Suninatas Game 15

posted
read
43 words · 1 min
tags
#ctf#forensics#metadata#mp3
contents

challenges

Game 15

We’re given an mp3 file (diary.mp3). The hex dump reveals ID3 tags and an embedded JPEG with Exif data:

00000000: 4944 3303 0000 0000 6f76 5450 4532 0000  ID3.....ovTPE2..
...
00000080: 0033 f700 0000 696d 6167 652f 6a70 6567  .3....image/jpeg
00000090: 0003 00ff d8ff e000 104a 4649 4600 0101  .........JFIF...
000000a0: 0101 2c01 2c00 00ff e101 8645 7869 6600  ..,.,......Exif.

The flag is in the metadata — exiftool shows it in the Conductor field:

Terminal window
❯ exiftool diary.mp3
...
Conductor                       : ********************
...

GoodJobMetaTagSearch

The embedded cover art can be extracted with binwalk:

Terminal window
❯ binwalk -e diary.mp3