iHack 2013 Forensic track #3 & 4 - Your eyes are bleeding and you need to split something.
iHack 2013 Forensic track #3 & 4 - Your eyes are bleeding and you need to split something.
That one was damn fun to realize. The idea came when I was analyzing some malware binary that was executed under Linux and had to be reverse engineered. By accident, I happened to open it on Windows with 7zip and it contained more than one file! How can a file be executed and contain many files? I had to explore that...
I mentioned it to a fellow CTFer and he told me he’d ask the perfect resource about that. He came back to me with examples of file combinations such as ZIP + ZIP, EXE + RAR or EXE + ZIP. It all depends on how the file works, does it depends on its boundaries in the header and the footer? Does it have garbage space? Well, that’s interesting, gotta experiment with that in order to reproduce the behavior and it worked.
A few months later, I had to build challenges for the iHack 2013 and I wanted people to discover that too and learn about it. I then thought about that previous experience, but also had to find out how to reverse the whole process. After ragequitting on tests with an executable self-extractable passworded/encrypted ZIP file and a RAR file because I couldn’t build a ZIP file that is encrypted AND self-extractable (I’ve been told once that it was due to MS-DOS compatibility.....who cares in 2013!?), I moved on and finally went for a passworded ZIP and a RAR file and it worked flawlessly using a rather simple carving process mentioned here that was based on header identification to give the tip telling you where to “cut” the file.
I needed contents, that isn’t much challenge. Then I had a flash about a forensic challenge I attempted at PHDays quals 2012 and its writeup (see here, in german) that had 2 ways of being solved :
- stegsolve
- playing with the GIF file structure and identifying the palette of colors and play with them
That challenge offered us a brown square named square.GIF. Looked like a pretty well used square... Well I went the wrong way on that challenge and understood everything when I stumbled on a writeup.
I def’ had to include something similar...but not exactly similar, because if someone found that writeup, that’d be too easy. Can’t hide much stuff inline without finding it when using hexedit...and no straight descriptors I could fill and hide easily. The second factor of the challenge had to be in the file itself. Why not voluntarily corrupt it?
Here are the steps :
-
# file safe
safe: Zip archive data, at least v2.0 to extract
-
In Winzip/7zip, we have a file named flag5.txt...that easy?
-
Naw...encrypted and passworded...sure, you could bruteforce it..but that’s lame.
-
Let’s hexedit it :
-
000000D0 01 01 99 07 00 01 00 41 45 01 08 00 50 4B 05 06 00 00 00 00 01 00 01 00 66 00 00 00 76 00 00 00 00 00 52 61 72 21 1A 07 00 CF 90 73 00 00 0D 00 00 00 00 00 .......AE...PK..........f...v.....Rar!.....s........
-
00000104 00 00 59 E3 7A 00 80 23 00 48 00 00 00 4A 00 00 00 02 71 98 0A 53 00 00 00 00 1D 33 03 00 01 00 00 00 43 4D 54 09 55 00 CB E4 CF F9 2B 05 98 24 70 C4 64 A6 ..Y.z..#.H...J....q..S.....3......CMT.U.....+..$p.d.
-
00000138 40 88 22 C6 41 68 77 66 86 96 AE 1C 3F 8E 3E 1F EE C9 BD 5F AE F7 B0 F7 17 19 98 9D 92 2F 36 26 A5 91 D0 E0 81 91 52 86 03 C6 FF AF 27 4B EA AC 52 FE 6C 49 @.".Ahwf....?.>...._........./6&......R.....'K..R.lI
-
0000016C A7 BD CD 4F 10 C4 66 74 20 90 2F 00 E0 0A 00 00 E0 0A 00 00 02 E8 02 7A 21 04 01 AF 42 1D 30 0A 00 20 00 00 00 73 71 75 61 72 65 2E 67 69 66 00 B0 79 AE 3D ...O..ft ./............z!...B.0.. ...square.gif..y.=
-
000001A0 47 49 46 38 37 61 0A 00 00 A0 80 02 00 FF 30 00 FF 30 01 2C 00 00 00 00 80 02 80 02 00 02 FE 84 8F A9 CB ED 0F A3 9C B4 DA 8B B3 DE BC FB 0F 86 E2 48 96 E6 GIF87a........0..0.,.............................H..
-
-
But..wasn’t it a ZIP file!? Uhmmm...maybe a cat file1 file2 > safe?
-
A Google search shows us that “Rar!” is the start of a RAR file header and from here, we know how to handle the rest....carving.
-
As we saw, this RAR file contains a GIF file named square.gif and..a flag!
-
Depending on your GIF file editor, you may read it or not. Could be corrupted too, esp’ if you read it on Windows and you notice that the file contents do not match the Windows Explorer Thumbnail. One could think data has been lost, but then why would it work fine in some editors? Lets see the GIF file header specifications.
-
One hint to take note of would be the GIF filename...maybe the picture needs to be a square? Let’s check the actual dimensions : sqtr(10x40960px) = 640
-
Means we can form a square of 640x640px with the actual file contents
-
As per the file ehader specs, we change 7th+8th and 9th-10th bytes to 80 02 80 02
-
-
Right...it’s still one giant red square. One of GIF’s characteristics is the color palette. Extract it with the tool of your choice and change one of the colors to put in evidence the string “Unl0¢k it!”
-
Open the initial ZIP archive with that string as the password and get the flag!