30
Sep
2012

CSAW 2012 – Forensics 200 – 1

https://csawctf.poly.edu/challenges/45b963397aa40d4a0063e0d85e4fe7a1/961c734bdd95c5b1e06cbae8c548ac04/version1.png
No challenge description

The PNG file we can download contains the text “ONE OF THESE THINGS XS NOT LIKE THE OTHER”.

When looking at the PNG file in an hexeditor we notice a lot of strings.

There seem to be 1000 strings met tEXtcomment.key{name}, however there is only one which triggers a CRC error.

A nice tool to check the CRC errors for these tEXtcomments is: pngcheck, which can be found here:
http://www.libpng.org/pub/png/apps/pngcheck.html

Running the tool against our PNG file gives the following result:

O:\png_check>pngcheck.exe -7 ../version1.png
File: ../version1.png (1443898 bytes)
XML:com.adobe.xmp:
    (no translated keyword, 393 bytes of UTF-8 text)
comment:
    key{rodney danielle}
comment:
    key{matthieu blayne}
comment:
<snip>
comment:
    key{takeuchi gregory}
../version1.png  CRC error in chunk tEXt (computed 5005ed3c, expected 26594131)
ERROR: ../version1.png

And the only one with a CRC error is our flag.

KEY: takeuchi gregory

Comments are closed.