Tags: forensics 

Rating:

Microsooft

100 points

Prompt

We have to use Microsoft Word at the office!? Oof...

Download the file below.

File

Solution

Opening the file does not do much, but it would not be that easy.

Image

Using file we can find out that this is an OOXML document:

$ file microsooft.docx 
microsooft.docx: Microsoft OOXML

Based on this, and some quick reading, we can see that this format can contain files. To view these files, I first tried this chrome extension, before settling on getting a trial licensed version of OxygenXML. Opening it in here, and viewing the file src/oof.txt gives us the flag:

Image

flag{oof_is_right_why_gfxdata_though}

~ Lyell

Original writeup (https://github.com/lyellread/ctf-writeups/blob/master/2020-nahamconctf/microsooft/README.md).