2013年7月8日 星期一

PHD CTF Quals 2012 Write Up: Forensic 100

In this problem, and QRcode image are given as following pic.


We first use online scanner to scan this QRcode and get the binary string.
7F454C46010000000000000000004305020003001A0043051A00430504000000B931004305B220CD80252000010093CD803030343330354232323043443830323532303030303130303933434438300A
Saving this string as a file, and using file command, we can recognized this file is an ELF executable.
After executing file, we get the string as output.
004305B220CD80252000010093CD80
Then with stegsolve, we can extract some string.
328:5261 72211A07 00CE9973 80000D00 00000000 00001566
EFE453AE B7AFEBEB 515C366D 9C07555B 4739CBEE 3217360A
3A52E015 3C7AA47C F3BC9DEA 16A30B98 8B5ABCC2 B98BD56C
8E84EB4A 7CEACF43 74D01FD6 9D98C282 1D05B79B 2CC4D3E6
4CB09081 42566EEA C2862E0A 2BA7C559 7E7FCB77 97051CFE
55C8DF4A 10A93D07 2DC79C64 39C6E44D 9845B267 21A71566
EFE453AE B7AF74E5 062C467D BD49421B 47D68DB8 E7F5.

The first integer 328 may indicate the length of msg. Therefore we extract first 328 chars as a file, which is indeed an RAR file.
To extract RAR file, we need a password. Hence we use first string as password and express RAR file.
There is an secret.txt and key.
The key is 90f3910ff22f4be0dfa95a2fd6cb8a25

沒有留言:

張貼留言