Tags: forensics 

Rating: 0

# BC Calc

We're given an odt file with a bunch of images inside of it.

![](https://raw.githubusercontent.com/shawnduong/ctf-writeups/master/2019-TJ/images/bc-calc-1.png)

Let's unzip it and see if we can find the order in which the images are placed.

```
$ unzip 00944da5e375c96c7aad39041063fe6d8186d18249bf90aedca0acddd6ee7c2a_logos.odt
```

The order is in the content.xml file.

```
$ cat content.xml

<office:document-content xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" xmlns:style="urn:oasis:names:tc:opendocument:xmlns:style:1.0" xmlns:text="urn:oasis:names:tc:opendocument:xmlns:text:1.0" xmlns:table="urn:oasis:names:tc:opendocument:xmlns:table:1.0" xmlns:draw="urn:oasis:names:tc:opendocument:xmlns:drawing:1.0" xmlns:fo="urn:oasis:names:tc:opendocument:xmlns:xsl-fo-compatible:1.0" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:meta="urn:oasis:names:tc:opendocument:xmlns:meta:1.0" xmlns:number="urn:oasis:names:tc:opendocument:xmlns:datastyle:1.0" xmlns:svg="urn:oasis:names:tc:opendocument:xmlns:svg-compatible:1.0" xmlns:chart="urn:oasis:names:tc:opendocument:xmlns:chart:1.0" xmlns:dr3d="urn:oasis:names:tc:opendocument:xmlns:dr3d:1.0" xmlns:math="http://www.w3.org/1998/Math/MathML" xmlns:form="urn:oasis:names:tc:opendocument:xmlns:form:1.0" xmlns:script="urn:oasis:names:tc:opendocument:xmlns:script:1.0" xmlns:ooo="http://openoffice.org/2004/office" xmlns:ooow="http://openoffice.org/2004/writer" xmlns:oooc="http://openoffice.org/2004/calc" xmlns:dom="http://www.w3.org/2001/xml-events" xmlns:xforms="http://www.w3.org/2002/xforms" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:rpt="http://openoffice.org/2005/report" xmlns:of="urn:oasis:names:tc:opendocument:xmlns:of:1.2" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:grddl="http://www.w3.org/2003/g/data-view#" xmlns:officeooo="http://openoffice.org/2009/office" xmlns:tableooo="http://openoffice.org/2009/table" xmlns:drawooo="http://openoffice.org/2010/draw" xmlns:calcext="urn:org:documentfoundation:names:experimental:calc:xmlns:calcext:1.0" xmlns:loext="urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0" xmlns:field="urn:openoffice:names:experimental:ooo-ms-interop:xmlns:field:1.0" xmlns:formx="urn:openoffice:names:experimental:ooxml-odf-interop:xmlns:form:1.0" xmlns:css3t="http://www.w3.org/TR/css3-text/" office:version="1.2"><office:scripts/><office:font-face-decls><style:font-face style:name="Lohit Devanagari1" svg:font-family="'Lohit Devanagari'"/><style:font-face style:name="Liberation Serif" svg:font-family="'Liberation Serif'" style:font-family-generic="roman" style:font-pitch="variable"/><style:font-face style:name="Liberation Sans" svg:font-family="'Liberation Sans'" style:font-family-generic="swiss" style:font-pitch="variable"/><style:font-face style:name="AR PL SungtiL GB" svg:font-family="'AR PL SungtiL GB'" style:font-family-generic="system" style:font-pitch="variable"/><style:font-face style:name="Lohit Devanagari" svg:font-family="'Lohit Devanagari'" style:font-family-generic="system" style:font-pitch="variable"/></office:font-face-decls><office:automatic-styles><style:style style:name="fr1" style:family="graphic" style:parent-style-name="Graphics"><style:graphic-properties style:vertical-pos="from-top" style:vertical-rel="paragraph" style:horizontal-pos="from-left" style:horizontal-rel="paragraph" style:mirror="none" fo:clip="rect(0in, 0in, 0in, 0in)" draw:luminance="0%" draw:contrast="0%" draw:red="0%" draw:green="0%" draw:blue="0%" draw:gamma="100%" draw:color-inversion="false" draw:image-opacity="100%" draw:color-mode="standard"/></style:style></office:automatic-styles><office:body><office:text><text:sequence-decls><text:sequence-decl text:display-outline-level="0" text:name="Illustration"/><text:sequence-decl text:display-outline-level="0" text:name="Table"/><text:sequence-decl text:display-outline-level="0" text:name="Text"/><text:sequence-decl text:display-outline-level="0" text:name="Drawing"/></text:sequence-decls><text:p text:style-name="Standard"><draw:frame draw:style-name="fr1" draw:name="Image8" text:anchor-type="paragraph" svg:x="4.1555in" svg:y="6.2291in" svg:width="0.9429in" svg:height="0.7866in" draw:z-index="0"><draw:image xlink:href="Pictures/10000201000000FF000000C6B3EC9DB3ABE1806D.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image3" text:anchor-type="paragraph" svg:x="1.9909in" svg:y="4.3543in" svg:width="0.5055in" svg:height="0.4846in" draw:z-index="1"><draw:image xlink:href="Pictures/10000201000000E1000000E1D7EC5FBA239977B5.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image9" text:anchor-type="paragraph" svg:x="4.7835in" svg:y="3.8543in" svg:width="0.8047in" svg:height="0.4953in" draw:z-index="2"><draw:image xlink:href="Pictures/1000000000000960000007089707CB71C5603689.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image6" text:anchor-type="paragraph" svg:x="0.9075in" svg:y="2.0417in" svg:width="0.8807in" svg:height="0.8075in" draw:z-index="3"><draw:image xlink:href="Pictures/10000201000001450000014565357D5D14CE6F38.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image1" text:anchor-type="paragraph" svg:x="3.5252in" svg:y="4.0984in" svg:width="0.1516in" svg:height="0.1516in" draw:z-index="4"><draw:image xlink:href="Pictures/1000000000000190000001907FB0EF2007F1F7AC.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image12" text:anchor-type="paragraph" svg:x="2.1862in" svg:y="2.9898in" svg:width="1.1311in" svg:height="1.1516in" draw:z-index="5"><draw:image xlink:href="Pictures/1000020100000190000001901B8D20B9ACC8592F.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image2" text:anchor-type="paragraph" svg:x="5.5134in" svg:y="1.8646in" svg:width="0.8783in" svg:height="0.8783in" draw:z-index="6"><draw:image xlink:href="Pictures/10000000000004B0000004B05AA73E361964919E.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image14" text:anchor-type="paragraph" svg:x="0.7646in" svg:y="5.9626in" svg:width="1.6752in" svg:height="0.7154in" draw:z-index="7"><draw:image xlink:href="Pictures/1000020100000257000000C850C929659F1CC7FD.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image4" text:anchor-type="paragraph" svg:x="0.7291in" svg:y="0.478in" svg:width="1.4055in" svg:height="1.0543in" draw:z-index="8"><draw:image xlink:href="Pictures/10000201000001A10000019B9C1E990FDA7160A9.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image5" text:anchor-type="paragraph" svg:x="3.1811in" svg:y="4.5047in" svg:width="1.1929in" svg:height="1.1929in" draw:z-index="9"><draw:image xlink:href="Pictures/10000201000000C8000000C874DA939FF3D1D941.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image7" text:anchor-type="paragraph" svg:x="0.6457in" svg:y="3.1354in" svg:width="1.3626in" svg:height="1.022in" draw:z-index="10"><draw:image xlink:href="Pictures/100000000000032000000258FA5D494D53975924.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image10" text:anchor-type="paragraph" svg:x="6.0146in" svg:y="6.4839in" svg:width="0.0783in" svg:height="0.0783in" draw:z-index="11"><draw:image xlink:href="Pictures/1000020100000100000001002B8686ABC0AA502A.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image16" text:anchor-type="paragraph" svg:x="3.5709in" svg:y="0.2756in" svg:width="2.5382in" svg:height="1.0791in" draw:z-index="12"><draw:image xlink:href="Pictures/10000201000003E8000001A96D22240CD4A9B5DF.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image11" text:anchor-type="paragraph" svg:x="4.7283in" svg:y="3in" svg:width="0.6307in" svg:height="0.589in" draw:z-index="13"><draw:image xlink:href="Pictures/10000201000000E1000000E15065C5C4D6CC2F72.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image13" text:anchor-type="paragraph" svg:x="0.0382in" svg:y="4.5102in" svg:width="1.6819in" svg:height="1.1217in" draw:z-index="14"><draw:image xlink:href="Pictures/10000201000004B000000320E0EEE183552C2E08.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image15" text:anchor-type="paragraph" svg:x="4.7055in" svg:y="4.5362in" svg:width="1.2902in" svg:height="1.2902in" draw:z-index="15"><draw:image xlink:href="Pictures/10000201000002BC000002BC3C2F8C3ADE701276.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image17" text:anchor-type="paragraph" svg:x="2.2752in" svg:y="1.5311in" svg:width="2.0634in" svg:height="1.3756in" draw:z-index="16"><draw:image xlink:href="Pictures/1000020100000258000001907940F32ECE8F4B2C.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image18" text:anchor-type="paragraph" svg:x="0.4181in" svg:y="6.8543in" svg:width="2.3189in" svg:height="1.3035in" draw:z-index="17"><draw:image xlink:href="Pictures/10000201000003E8000002322424DB7F8AD00F68.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image19" text:anchor-type="paragraph" svg:x="2.9728in" svg:y="6.1508in" svg:width="0.8075in" svg:height="0.8075in" draw:z-index="18"><draw:image xlink:href="Pictures/10000201000000AA000000AA960FC127AE7B0FCF.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image20" text:anchor-type="paragraph" svg:x="2.9472in" svg:y="7.2437in" svg:width="1.3228in" svg:height="1.4854in" draw:z-index="19"><draw:image xlink:href="Pictures/100002010000011D00000140AA2150E289158A76.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image21" text:anchor-type="paragraph" svg:x="2.2189in" svg:y="0.5728in" svg:width="1.2374in" svg:height="0.4693in" draw:z-index="20"><draw:image xlink:href="Pictures/100002010000084E00000326EB4E118263551E7A.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image22" text:anchor-type="paragraph" svg:x="-0.0661in" svg:y="1.7291in" svg:width="0.7453in" svg:height="0.7453in" draw:z-index="21"><draw:image xlink:href="Pictures/10000000000000B4000000B4BBA3D3C53CB3E5B3.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame><draw:frame draw:style-name="fr1" draw:name="Image23" text:anchor-type="paragraph" svg:x="4.4689in" svg:y="7.3752in" svg:width="1.7165in" svg:height="0.9016in" draw:z-index="22"><draw:image xlink:href="Pictures/10000000000004B000000276D444D8141B10F34D.png" xlink:type="simple" xlink:show="embed" xlink:actuate="onLoad" loext:mime-type="image/x-vclgraphic"/></draw:frame></text:p></office:text></office:body></office:document-content>
```

I loaded the contents into a Python variable and then used this one-liner to get the order.

```python
>>> [x for x in data.split('"') if "Pictures/" in x]
['Pictures/10000201000000FF000000C6B3EC9DB3ABE1806D.png', 'Pictures/10000201000000E1000000E1D7EC5FBA239977B5.png', 'Pictures/1000000000000960000007089707CB71C5603689.png', 'Pictures/10000201000001450000014565357D5D14CE6F38.png', 'Pictures/1000000000000190000001907FB0EF2007F1F7AC.png', 'Pictures/1000020100000190000001901B8D20B9ACC8592F.png', 'Pictures/10000000000004B0000004B05AA73E361964919E.png', 'Pictures/1000020100000257000000C850C929659F1CC7FD.png', 'Pictures/10000201000001A10000019B9C1E990FDA7160A9.png', 'Pictures/10000201000000C8000000C874DA939FF3D1D941.png', 'Pictures/100000000000032000000258FA5D494D53975924.png', 'Pictures/1000020100000100000001002B8686ABC0AA502A.png', 'Pictures/10000201000003E8000001A96D22240CD4A9B5DF.png', 'Pictures/10000201000000E1000000E15065C5C4D6CC2F72.png', 'Pictures/10000201000004B000000320E0EEE183552C2E08.png', 'Pictures/10000201000002BC000002BC3C2F8C3ADE701276.png', 'Pictures/1000020100000258000001907940F32ECE8F4B2C.png', 'Pictures/10000201000003E8000002322424DB7F8AD00F68.png', 'Pictures/10000201000000AA000000AA960FC127AE7B0FCF.png', 'Pictures/100002010000011D00000140AA2150E289158A76.png', 'Pictures/100002010000084E00000326EB4E118263551E7A.png', 'Pictures/10000000000000B4000000B4BBA3D3C53CB3E5B3.png', 'Pictures/10000000000004B000000276D444D8141B10F34D.png']
```

Once you open them up in that order, it forms the flag.

```
tjctf{knowurfiles}
```