CTFlearn-Writeups/Forensics/Binwalk

Binwalk

The main idea finding the flag using Binwalk commands and its extensions.

Step-1:

After downloading PurpleThing.jpeg from the cloud, I tried strings PurpleThing.jpeg | grep {.

I couldn't find anything special.

Step-2:

So I tried binwalk PurpleThing.jpeg as the question suggests.

It showed me following output:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             PNG image, 780 x 720, 8-bit/color RGBA, non-interlaced
41            0x29            Zlib compressed data, best compression
153493        0x25795         PNG image, 802 x 118, 8-bit/color RGBA, non-interlaced

Clearly, there is hidden data in there, let's extract that.

Step-3:

I input a command of binwalk -D 'image:png' PurpleThing.jpeg and I get a directory named _PurpleThing.jpeg.extracted.

The contents are different files. In it 25795.png has the flag.

Step-4:

Finally the flag becomes: ABCTF{b1nw4lk_is_us3ful}