[Writeup] Pragyan CTF - Forensics

Welcome

We have a jpg file, I used HXD and see a zip file in it, then I used binwalk to get the zip file.

1 2 3 4 5 6 7

$ binwalk welcome.jpeg DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 JPEG image data, JFIF standard 1.01 10600 0x2968 Zip archive data, at least v2.0 to extract, uncompressed size: 9886, name: d.zip 20483 0x5003 End of Zip archive

And what I got? One secret.bmp file and one zip file contain the flag but protected by password. Dig the bitmap file I saw a base64 strings is: dGhlIHBhc3N3b3JkIGlzOiBoMzExMF90aDNyMyE==
Decode and I got the password is: h3110_th3r3!
After have a.png I used stegsolve to check lsb and got the flag

Flag: pctf{st3gs0lv3_1s_u53ful}

Magic PNGs

The picture you_can't_see_me.png have wrong 2 point, first is the header, I changed the header

89 50 4E 47 2E 0A 2E 0A to 89 50 4E 47 0D 0A 1A 0A

then I look for chunk: 6, the iidat should be IDAT, 

fix it and I got the image:

And the password for zip file is md5(h4CK3RM4n)

Flag: pctf{y0u_s33_m33_n0w!}

Read More