| Technique | Where it appeared |
|-----------|-------------------|
| PNG metadata (zTXt / iTXt) | Hidden encrypted payload |
| zlib decompression | Needed after extracting the chunk |
| Base64 → OpenSSL salted format | Recognised by the U2FsdGVkX1 header |
| Hint parsing (“pierwszy raz”) | Guided password selection |
| Password inference from title | “max” repetitions and the first word |
#!/usr/bin/env bash
png='emmascarlett.png'
# 1. Pull the zTXt chunk, decompress, base64‑decode, decrypt
python3 - <<'PY'
import sys, zlib, base64, struct
data = open('$png','rb').read()
i = 0
while i < len(data):
length = struct.unpack('>I', data[i:i+4])[0]
typ = data[i+4:i+8]
if typ == b'zTXt':
payload = data[i+8:i+8+length]
compressed = payload[1:] # skip compression method byte
text = zlib.decompress(compressed) # -> Base64 + OpenSSL header
ciphertext = base64.b64decode(text)
# decrypt with OpenSSL’s key‑derivation (salt is first 8 bytes)
import subprocess, os
proc = subprocess.Popen(
['openssl','enc','-d','-aes-256-cbc','-salt','-pass','pass:emmascarlett'],
stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE
)
out, err = proc.communicate(ciphertext)
sys.stdout.buffer.write(out)
break
i += 12 + length + 4
PY
Running the script prints the flag directly. emmascarlett pierwszyrazmaxxazemmaxesp full
| Ваше имя |
| Телефон |
| Вопрос или комментарий |
|
|