This challenge was pretty fun, there were a couple of dead ends/tricks.
The first step was to take a look at the packets. You can quickly notice that a ton of files are being grabbed using Wget (seen in the user-agent below). These can be exported using Wireshark’s File -> Export Objects -> HTTP.
When I listed out the files I noticed that there were a couple which were named with shorter, related strings. Running file on those particular files showed that they were all associated with either an archive or some data.
After extracting and searching through a couple (initially focusing on caa, cae because they return “flag.txt” when running strings), I tried to extract the bab file using arj.
The extraction failed when just trying to arj -e bab, so I figured that baa and bac may be extra pieces of the archive. I cat’d together bab,baa,bac (in that order), and again got a failure.
Finally, after putting them together in the order bab,bac,baa the extraction worked properly. The file f2 was extracted which is a BTRFS volume which I mounted to the directory f2dir.
F2 was, like all other archives in this challenge, full of more randomly named files. I run the following command to look for interesting strings in the entire subdir:
find -type f -exec strings {} \;
As seen in the screenshot above, some interesting PNG tEXt comments were found in one of the files, so I narrowed my search, found an ARC archive, and extracted the files:
grep -R ‘f-l-a-g’
Binary file vaQ1Dg/7JLc3R/ktCBdI/az7zY6/OdzAzw/abcde matchesfile abcde
abcde: ARC archive data, packedunar abcde -o derp
Looking into the ./derp/abcde folder shows the expected PNGs, some of which can be seen below. Essentially it was a bunch of broken strings trying to spell “f-l-a-g{lossless_data_compression}”. Since no PNG was complete, I couldn’t be sure, so I ran strings again on all of the files.
strings * | grep ‘f-l-a-g’
Again, we see a bunch of broken flag strings, though one of them is complete. When submitting flag{lossless_data_compression} to the challenge, we get a wrong answer. Lame. So the only other interesting flag here is the “f-l-a-g{sha512}”, which I suspect means we will have to grab the sha512 sum of that particular PNG.
grep ‘sha512’ *
Binary file 07bb9 matchessha512sum 07bb9
b70b003b1aa96c5b44e4cbb564196e43531d9cbdd5c27cca36e85ff89bf71a8109725b64834ae6232ce3110bf4a4f75a27dd7050aba9f4362ed729b333c0a5ed
Input the flag with the sha512 sum above and scored the 200pts!
