Skip to main content

CTF

picoCTF WriteUp | Corrupted file

·1 min· loading · loading
Introduction # Hey everyone 👋 — In this Capture The Flag (CTF), we’re told that a file is broken and we need to figure out how we could repair it. File # Looking at the file, we could see that it seems like it is a JFIF. The file itself can’t be opened. Editing The Hex Value # That’s weird! — Referring to a Wikipedia article, the file SOI segment must start with FF D8. However, this starts with 5C 78. Let’s change that! To edit the value, you could use hexedit: sudo apt install hexedit # Install hexedit file # Edit the file. REPLACE FILE WITH YOUR FILENAME We would use hexedit to edit the file value. Simply add FF D8. Boom! — You could write the file via ctrl+w to write and ctrl+x to quit. Flag 🚩 # Boom! — We could now see the flag!

picoCTF WriteUp | Flag in Flame

·1 min· loading · loading
Introduction # Hey everyone 👋 — In this Capture The Flag (CTF) task, we’re told to analyze a large log file with something hidden within. Analyzing The File # The file seems like it’s encoded in base64. I would run a command to decode it. cat logs.txt | base64 -d > logs_decoded.txt Decoded File # As we can see, the decoded log file seems like it’s actually a .PNG. View # Looking at this .png file, we can see that a long string appears. Extracting & Decoding Strings # Google offers great Optical Character Recognition (OCR) technology. It allows us to copy the string which is: 7069636F43544678666F72656E736963735F616E616C797369735F69735F616D617A696E675F61633165333538347D We can drop it in MagicChef using the Magic recipe. It would return the result from Hex. Flag 🚩 # picoCTF{forensics_analysis_is_amazing_ac1e3584}