flag.

Screenshot from 2019-04-05 15-16-20

So yeah, the challenge is done…Yay!

Flag: flag{P0lYt@r_D0_y0u_G3t_It_N0w?}

Please share & like the post if you enjoyed the challenge. Cheers!

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

Powered by WordPress.com.

Up ↑

Create your website at WordPress.com
Get started
%d bloggers like this: