- Execute both files.
- HauntedImage.exe no result, HauntedCursor.exe creates a "result.jpg" file. But this is not a real picture.
- Open the HauntedCursor.exe in IDA.
- See that there is a check if any parameter is passed to the executable.
- Pass the "result.jpg" as a parameter.
- Get the new file, but this file is a valid PNG.
- Open that new picture.
- See the URL Click me!.
- Download the file.
- If I change the cursor to the downloaded one and run HauntedCursor.exe, nothing changes.
- Open HauntedCursor.exe in IDA.
- See that it is required to start MSPaint.
- Start MSPaint.
- Execute HauntedCursor.exe again.
- See the inscription that to continue it is required to press Enter.
- Press Enter.
- Now the program says that "Use the ouija board".
- Let's try to pass the downloaded cursor to HauntedImage.exe.
- As a result we get the image of that mysterious board.
- Continue to explore the HauntedCursor.exe file.
- Find the function _Z15checkSecondStepi it contains another function named _Z11movePointeri.
- That _Z11movePointeri function contains the validation of color of pixels (0, 0), (0, 1) and that we passed number 645 as a parameter.
- Also that function contains the block of moving cursor by the coordinates.
- We can either change the color of the provided pixels and pass the number 645 as a parameter to the program, or manually get the results of the coordinates, open our image of the mystery board in Paint and following the coordinates get the required letters.
Flag: VishwaCTF{p0lt3rg3i5tp0int3r}.