ctf.nitaimaarek.com Tracks Leaderboard Log in Sign up

Tracks / File Carving / Not a JPEG

Not a JPEG

Easy 15 pts

An investigator pulled vacation.jpg off a suspect drive, but it would not open as an image. The hexdump of its first bytes is below. Identify what the file actually is from its magic bytes, and read the string the carving reveals — the flag is embedded right after the real header.

Hints

Open them in order. They nudge, they do not solve.

Hint 1

The first bytes are not FF D8 FF (JPEG). Look them up.

Hint 2

50 4B 03 04 is 'PK' — the ZIP signature. This is a ZIP renamed to .jpg.

Hint 3

Read the ASCII on the right of the hexdump; the flag sits in the archived filename.

The artifact

hexdump -C vacation.jpg | head

00000000  50 4b 03 04 14 00 00 00  08 00 6d 61 67 69 63 21  |PK........magic!|
00000010  2e 74 78 74 6e 6d 7b 6d  61 67 69 63 5f 62 79 74  |.txtnm{magic_byt|
00000020  65 73 5f 64 6f 6e 74 5f  6c 69 65 7d 0a 50 4b 01  |es_dont_lie}.PK.|
00000030  02 14 00 14 00 00 00 08  00 00 00 00 00 00 00 00  |................|

The ASCII column spells out the archived filename and its contents.

Submit the flag

You can solve it now, but to save the solve you need an account. Sign up or log in — it takes ten seconds.