Another day, another challenge.
Today’s challenge is from the InfoSec Institute CTF.
Going to the following LINK we see:
Doing our favorite trick of right click, view page source we see the following:
We see an image of “php-logo-virus.jpg” hmm… what happens when we click this file?
We see the following:
Looks like a simple file… looks can be deceiving.
Just going from the title of the file, there’s something in this file that we’re not seeing.
Let’s use our trick from the last challenge of using strings to see if this is a true file.
Using the strings command inside our cygwin terminal we see the following:
Hmm… we see the beginning part of the flag. The last looks like encoding.
Let’s try to decode it.
One of the encoding we’ve seen in the challenges have been base64 encoding, so let’s use that to see if we can decode the message.
Going to this link, and typing in the encoding we see the following:
We’re presented with a link. Going to that link we see the following:
Combining the this with the beginning of the flag, we get infosec_flagis_powerslide!
Lessons learned:
Most of these challenges build on top of each. We still used our tried and true right click, view page source to see if there are any nuggets that were not shown on the page. We noticed there was a file. Looking at the name, we determined that there was more than what met the eye. Using another command we learned – strings we were able to see that the flag was embedded in picture, but it was encoded. Using previous knowledge, we noticed that previous challenges used base64 encoding so we used that (base64) to see if we can decode the text. After decoding we went to the link and used the image to complete the flag.
