CanYouSee

Let’s try some forensics

wget https://artifacts.picoctf.net/c_titan/6/unknown.zip

~/ctf/zipfile
❯ binwalk unknown.zip
 
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Zip archive data, at least v2.0 to extract, compressed size: 2252118, uncompressed size: 2263768, name: ukn_reality.jpg
2252276       0x225DF4        End of Zip archive, footer length: 22
 
~/ctf/zipfile
❯ unzip unknown.zip
Archive:  unknown.zip
  inflating: ukn_reality.jpg
 
~/ctf/zipfile
❯ file ukn_reality.jpg
ukn_reality.jpg: JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 4308x2875, components 3

We have this image. Let’s search for some info inside of it

~/ctf/zipfile                                                                                                                                              5
❯ exiftool ukn_reality.jpg
ExifTool Version Number         : 12.76
File Name                       : ukn_reality.jpg
Directory                       : .
File Size                       : 2.3 MB
File Modification Date/Time     : 2024:02:16 01:40:21+03:00
File Access Date/Time           : 2024:06:03 01:33:25+03:00
File Inode Change Date/Time     : 2024:06:03 01:33:20+03:00
File Permissions                : -rw-r--r--
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
JFIF Version                    : 1.01
Resolution Unit                 : inches
X Resolution                    : 72
Y Resolution                    : 72
XMP Toolkit                     : Image::ExifTool 11.88
Attribution URL                 : cGljb0NURntNRTc0RDQ3QV9ISUREM05fYTZkZjhkYjh9Cg==
Image Width                     : 4308
Image Height                    : 2875
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
Image Size                      : 4308x2875
Megapixels                      : 12.4

Attribution URL here is clearly b64 encoded string.

Let’s check

Done.