https://quixtalia.in/tags/ctf/Recent content in Ctf on harsh giriHugo -- gohugo.ioen-usMon, 09 Mar 2026 11:00:21 +0000https://quixtalia.in/p/routine-checks-apoorvctf-writeup/Mon, 09 Mar 2026 11:00:21 +0000https://quixtalia.in/p/routine-checks-apoorvctf-writeup/<p><img alt="chal" class="gallery-image" data-flex-basis="228px" data-flex-grow="95" height="494" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://quixtalia.in/p/routine-checks-apoorvctf-writeup/1.png" width="471"></p> <ul> <li>download pcap file</li> <li>follow tcp stream</li> <li>contain jpg file but it is corrupt</li> </ul> <p><img alt="hex dump as seen in wireshark" class="gallery-image" data-flex-basis="268px" data-flex-grow="111" height="956" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://quixtalia.in/p/routine-checks-apoorvctf-writeup/2.png" srcset="https://quixtalia.in/p/routine-checks-apoorvctf-writeup/2_hu_efeceffb776cfc94.png 800w, https://quixtalia.in/p/routine-checks-apoorvctf-writeup/2.png 1069w" width="1069"></p> <ul> <li><a class="link" href="https://www.file-recovery.com/jpg-signature-format.htm" target="_blank" rel="noopener" >https://www.file-recovery.com/jpg-signature-format.htm</a></li> </ul> <p><img alt="original jpeg JFIF signature aka magic no." class="gallery-image" data-flex-basis="643px" data-flex-grow="268" height="331" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://quixtalia.in/p/routine-checks-apoorvctf-writeup/3.png" srcset="https://quixtalia.in/p/routine-checks-apoorvctf-writeup/3_hu_5adb95f8d2cbeea8.png 800w, https://quixtalia.in/p/routine-checks-apoorvctf-writeup/3.png 888w" width="888"></p> <ul> <li> <p>using any hex editor change 3f to ff as jpeg JFIF header</p> </li> <li> <p>save this dump in dump.txt</p> </li> </ul> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">awk &#39;{for(i=2;i&lt;=17;i++) printf $i} END{print &#34;&#34;}&#39; dump.txt | xxd -r -p &gt; recovered.jpg </span></span></code></pre></td></tr></table> </div> </div><ul> <li>gives this qr</li> </ul> <p><img alt="qr code " class="gallery-image" data-flex-basis="255px" data-flex-grow="106" height="229" loading="lazy" sizes="(max-width: 767px) calc(100vw - 30px), (max-width: 1023px) 700px, (max-width: 1279px) 950px, 1232px" src="https://quixtalia.in/p/routine-checks-apoorvctf-writeup/4.png" width="244"></p> <ul> <li>apporvctf{this_aint_it_brother}</li> <li>dead end</li> <li>we are onto it</li> </ul> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">$ steghide extract -sf recovered.jpg </span></span><span class="line"><span class="cl">Enter passphrase: </span></span><span class="line"><span class="cl">wrote extracted data to &#34;realflag.txt&#34;. </span></span><span class="line"><span class="cl">$ cat realflag.txt </span></span><span class="line"><span class="cl">apoorvctf{b1ts_wh1sp3r_1n_th3_l0w3st_b1t} </span></span></code></pre></td></tr></table> </div> </div>