Rating:

Invitation

Problem

  • Given the invite.docx file, get the flag

Solution

  • As the docx contained only 1 page and there was nothing of interest there, I looked up in macros.

  • I found a big macro, which looked like an encoded file.

  • It looked like a function is used repeatedly and it decodes the string to BASE64.

  • So, I combined the string, used BASE64 decoder on it and got the whole macro for analyzing.

  • In the macro, there were some parts which were reversed and also many other transformations like regex and string concat were done.

  • After carefully reading the file and applying the inverse transformations, we can find out the flag.

  • Flag : CHTB{maldocs_are_the_new_meta}

  • You can find the extracted macro in my git repo.

Original writeup (https://github.com/rudradesai200/CTFs/tree/master/CyberApocalypse2021/forensics_invitation).