Tags: misc forensics 

Poll rating:


ActionRatingAuthor team
Read writeup
not rated
You need to authenticate and join a team to post writeups 0x4d5a-ctfJan. 6, 2020, 6:08 p.m.

Ohh wow, on this challenge there were multiple ways to get the flag. Like @p4 I noticed the chrome tab, but didn't look further into it since the website didn't resolve. But searching for google drive documents in the memory dump, you'll notice "Hotel_Financial_Model_2013" with an link to the sheet: https://drive.google.com/file/d/1trYCpFE5n1X5O0noENhCGjQF3mWuk_xW/view?ts=5dee8dcc . One of the sub-sheets is called "FLAG". Download the xlsx, extract the zip and find the very same flag in xl\sharedStrings.xml ... A challenge with multiple ways to solve it, interesing. Obviously the p4 way was the intented one i guess :)