-1

I'm currently working through a series of CTF forensics challenge and have run into a file format that I am dead-ending on. The format has no recognizable File Magic Number - and the file itself is filled with odd repetitive sequences of text like:

Enter/Down/Down/Enter/Down/Down/Down/Enter/Down/Down/Down/readme.txtAnd the path, to you, remains clear.

Any suggestions for avenues of research?

  • do you have the program which parses the file? – Igor Skochinsky May 28 '18 at 11:56
  • Hello again, @IgorSkochinsky - great to hear from you. For the challenge, we essentially just got an address to connect to with NetCat. On connection, the server transmitted the file contents. No shell, just that data response. The connection is closed at EOF with this ...?Enter/Right/P?p9LPi?Wh Enter/Right/readme.txtPK00+? End Transmission My initial guesses are that either the flag is encoded in the file, or the file contains instructions on where to get the flag. – BronzeOtter May 29 '18 at 1:34
  • I had previously suspected that the file was an MP4 container due to this line: Enter/Down/readme.txtAnd the path, to you, remains clear. PKÓp9LÿW”2µ Enter/map.mp4”÷’’FC\5 but it doesn't seem to be correctly formatted – BronzeOtter May 29 '18 at 1:36
  • 3
    PK is more like a magic number for ZIP file, which could inside contain an mp4. – Paweł Łukasik May 30 '18 at 3:45
  • @PawełŁukasik This was the key clue. Turned out to be a corrupt (but still openable with unzip) ZIP file. Thank you! – BronzeOtter Jun 15 '18 at 16:41
2

Returning to this challenge after a bit, and Paweł Łukasik's comment turned out to be key. The presence of repeated PK sequences was the clue that this was actually a ZIP file. Ran unzip on the file - which turned out to be a somewhat corrupt ZIP. The file expanded to a huge stack of nested directories named Up, Right, Etc - and in one of those directories was the flag. Thanks again Paweł for the key clue!

  • By the way, the MP4 file had a "map" of the maze hidden inside it, visible when opened with HexFiend – BronzeOtter Jun 15 '18 at 16:40
  • Nice to hear that! – Paweł Łukasik Jun 15 '18 at 18:08
0

It seems just a simple text file, what I think /Down/ means a parent directory, so it's just a path to a readme.txt file, you just have to navigate to it, and find what it there. the indication at the end the path to you remains clear confirms what I said

  • I had suspected something like that. But that leads to two questions - first, there are also many references to /Right/ - which doesn't seem to make sense if it refers to a path. Secondly, there's no address that leads to a shell or directory structure (see above) - all we're given is that data. I do suspect there might be a location to connect to hidden in the file, but am not sure on how to follow up on that... – BronzeOtter May 29 '18 at 1:38
0

My answer is similar to @JanaTii! This file is the description to the flag path, the entrypoint is the server (which you can connect with netcat/telnet ...). You have to use hints from that file to find out how to access to flag (maybe readme.txt). In some cases, it just check all the characters you input as keys to open the box (In the past, my challenge is all binary data with "Open the box" at last - I piped all the data to the netcat server and the flag was printed). Good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.