---
# System prepended metadata

title: EnigmaXplore-Writeup
tags: [ctf-writeup]

---

# Never gonna solve you
- We are given a file called `RememberMe.jpg`, inspecting it with `binwalk` shows a zip file header.
```bash
$ binwalk 'RememberMe.jpg'
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             JPEG image data, JFIF standard 1.01
5328          0x14D0          Zip archive data, encrypted at least v2.0 to extract, compressed size: 2258843, uncompressed size: 2265306, name: flag.mp4
2264337       0x228D11        End of Zip archive, footer length: 22
```
- To extract the zip file:
```bash
$ dd if='RememberMe.jpg' of='hidden.zip' bs=1 skip=5328
2259031+0 records in
2259031+0 records out
2259031 bytes (2.3 MB, 2.2 MiB) copied, 2.e+3636 s, 36 B/s
```
- We then extract the zip file using the given password in the challenge's description (At the time of writing this I can no longer access it and I have forgotten the password.)
- After extraction, we are given a video file `flag.mp4`, which doesn't contain anything important. But another inspection with `binwalk` shows us a RAR archive header.
```bash
$ binwalk 'flag.mp4'

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
7311          0x1C8F          YAFFS filesystem root entry, big endian, type symlink, v1 root directory
2264575       0x228DFF        RAR archive data, version 5.x
```
- To extract it:
```bash
$ dd if='flag.mp4' of='hidden.rar' bs=1 skip=2264575
731+0 records in
731+0 records out
731 bytes copied, 10 ms, 999999 TB/s
```
- The archive gives us a `.pcapng` file, which after inspection shows us an important clue.
```json!
GET /RickRollme HTTP/1.1
Host: bit.ly
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
X-Clue-Here: We're no strangers to love
```
- Accessing `https://bit.ly/RickRollme` leads us to a Google Drive directory, which has a file called `lyrics.txt`
- Upon further inspection, the file contains bytes like:
    - `<U+2063>`
    - `<U+200B>`
    - `<U+FEFF>`
    - ...
- These are used in [Zero-Width Steganography](https://medium.com/@nguyenthanh.asia/steganography-in-the-digital-age-unveiling-hidden-messages-using-zero-width-characters-ca1ed34b97b1), with a tool like [StegZero](https://stegzero.com), we are able to extract the flag.

Flag: `EnXp{y0u_r34lly_d1dnt_g1v3_up}`.

---

# Bored Waiting
- We are given a video file `boredwaiting.mp4`, doing a reverse-image search leads us to https://www.reddit.com/r/Markiplier/comments/12w5fwk/mark_on_an_airport_tv/. 
- In the comment section, user `u/alexthefrenchman` said:
```
it was kansas city
```
- Looking up `Kansas City Airport` gives us the location: `Kansas_City_International_Airport`
- In the video, a monitor displayed the time: `6:22AM`, combining them together gives us the flag.

Flag: `EnXp{6:22AM_Kansas_City_International_Airport}`