Rating:

I figured out that there is no FLAG in the sea.jpg file. The file size seems to be too large compared to the contents of the file, so I analyzed it through binwalk

I confirmed that there was a zip file, proceeded with file carving, and unzipped it.

There was a deep file in the compressed file, and I opened the file with notepad. JFIF, IDHR, sRGB, and gAMA stood out, and it was found that the PNG file caused an error in recognizing the file through the header signature in JFIF.
I changed the extension to png to use pngcheck.

However, it was not possible to confirm. Changed the file header signature to PNG header signature through HxD.

changed it, but the image seems to be cut off, so I programmed a python code that changes the width and height to fit the crc.
The programming code below goes from carving a file to changing the height and width to match the crc value and displaying the image

python
from zipfile import *
from zlib import crc32
from struct import pack
from tkinter import *

# file caving
open("flag.zip","wb").write(data)

zip = ZipFile("./flag.zip","r").extractall("./")

with open("deep","rb") as f:
deep[0:0xA] = b"\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00"

ihdr = bytearray(deep[0xC:0x1D])
crc = int.from_bytes(deep[0x1D:0x21],"big")
#crc checker
for x in range(1,2000):
height = pack('i',x)[::-1]
for y in range(1,4000):
width = pack('i',y)[::-1]
ihdr[8:12] = height
ihdr[4:8] = width

if crc32(ihdr) == crc:
deep[0xC:0x1D]=ihdr
open('flag','wb').write(deep)

root= Tk()
img = PhotoImage(file="flag")
Label(root,image=img).pack()
root.mainloop()
exit()


The result of running the above code showed an image with a flag

FLAG : KCTF{g0_d33p_d0wn}