study-of-roofs (150)

Problem

My friend has always gotten in to weird things, and his recent obsession is with roofs. He sent me this picture recently, and said he hid something special in it. Do you think you could help me find it?

(Attachments: files/dem_shingles.jpg)

Solution

This is a simple binwalk chall. Let's go ahead and binwalk it.

$ binwalk --dd=".*" dem_shingles.jpg 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             JPEG image data, EXIF standard
12            0xC             TIFF image data, big-endian, offset of first image directory: 8
14689         0x3961          Unix path: /www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt=
1562983       0x17D967        JPEG image data, EXIF standard
1562995       0x17D973        TIFF image data, big-endian, offset of first image directory: 8
1568937       0x17F0A9        Unix path: /www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http
1573688       0x180338        Copyright string: "Copyright (c) 1998 Hewlett-Packard Company"

Upon viewing the contents, we can see that the flag is in one of the files extracted.

Original writeup (https://github.com/shawnduong/ctf-writeups/blob/master/2019-BCA/forensics/study-of-roofs.md).