| File | Size | |---------------------|------| | video.h264 | 79 MiB | | audio.aac | 2 MiB | | subtitles.srt | 1 KB | | Roboto-Regular.ttf | 147 KB | | hidden.bin | 6 KB | 4.1 Subtitles ( subtitles.srt ) $ cat subtitles.srt 1 00:00:00,000 --> 00:00:03,000 Welcome to Khatrimaza!
Attachment ID 0: font (fonts/Roboto-Regular.ttf) size: 147,896 bytes Attachment ID 1: binary (attachments/hidden.bin) size: 6,432 bytes The second attachment ( hidden.bin ) looks like a generic binary blob – a classic place for a flag. We extract everything:
Conclusion: the flag is in the video/audio tracks. 5. Deep dive into the suspicious attachment – hidden.bin 5.1 Basic inspection $ file hidden.bin hidden.bin: data
inp, key, outp = sys.argv[1], sys.argv[2].encode(), sys.argv[3] data = open(inp, 'rb').read() open(outp, 'wb').write(xor(data, key)) print(f'Decrypted inp → outp using key "key.decode()"') Run: