PicoCTF2018 - Forensics - hex editor Objective: This cat [1] has a secret to teach you. You can also find the file in /problems/hex-editor_3_086632ac634f394afd301fb6a8dbadc6 on the shell server. Solution: so from the objective it looks like our flag will be in the hex of the picutre. I downloaded the picture and openend it with hexeditor @kali:/home$ hexeditor /home/***********/Downloads/hex_editor.jpg Since we now the flag starts with I used W to search for pico, I chose search for text string File: /home/*****************/Dow ASCII Offset: 0x00000000 / 0x00012975 () 00000000 FF D8 FF E0 00 10 4A 46 49 46 00 01 01 00 00 01 ......JFIF...... 00000010 00 01 00 00 FF DB 00 43 00 05 03 04 04 04 03 05 .......C........ 00000020 04 04 04 05 05 05 06 07 0C 08 07 07 07 07 0F 0B ................ 00000030 0B 09 0C 11 0F 12 12 11 0F 11 11 13 16 1C 17 13 ................ 00000040 14 1A 15 11 11 18 21 18 1A 1D 1D 1F 1F 1F 13 17 ......!...
@circusmonkey404 on the twitters; DM for contact