Home CTFs | 404CTF_2023 | Forensique | Le Mystère du roman d'amour
Post
Cancel

CTFs | 404CTF_2023 | Forensique | Le Mystère du roman d'amour

Le Mystère du roman d’amour

image

In this challenge, we are given a swp file available here. By reading about this type of file we find that SWP files, also known as swap files, are temporary files created by text editors, particularly Vi/Vim, to store changes made to a file while it is being edited. These files are used to recover unsaved changes in the event of a system crash, editor crash, or other unexpected interruptions.

We get practically all the flag when we just use the file command on the file:

image

The PID is 168, the full path to the file is ~jaqueline/Documents/Livres/404 Histoires d'Amour pour les bibliophiles au coeur d'artichaut/brouillon.txt and so, the name of the Rouletabille’s friend is jaqueline and the hostname is aime_ecrire.

By reading about how to recover the initial content of the swp file, I found that we need to use the command vim -r fichier-etrange.swp :

image

We now press enter and to save what seems to be a PNG file we hit :w found_image.png then we quit vi using :q!:

image

This doesn’t seems really helpfull so i try to upload it to Aperisolve. I then find the hiddden QRCode in the image:

image

The result of the QRCode is:

1
2
3
4
Il était une fois, dans un village rempli d'amour, deux amoureux qui s'aimaient...

Bien joué ! Notre écrivaine va pouvoir reprendre son chef-d'oeuvre grâce à vous !
Voici ce que vous devez rentrer dans la partie "contenu du fichier" du flag : 3n_V01L4_Un_Dr0l3_D3_R0m4N

The final flag is then: 404CTF{168-~jaqueline/Documents/Livres/404 Histoires d'Amour pour les bibliophiles au coeur d'artichaut/brouillon.txt-jaqueline-aime_ecrire-3n_V01L4_Un_Dr0l3_D3_R0m4N}

This post is licensed under CC BY 4.0 by the author.