How to pronounce GIF — DownUnderCTF 2021

CTF EVENT : DownUnderCTF 2021

DIFFICULTY: Easy

CATEGORY: FORENSICS

POINTS: 100

CHALLENGE:

Our machine that makes QR Codes started playing up then it just said “PC LOAD LETTER” and died. This is all we could recover…

Author: xXl33t_h@x0rXx

Download: challenge.gif

We can see this is a QR challenge so we will need to reconstruct the QR in order to read it.

This is a GIF so we can separate all the frames. However, we can already see that there are multiples QR codes on this GIF. Let’s verify it.

I verified this hypothesis with the website https://ezgif.com/

We just confirmed the hypothesis of multiple QR codes. Moreover, we have a clear view that each QR code has a different color. We can also see that each QR code is separated by 10 frames.

As consequence, in order to recreate the QR codes, we will need to put append frame1 with frame11 then with frame21, and so on.

Let’s use ImageMagick in order to split the frames and put everything together.

First I created folder “frames”.

Then I run this command to separate all the frames:

convert challenge.gif frames/frame.png

Now I can run this command to recreate each QR code:

QR code1:

convert frames/frame-0.png frames/frame-10.png frames/frame-20.png frames/frame-30.png frames/frame-40.png frames/frame-50.png frames/frame-60.png frames/frame-70.png frames/frame-80.png frames/frame-90.png frames/frame-100.png frames/frame-110.png -append QRcode1.png

QR code2:

convert frames/frame-1.png frames/frame-11.png frames/frame-21.png frames/frame-31.png frames/frame-41.png frames/frame-51.png frames/frame-61.png frames/frame-71.png frames/frame-81.png frames/frame-91.png frames/frame-101.png frames/frame-111.png -append QRcode2.png

QR code3:

convert frames/frame-2.png frames/frame-12.png frames/frame-22.png frames/frame-32.png frames/frame-42.png frames/frame-52.png frames/frame-62.png frames/frame-72.png frames/frame-82.png frames/frame-92.png frames/frame-102.png frames/frame-112.png -append QRcode3.png

QR code4:

convert frames/frame-3.png frames/frame-13.png frames/frame-23.png frames/frame-33.png frames/frame-43.png frames/frame-53.png frames/frame-63.png frames/frame-73.png frames/frame-83.png frames/frame-93.png frames/frame-103.png frames/frame-113.png -append QRcode4.png

QR code5:

convert frames/frame-4.png frames/frame-14.png frames/frame-24.png frames/frame-34.png frames/frame-44.png frames/frame-54.png frames/frame-64.png frames/frame-74.png frames/frame-84.png frames/frame-94.png frames/frame-104.png frames/frame-114.png -append QRcode5.png

QR code6:

convert frames/frame-5.png frames/frame-15.png frames/frame-25.png frames/frame-35.png frames/frame-45.png frames/frame-55.png frames/frame-65.png frames/frame-75.png frames/frame-85.png frames/frame-95.png frames/frame-105.png frames/frame-115.png -append QRcode6.png

QR code7:

convert frames/frame-6.png frames/frame-16.png frames/frame-26.png frames/frame-36.png frames/frame-46.png frames/frame-56.png frames/frame-66.png frames/frame-76.png frames/frame-86.png frames/frame-96.png frames/frame-106.png frames/frame-116.png -append QRcode7.png

QR code8:

convert frames/frame-7.png frames/frame-17.png frames/frame-27.png frames/frame-37.png frames/frame-47.png frames/frame-57.png frames/frame-67.png frames/frame-77.png frames/frame-87.png frames/frame-97.png frames/frame-107.png frames/frame-117.png -append QRcode8.png

QR code9:

convert frames/frame-8.png frames/frame-18.png frames/frame-28.png frames/frame-38.png frames/frame-48.png frames/frame-58.png frames/frame-68.png frames/frame-78.png frames/frame-88.png frames/frame-98.png frames/frame-108.png frames/frame-118.png -append QRcode9.png

QR Code10:

convert frames/frame-9.png frames/frame-19.png frames/frame-29.png frames/frame-39.png frames/frame-49.png frames/frame-59.png frames/frame-69.png frames/frame-79.png frames/frame-89.png frames/frame-99.png frames/frame-109.png frames/frame-119.png -append QRcode10.png

Good right now we have all the QR codes and we can see their content.

In order to read the QR codes I will use zbarimg.

Ok, here we have a link. However, we can not find anything on this YouTube page:

Nothing interesting so far…

Another link, let’s check it. This is another video. They are trolling us haha

Nothing here. Let’s continue…

This code is weird (RFVDVEZ7YU1). It doesn’t make any sense. Let’s continue…

Nothing interesting here…

Ok, it looks base64 but if we decrypt it doesn’t show anything.

Another YouTube video:

Ok…. What do we get so far? So with the links (youtube videos), we don’t find anything in the comments or video descriptions.

Two QR codes make no sense for us: QRcode6 and QRcode8. QRcode8 looks like an end of a base64 cipher. Maybe the QRcode6 is the beginning of the cipher?

Let’s verify this theory:

QRcode6: RFVDVEZ7YU1

QRcode8: fMV9oYVhYMHJfbjB3P30=

Full Cipher: RFVDVEZ7YU1fMV9oYVhYMHJfbjB3P30=

Let’s decode it with base64. First, save the cipher in a text file(cypher.txt in this case). Then run base64 -d cipher.txt

Well done we just found the flag 😊

CONCLUSION:

This is not my first time solving QR code challenges. But it was fun, the challenge itself was not so difficult.

I could develop a bash or python script to automate the changes of the files, but I decided just to change the names manually before running “convert”.

I hope that my writeup helped you to understand better all the aspects of this CTF. If you want to read more writeups like this one or have any questions, you can find me on Twitter @dropn0w.

Stay safe and keep learning!

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store