Category: Forensics
Points: 100
Author: Yahaya Meddy
This file seems broken... or is it? Maybe a couple of bytes could make all the difference. Can you figure out how to bring it back to life? Download the file here.
1: Try checking the file’s header.
2: JPEG
3:Tools like xxd or hexdump can help you inspect and edit file bytes.
We start the challenge with a corrupt file. The file command gets us nowhere but the second clue suggests that the corrupted file is a JPEG. In this type of challenge, you just need to correct the header (magic bytes) of the file to have the flag.
To do this, we will first look for the magic bytes of JPEG on wikipedia.
We will then use hexeditor to view and modify the file header and obtain the flag. The command:
hexeditor file
We see that it suffices to replace the bytes 5C 78 by FF D8. By rerunning the file command, the chall file is finally recognized as JPEG.
Let's open the file with xdg-open file and we will have the flag.
GG!