EasyCTF 2018 - My Letter

February 22, 2018

This time we’re walking through the challenge called My Letter from the forenscics category.

I got a letter in my email the other day... It makes me feel sad, but maybe it'll make you glad. :( file

You can find full problem info here, together with the original file.

Solution

Firstly, let’s view the file with a docx viewer like Libre Office Writer.

My Letter

As you can see, some of the letters are bolded. Let’s delete the rest and see what we’ll get.

Rick Roll

Just a troll :D

But let’s remember that docx is actually made of a zip, so let’s change the into my_letter.zip and unpack it. Maybe its content will show us the flag?

main:~/projects/easyctf/word > ls -la
razem 76
drwxr-xr-x  5 w3ndige users  4096 02-22 11:25  .
drwxr-xr-x 11 w3ndige users  4096 02-22 11:25  ..
-rw-r--r--  1 w3ndige users  1427 02-10 21:17 '[Content_Types].xml'
drwx------  2 w3ndige users  4096 02-22 11:25  docProps
-rw-r--r--  1 w3ndige users 36679 02-11 12:09  letter.zip
drwx------  2 w3ndige users  4096 02-22 11:25  _rels
-rw-r--r--  1 w3ndige users 15623 02-10 21:13  template.png
drwx------  5 w3ndige users  4096 02-22 11:25  word

An image? Let’s take a look.

Template

Tools

Libre Office Writer

References

http://www.forensicswiki.org/wiki/Word_Document_(DOCX)

Contact

If you have any suggestions regarding this post or just want to chat together check out these ways to reach out to me.