CTF TOPIC · 7 FLAGS · 22 MIN

Artifact forensics

Magic bytes, metadata, nested archives and data hidden after a file's end.

Forensics means examining a file closely. The first bytes (magic bytes) identify the real file type whatever the extension says. Images and documents carry metadata (EXIF) that people forget to strip. Archives are often nested several deep. And data can be appended after a file's logical end marker, invisible to viewers but present in the bytes. strings, file, exiftool and binwalk are the everyday tools.

A first example

89 50 4E 47 = PNG ; exiftool photo.jpg ; binwalk file ; strings file | grep flag

First moves

1. Check magic bytes (file command)
2. Run strings and search for flag{
3. Read metadata (exiftool)
4. Look past the end marker for appended data
5. Unpack nested archives until nothing is left

The challenges

• The overlooked field · Easy · 20 XP
• Readable fragments · Easy · 20 XP
• Put the handoff in order · Medium · 30 XP
• What file is this? · Medium · 30 XP
• The photo remembers · Easy · 20 XP
• Archive in an archive · Easy · 20 XP
• Hidden after the image · Medium · 30 XP