Introduction#
Hey everyone 👋 — In this Capture The Flag (CTF), we’re told that a file is broken and we need to figure out how we could repair it.
File#
Looking at the file, we could see that it seems like it is a JFIF. The file itself can’t be opened.
Editing The Hex Value#
That’s weird! — Referring to a Wikipedia article, the file SOI segment must start with FF D8. However, this starts with 5C 78. Let’s change that!
To edit the value, you could use hexedit:
sudo apt install hexedit # Install
hexedit file # Edit the file. REPLACE FILE WITH YOUR FILENAME
We would use hexedit to edit the file value. Simply add FF D8.
Boom! — You could write the file via ctrl+w to write and ctrl+x to quit.
Flag 🚩#
Boom! — We could now see the flag!
We could use Google Optical Image Recognition (OCR) to get the text of the image.
picoCTF{r3st0r1ng_th3_by73s_684e09bc}