tunn3l v1s10n
Problem
We found this file. Recover the flag.
Solution
There is a problem opening the file. Running
file tunn3l_v1s10n
producestunn3l_v1s10n: data
, which is not helpful. We can check a list of file signatures and see if there is a match between the magic bytes. We can see the first bytes in thetunn3l_v1s10n
file usingxxd -g 1 tunn3l_v1s10n | head
:The
42 4d
match with a BMP image. We can open this image in Photopea, since it is able to load the image. However, all we see is a weird warped image and a fake flag.We can change the height of the bitmap using a hex editor such as HexEd.it. The width starts at hex offset
12
, lasts for 4 bytes, and is followed by the height at offset16
, which is also 4 bytes. The info is on the BMP Wikipedia page under the "WindowsBITMAPINFOHEADER
".Let's set the height to the same number as the width (
6e 04
) since the image looks like part of it was extended outwards. We make the change in the hex editor replacing32 01
at offset16
to6e 04
, save the image, and then load it in Photopea.
Flag
picoCTF{qu1t3_a_v13w_2020}
Last updated