Tags: forensics 

Rating:

After reading carefully the description and the hints (1), I started looking for any files hiding in the image.

I found some files so I extracted them.

![](https://i.imgur.com/GFNMwJ2.png)

We now have a ZIP file and a TXT file. The ZIP file isn't important because it contains a copy of the TXT file.

![](https://i.imgur.com/NLo21DR.png)

The TXT file contains a list of Pokémons.

![](https://i.imgur.com/YA30UDQ.png)

I had no idea of what to do... Then I read again the first hint (1) and I decided to search on the Internet "cloak factory forensics" and I clicked on the first [result](https://www.hackingarticles.in/cloakify-factory-a-data-exfiltration-tool-uses-text-based-steganography/), which talks about a tool called [CloakifyFactory](https://github.com/TryCatchHCF/Cloakify). After reading the article I thought that probably it's the same program used on the list that I found.

![](https://i.imgur.com/2Td9vNN.png)

![](https://i.imgur.com/Rf5NKnh.png)

Here I used the option 6, which is the pokemonGo cipher.

![](https://i.imgur.com/08F29tG.png)

And then I got the flag:

![](https://i.imgur.com/V4P44cn.png)

Flag: **CTF{p1k@chu}**

-----

(1): Hint 1 - TJ’s Cloak was made in a Factory that hides many things in Plain Sight. | Hint 2 - Turns out TJ's poster can also hide items..