[Misc] SECTF - Joeys screenshot

Misc comments, misc, puzzle, stego, zsteg Comments


Joeys screenshot - Misc (50 + 0)

Joey gave me this screenshot to prove he got into The Gibson. Can you help us hack The Gibson too?

Solves: 69

Download: http://dl.ctf.rocks/joey.tar.gz

Author: SecureLink / klondike

Pretty simple one, this image had some strange hidden comments, I extracted them using https://github.com/zed-0xff/zsteg:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
$ zsteg chall.png
meta Comment        .. 

    00000000: 5f 33 36                                          |_36             |
meta Comment        .. 

    00000000: 33 32 37                                          |327             |
meta Comment        .. 

    00000000: 43 32                                             |C2              |
meta Comment        .. 

    00000000: 31 33 34                                          |134             |
meta Comment        .. 

    00000000: 35 32 34                                          |524             |
meta Comment        .. 

    00000000: 4e 32 32                                          |N22             |
meta Comment        .. 

    00000000: 48 34 31                                          |H41             |
meta Comment        .. 

    00000000: 7b 34                                             |{4              |
meta Comment        .. 

    00000000: 5f 31 31                                          |_11             |
meta Comment        .. 

    00000000: 5f 33 33                                          |_33             |
meta Comment        .. 

    00000000: 5f 31 33                                          |_13             |
meta Comment        .. 

    00000000: 30 32 31                                          |021             |
meta Comment        .. 

    00000000: 45 31                                             |E1              |
meta Comment        .. 

    00000000: 35 33 30                                          |530             |
meta Comment        .. 

    00000000: 33 34 32                                          |342             |
meta Comment        .. 

    00000000: 48 34 33                                          |H43             |
meta Comment        .. 

    00000000: 30 33 38                                          |038             |
meta Comment        .. 

    00000000: 35 33 35                                          |535             |
meta Comment        .. 

    00000000: 50 32 36                                          |P26             |
meta Comment        .. 

    00000000: 55 32 35                                          |U25             |
meta Comment        .. 

    00000000: 47 33 37                                          |G37             |
meta Comment        .. 

    00000000: 34 31 35                                          |415             |
meta Comment        .. 

    00000000: 33 39                                             |39              |
meta Comment        .. 

    00000000: 42 31 39                                          |B19             |
meta Comment        .. 

    00000000: 53 30                                             |S0              |
meta Comment        .. 

    00000000: 55 32 39                                          |U29             |
meta Comment        .. 

    00000000: 52 32 38                                          |R28             |
meta Comment        .. 

    00000000: 52 33 32                                          |R32             |
meta Comment        .. 

    00000000: 44 31 34                                          |D14             |
meta Comment        .. 

    00000000: 32 31 32                                          |212             |
meta Comment        .. 

    00000000: 5f 32 33                                          |_23             |
meta Comment        .. 

    00000000: 44 35                                             |D5              |
meta Comment        .. 

    00000000: 44 33 39                                          |D39             |
meta Comment        .. 

    00000000: 5f 34 30                                          |_40             |
meta Comment        .. 

    00000000: 47 31 37                                          |G17             |
meta Comment        .. 

    00000000: 4b 38                                             |K8              |
meta Comment        .. 

    00000000: 59 31 30                                          |Y10             |
meta Comment        .. 

    00000000: 33 34 34                                          |344             |
meta Comment        .. 

    00000000: 21 34 35                                          |!45             |
meta Comment        .. 

    00000000: 35 32 30                                          |520             |
meta Comment        .. 

    00000000: 54 33                                             |T3              |
meta Comment        .. 

    00000000: 33 33 31                                          |331             |
meta Comment        .. 

    00000000: 31 31 38                                          |118             |
meta Comment        .. 

    00000000: 34 36                                             |46              |
meta Comment        .. 

    00000000: 7d 34 36                                          |}46             |
meta Comment        .. 

    00000000: 5f 31 36                                          |_16             |
meta Comment        .. 

    00000000: 5f 37                                             |_7              |

After extracting them into a file I noticed the pattern behind it! if we get some comments we can see something familiar!

1
2
3
4
5
S0
E1
C2
T3
{4

Yes! the first letter is a character from the flag and the order is the number after it! so lets write a python script to parse this and construct the flag!

1
2
3
4
5
6
7
8
9
d = {}
flag = ''
with open('notes.txt', 'r') as f:
	l = f.read().split()
	for s in l:
		d[s[1:]] = s[0]
for x in xrange(47):
	flag += d[str(x)]
print flag

A now running it

1
2
$ python misc50.py 
SECT{D4_K3Y_2_D4_G1B50N_5UP3RU53R_15_G0D_H3H3!}

TeamRocketISTCTF Team

Portuguese Computer Science Students