vee1e/Cryptonite-Taskphase
1
0
Fork 0
mirror of https://github.com/vee1e/Cryptonite-Taskphase.git synced 2026-09-01 19:17:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add macrohard

Browse source
This commit is contained in:
lucky-vers 2023-11-03 14:49:01 +05:30
parent 87c701dbbf
commit d5acd6cd07
1 changed files with 38 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

38
Phase 2/04 Forensics.md
View file

@ -3,3 +3,41 @@
# Trivial Flag Transfer Protocol
# MacroHard WeakEdge
**Flag:** `picoCTF{D1d_u_kn0w_ppts_r_z1p5}`
We're given a file `Forensics is fun.pptm`. Since PPT files are essentially zip files, we change its extension to `.zip` and extract it.
```
~/Downloads $ mv Forensics\ is\ fun.pptm Forensics\ is\ fun.zip
renamed 'Forensics is fun.pptm' -> 'Forensics is fun.zip'
~/Downloads $ atool -x Forensics\ is\ fun.zip
Archive: Forensics is fun.zip
inflating: Unpack-3555/[Content_Types].xml
inflating: Unpack-3555/_rels/.rels
inflating: Unpack-3555/ppt/presentation.xml
inflating: Unpack-3555/ppt/slides/_rels/slide46.xml.rels
inflating: Unpack-3555/ppt/slides/slide1.xml
inflating: Unpack-3555/ppt/slides/slide2.xml
inflating: Unpack-3555/ppt/slides/slide3.xml
.
.
.
```
Entering the directory `Forensics is fun`, we find a file called `hidden` inside the `ppt/slideMasters` subdirectory. The contents of it are
```
…/Downloads/Forensics is fun/ppt/slideMasters $ cat hidden
Z m x h Z z o g c G l j b 0 N U R n t E M W R f d V 9 r b j B 3 X 3 B w d H N f c l 9 6 M X A 1 f Q
```
It seems to be a base64 cipher. Removing the spaces and using `base64` on it, we get the following output
```
…/Downloads/Forensics is fun/ppt/slideMasters $ sed -i 's/ //g' hidden
…/Downloads/Forensics is fun/ppt/slideMasters $ cat hidden
ZmxhZzogcGljb0NURntEMWRfdV9rbjB3X3BwdHNfcl96MXA1fQ
…/Downloads/Forensics is fun/ppt/slideMasters $ base64 -d hidden
flag: picoCTF{D1d_u_kn0w_ppts_r_z1p5}
```