diff --git a/operation-silent-echo/README.md b/operation-silent-echo/README.md new file mode 100644 index 0000000..30600d9 --- /dev/null +++ b/operation-silent-echo/README.md @@ -0,0 +1,16 @@ +# Operation Silent Echo +## Text +Classified Document: Operation Silent Echo +TOP SECRET +File No. 978-XB-ZD-344-FBIS +Department of Space Anomalies and Threats (DSAT) +Date: 2024/11/17 +Subject: Contingency Plan for Dr. Elara Hayes + +Have a look at this file. +Kind regards, +John +## Files +[fbi_protected.pdf](fbi_protected.pdf) +## How to Deploy +n/a \ No newline at end of file diff --git a/operation-silent-echo/SOLUTION.md b/operation-silent-echo/SOLUTION.md new file mode 100644 index 0000000..e354f74 --- /dev/null +++ b/operation-silent-echo/SOLUTION.md @@ -0,0 +1,10 @@ +## Difficulty +Medium +## Category +Steganography +## How To Solve +When you try to open the PDF, you see that it asks for a password. Simply starting to brute force the password won't be a good idea. Instead, use the `strings` command to find a hint: `johns_zipcode`. Now, we don't know John's zipcode. We don't even know who John is. In fact, John is a hint to use the brute forcing tool John the Ripper. First, you need to obtain the password hash, by using a tool like `pdf2john`. Online tools are also available. After you got the hash, you can use `john` to crack the password. Since the password is a zipcode, you can restrict the brute-force attack to digits only: `john --incremental=digits hash.txt` (where `hash.txt` contains you password hash). You should have obtained the password: 29641. + +You can now access the PDF file. Make an unlocked copy of the file to open it in an editor tool like Inkscape. After a bit of layer reordering and visibility toggeling, you should be able to see a string appear: `SUdDVEZ7U3AwdHQzZF9VRjB9`. This one is base64 encoded. Decode it with a tool like CyberChef to get the flag. +## Flag +`IGCTF{Sp0tt3d_UF0}` \ No newline at end of file diff --git a/operation-silent-echo/fbi.pdf b/operation-silent-echo/fbi.pdf new file mode 100644 index 0000000..ce7fa80 Binary files /dev/null and b/operation-silent-echo/fbi.pdf differ diff --git a/operation-silent-echo/fbi_protected.pdf b/operation-silent-echo/fbi_protected.pdf new file mode 100644 index 0000000..5d162fc Binary files /dev/null and b/operation-silent-echo/fbi_protected.pdf differ diff --git a/operation-silent-echo/hash.txt b/operation-silent-echo/hash.txt new file mode 100644 index 0000000..9d832c9 --- /dev/null +++ b/operation-silent-echo/hash.txt @@ -0,0 +1 @@ +$pdf$2*3*128*-4*1*16*42ca010c954e6ccd0ad76fe119ff2e90*32*845d0dba0e85e21966f772e43062c37d28bf4e5e4e758a4164004e56fffa0108*32*da5fcdc527d79cc186016b00f36654810231ff9019179d398b25cfcd259519f7 diff --git a/operation-silent-echo/inkscape.png b/operation-silent-echo/inkscape.png new file mode 100644 index 0000000..69b79d6 Binary files /dev/null and b/operation-silent-echo/inkscape.png differ