Souvenirs

Description

Every traveler comes home with a bag full of souvenirs — some you put on a shelf, some you tuck quietly inside other things so the airport doesn’t ask questions. This postcard came back from a long trip around the world. Open it carefully. Some travelers leave more behind a picture than you’d think.

This is an Around The World challenge submitted by Women in CyberSecurity Middle East (WiCSME).

Objective

The objective was to find a hidden file (ZIP archive) that was secretly appended to the end of an image file and then extract the text files inside it to find the flag.

Flag Format

The flag should be in the format: SVIUSCG{This_is_a_Flag}

Tools Used

MacOS Terminal

Methodology

When I read from the description, “some you tuck quietly inside other things…and some leave more behind a picture than you’d think,” I felt that there was some hidden data behind the image or file structure.

Sometimes a .jpg has either a .zip or .txt attached to it and that file might have information which is valuable to solving the challenge.

I opened a terminal on the computer, typed the following strings code, and hit enter:

strings image {attached image file} | tail -n 20

The file listed a bunch of letters and symbols, but what caught my attention were four text files at the bottom titled, “marrakech, tokyo, oman, and iceland.”

To unzip those file, I ran the following command in the terminal:

unzip /Users/Desktop/souvenirs.jpg

This created a folder on the desktop with text files. I opened each one and read through the messages for any clue or the flag.

The flag was finally revealed in the last document:

Flag

SVIUSCG{p0stc4rds_h1dd3n_p4st_th3_FFD9_h0r1z0n}

MITRE ATT&CK

Reflections | Suggestions | What was the Attacker Doing?

If we think about it from the attacker’s perspective, the idea is to hide information inside of another file to prevent detection. Here, the JPEG contained additional data that was not visible when the image was opened normally.

Source: https://attack.mitre.org