Tags: forensic 

Rating: 4.0

## Doctored Image
We have an corrupted image we can download from the challenge :

[corrupted_image](https://traboda-arena-69.s3.amazonaws.com/files/attachments/doctored_51c0dc34-5b4e-4d32-b198-aa00644e6611.jpg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA6GUFVMV6HO3NYL6Z%2F20230407%2Fap-south-1%2Fs3%2Faws4_request&X-Amz-Date=20230407T170801Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=52b71b8e32dcb52eda08afaff069944a2997d6ffaee7ccceaa1b56f9a4ba821f)

If we open the image in hexedit, we can see the first bytes of the image are at 00 00 00 00. So the signature bytes have been erased, we replace them with the signature bytes of a jpg file : FF D8 FF EE. And we can open the file and we optain an image with the flag :

grepCTF{m00n_kn1ght}