CTF EVENT : DownUnderCTF 2021
DIFFICULTY: Easy
CATEGORY: FORENSICS
POINTS: 100
CHALLENGE:
Our machine that makes QR Codes started playing up then it just said “PC LOAD LETTER” and died. This is all we could recover…
Author: xXl33t_h@x0rXx
Download: challenge.gif
We can see this is a QR challenge so we will need to reconstruct the QR in order to read it.
This is a GIF so we can separate all the frames. However, we can already see that there are multiples QR codes on this GIF. Let’s verify it.
I verified this hypothesis with the website https://ezgif.com/
We just confirmed the hypothesis of multiple QR codes. Moreover, we have a clear view that each QR code has a different color. We can also see that each QR code is separated by 10 frames.
As consequence, in order to recreate the QR codes, we will need to put append frame1 with frame11 then with frame21, and so on.
Let’s use ImageMagick in order to split the frames and put everything together.
First I created folder “frames”.
Then I run this command to separate all the frames:
convert challenge.gif frames/frame.png
Now I can run this command to recreate each QR code:
QR code1:
convert frames/frame-0.png frames/frame-10.png frames/frame-20.png frames/frame-30.png frames/frame-40.png frames/frame-50.png frames/frame-60.png frames/frame-70.png frames/frame-80.png frames/frame-90.png frames/frame-100.png frames/frame-110.png -append QRcode1.pngQR code2:
convert frames/frame-1.png frames/frame-11.png frames/frame-21.png frames/frame-31.png frames/frame-41.png frames/frame-51.png frames/frame-61.png frames/frame-71.png frames/frame-81.png frames/frame-91.png frames/frame-101.png frames/frame-111.png -append QRcode2.pngQR code3:
convert frames/frame-2.png frames/frame-12.png frames/frame-22.png frames/frame-32.png frames/frame-42.png frames/frame-52.png frames/frame-62.png frames/frame-72.png frames/frame-82.png frames/frame-92.png frames/frame-102.png frames/frame-112.png -append QRcode3.pngQR code4:
convert frames/frame-3.png frames/frame-13.png frames/frame-23.png frames/frame-33.png frames/frame-43.png frames/frame-53.png frames/frame-63.png frames/frame-73.png frames/frame-83.png frames/frame-93.png frames/frame-103.png frames/frame-113.png -append QRcode4.pngQR code5:
convert frames/frame-4.png frames/frame-14.png frames/frame-24.png frames/frame-34.png frames/frame-44.png frames/frame-54.png frames/frame-64.png frames/frame-74.png frames/frame-84.png frames/frame-94.png frames/frame-104.png frames/frame-114.png -append QRcode5.pngQR code6:
convert frames/frame-5.png frames/frame-15.png frames/frame-25.png frames/frame-35.png frames/frame-45.png frames/frame-55.png frames/frame-65.png frames/frame-75.png frames/frame-85.png frames/frame-95.png frames/frame-105.png frames/frame-115.png -append QRcode6.pngQR code7:
convert frames/frame-6.png frames/frame-16.png frames/frame-26.png frames/frame-36.png frames/frame-46.png frames/frame-56.png frames/frame-66.png frames/frame-76.png frames/frame-86.png frames/frame-96.png frames/frame-106.png frames/frame-116.png -append QRcode7.pngQR code8:
convert frames/frame-7.png frames/frame-17.png frames/frame-27.png frames/frame-37.png frames/frame-47.png frames/frame-57.png frames/frame-67.png frames/frame-77.png frames/frame-87.png frames/frame-97.png frames/frame-107.png frames/frame-117.png -append QRcode8.pngQR code9:
convert frames/frame-8.png frames/frame-18.png frames/frame-28.png frames/frame-38.png frames/frame-48.png frames/frame-58.png frames/frame-68.png frames/frame-78.png frames/frame-88.png frames/frame-98.png frames/frame-108.png frames/frame-118.png -append QRcode9.pngQR Code10:
convert frames/frame-9.png frames/frame-19.png frames/frame-29.png frames/frame-39.png frames/frame-49.png frames/frame-59.png frames/frame-69.png frames/frame-79.png frames/frame-89.png frames/frame-99.png frames/frame-109.png frames/frame-119.png -append QRcode10.pngGood right now we have all the QR codes and we can see their content.
In order to read the QR codes I will use zbarimg.
Ok, here we have a link. However, we can not find anything on this YouTube page:
Nothing interesting so far…
Another link, let’s check it. This is another video. They are trolling us haha
Nothing here. Let’s continue…
This code is weird (RFVDVEZ7YU1). It doesn’t make any sense. Let’s continue…
Nothing interesting here…
Ok, it looks base64 but if we decrypt it doesn’t show anything.
Another YouTube video:
Ok…. What do we get so far? So with the links (youtube videos), we don’t find anything in the comments or video descriptions.
Two QR codes make no sense for us: QRcode6 and QRcode8. QRcode8 looks like an end of a base64 cipher. Maybe the QRcode6 is the beginning of the cipher?
Let’s verify this theory:
QRcode6: RFVDVEZ7YU1
QRcode8: fMV9oYVhYMHJfbjB3P30=
Full Cipher: RFVDVEZ7YU1fMV9oYVhYMHJfbjB3P30=
Let’s decode it with base64. First, save the cipher in a text file(cypher.txt in this case). Then run base64 -d cipher.txt
Well done we just found the flag 😊
CONCLUSION:
This is not my first time solving QR code challenges. But it was fun, the challenge itself was not so difficult.
I could develop a bash or python script to automate the changes of the files, but I decided just to change the names manually before running “convert”.
I hope that my writeup helped you to understand better all the aspects of this CTF. If you want to read more writeups like this one or have any questions, you can find me on Twitter @dropn0w.
Stay safe and keep learning!