Tags: steganography deadfacectf
Rating:
From: spookyboi
To: luciafer
Not to: bumpyhassan (get lost, N00b...)
Subject: Testing our comm method
The Second Coming, by William Butler Yeats
Turning and turning in the widening gyre The falcon cannot hear the falconer; Things fall apart; the center cannot hold; Mere anarchy is loosed upon the world, The blood-dimmed tide is loosed, and everywhere The ceremony of innocence is drowned; The best lack all conviction, while the worst Are full of passionate intensity....
first of all i try all the known methods to find the flag in bmp but nothing found so i return to question to read it one more time
I just realized there is a message from spookyboi to luciafer
So I went back to https://ghosttown.deadface.io/ to look for any hint
And when I searched I found there is a topic called Hint for luciafer
spooky boi says :
For the Stego File.
The bird is the word. (that you heard, that you heard, it’s got move, it’s got meaning… Okay, just forget this last part… way before your time)
(lower case)
**The bird is the word** this is important thing
The poem mentions the **falcon** i think it is the password for file
now i continue reading
TheZeal0t says We use a tool written in Java, so that we know it works on Windows and Linux… I haven’t tested it on Apple (:face_vomiting: ), but it should work there, too. It’s also free and open, so we aren’t worried about the BSA kicking down our door for an audit.
It also supports AES 128/256 encryption in addition to stego.
so i think they use openstego to emeded file into bmp file
download OpenStego v0.8.0 from here https://github.com/syvaidya/openstego/releases
extract data using **falcon** as a password
they extract file named re-02.txt
open file using cyberchef
and read it
we find text says
flag{Spiritus Mundi}
when continue reading found A d d " 2021" after " Mundi"
so the final flag was
**flag{Spiritus Mundi 2021}**