Forensics

PreviousBinary Exploitations NextReverse Engineering

Last updated 3 years ago

Was this helpful?

Forensics

Glory of the Garden [50 pts]

Solution

Being the most basic flag I assumed it would have the flag in the file in plain text but after the image. I used a simple command and the last line printed out the flag. strings garden.jpg

Flag: picoCTF{more_than_m33ts_the_3y3657BaB2C}

So Meta [150 pts]

Solution

Gave hint of the title "meta" so I used the built-in tool

exiftool pico_img.png

Flag: picoCTF{s0_m3ta_fec06741}

shark on wire 1 [150 pts] [Not Solved]

Solution

Flag:

extensions [150 pts]

Solution

Either by trying to open, using the file flag.txt command, or hex editor flag.txt the conclusion is the same. It is a PNG file.

Flag: picoCTF{now_you_know_about_extensions}

What Lies Within [150 pts]

Solution

Flag: picoCTF{h1d1ng_1n_th3_b1t5}

m00nwalk [250 pts] [Not Solved]

Solution

Flag:

WhitePages [250 pts]

Solution

I know the file is filled with spaces but looking through hex editor it isn't spaces but more of other types of hex that are not viewable. I noticed it was a "." and " " pattern denoting 1's and 0's with hex "E2", "80", "83", and "20". Hmmm 4 but only needed 2... You can notice that the two patterns are E28083 and 20. Taking that and converting the bits in the file gets a bunch of 10 which goes to ASCII flag.

import binascii

def text_from_bits(bits, encoding='utf-8', errors='surrogatepass'):
    n = int(bits, 2)
    return int2bytes(n).decode(encoding, errors)

def int2bytes(i):
    hex_string = '%x' % i
    n = len(hex_string)
    return binascii.unhexlify(hex_string.zfill(n + (n & 1)))
    
with open("whitepages.txt", "rb") as bin_file:
	data = bytearray(bin_file.read()) 
	data = data.replace(b'\xe2\x80\x83', b'0')
	data = data.replace(b'\x20', b'1')
	data = data.decode("ascii")
	print(data)
	print(text_from_bits(data))

Output

Flag: picoCTF{not_all_spaces_are_created_equal_c54f27cd05c2189f8147cc6f5deb2e56}

c0rrupt [250 pts] [Not Solved]

Solution

Flag:

like1000 [250 pts] [Not Solved]

Solution

Flag:

m00nwalk2 [300 pts] [Not Solved]

Solution

Flag:

Investigative Reversing 0 [300 pts] [Not Solved]

Solution

Flag:

shark on wire 2 [300 pts] [Not Solved]

Solution

Flag:

Investigative Reversing 2 [350 pts] [Not Solved]

Solution

Flag:

Investigative Reversing 1 [350 pts] [Not Solved]

Solution

Flag:

WebNet0 [450 pts] [Not Solved]

Solution

Flag:

Investigative Reversing 4 [400 pts] [Not Solved]

Solution

Flag:

Investigative Reversing 3 [400 pts] [Not Solved]

Solution

Flag:

WebNet1 [450 pts] [Not Solved]

Solution

Flag:

investigation_encoded_1 [450 pts] [Not Solved]

Solution

Flag:

investigative_encoding_2 [500 pts] [Not Solved]

Solution

Flag:

B1g_Mac [500 pts] [Not Solved]

Solution

Flag:

PreviousBinary Exploitations NextReverse Engineering

Last updated 3 years ago

Was this helpful?