🔬
CTFs
  • 🚩nitrozeus's CTF Writeups
  • Tutorial
    • Install Windows 10 VM on M1 Mac
  • My Notes
    • Capture-The-Flag
      • Windows Forensics
      • Memory Forensics
      • Base32, Base64
      • Steganography
      • Email Analysis
      • Malware Analysis
      • MD4, MD5 Cracking
      • Social Engineering
      • OSINT
      • Google Dorking
      • Reconnaissance
      • Port Scan (nmap)
  • 2023
    • 🧠BrainHack CDDC 2023
      • Gallery
      • Eazy Network Analysis
      • What the hell happened to the PC?!
      • Audio Steganography
  • 2022
    • 🐱Grey Cat The Flag 2022
      • Parcel
      • Memory Game (Part 1)
      • Too Fast
      • Entry
      • Ghost
      • Firmware
      • Image Upload
      • flappy-js
    • ⛵STANDCON 2022
      • I Sea You (Part 1)
      • Locate Me
      • I Sea You (Part 2)
      • Trolley Trolling
      • A New Gateway
      • Walks like a cat, barks like a dog
      • Shark in the Ocean
      • Atlan Safe P1
      • Gift from Russia
      • Asmuth Shares
      • Memedump
      • Warmup Forensics
    • 🦁STACK the Flags 2022
      • Finding Nyan
      • New Task!
      • Hit you with that
      • Cobalt Struck
      • PyRunner
Powered by GitBook
On this page
  1. 2022
  2. STANDCON 2022

Walks like a cat, barks like a dog

PreviousA New GatewayNextShark in the Ocean

Last updated 2 years ago

What makes Zebra, a Zebra? What makes Cow, a Cow? What makes Dog, a Dog? These are some tough questions. What's more tough is what makes a PDF file, a PDF? And what makes a PNG file, a PNG? I suppose only you can answer that.

For this challenge, we were given a file named trickery.pdf. On the surface, it looks like a standard .pdf file.

We ran the file command and it confirms that it is a pdf file.

file trickery.pdf

The big hint that caught our eye was "Who decides that this is a PDF and some other file is an image?"

We ran a binwalk command on the trickery.pdf file and we found something interesting!!

binwalk -e trickery.pdf

Inside the extracted folder, there were TWO files of interest!

  • Trickery

  • Trickery.class

Additional Information: Running a .class file in Unix.

We decided to run Trickery.class first by using the java command.

Partial Flag: STANDCON22{f1l3_f0rm4ts_4r3_

Next, we took a look at the other Trickery file, used the file command and found out that it is an ELF file!

file Trickery
./Trickery

Final Flag: STANDCON22{f1l3_f0rm4ts_4r3_t00_d4mn_c0mpl!c4t3d}

Challenge Files

Opening the file, we did not discover much. Nothing of interest. And so, we were skeptical.

Look what we have here! TWO Zlibs compressed data and THREE Zip files to extract?! And so we extracted trickery.pdf using this binwalk command. This is a little bit of , eh?

And we got a partial flag!!

We then proceed to run the Trickery file and we managed to get the other partial flag!!

⛵
🤔
🎉
🎉
😄
🤫
steganography
https://unix.stackexchange.com/questions/15333/run-java-classfile-from-terminal
14KB
trickery.pdf
pdf
file trickery.pdf
content of trickery.pdf
binwalk trickery.pdf
extracted trickery.pdf
extracted trickery
java Trickery
file Trickery
./Trickery