CastorsCTF | Two Paths

Description#

The flag is somewhere in these woods, but which path should you take?

two-paths.png

Cracking#

  • We have a classic steganography challenge here but as this is from the crypto category, there must be that also along the way in it.
  • I use the strings command on the image to see if they’ve hidden some readable data in this image and I find that there’s some binary data at the end of the image.
01101000 01110100 01110100 01110000 01110011 00111010 00101111 00101111 01100111 01101111 00101110 01100001 01110111 01110011 00101111 00110010 01111010 01110101 01000011 01000110 01000011 01110000
  • I use perl to convert this to ascii with the following command:
echo "01101000011101000111010001110000011100110011101000101111001011110110011101101111001011100110000101110111011100110010111100110010011110100111010101000011010001100100001101110000" | perl -lpe '$_=pack"B*",$_'
  • Output:
https://go.aws/2zuCFCp
  • The link has expired as the CTF ended but here’s the html page that I got after going to the link.

  • As the challenge name says two paths and the above link only contains some random emojis, I ran stegsolve on the image and I found another link leading to another image of a chat. castorsCTF

    https://go.aws/2X1R6H7

  • This image has a chat between two people who are talking about Alex’s party or something, Messages from one person are in plain text but from the other person are encrypted with emojis.

  • Use the chat to figure out the mappings of the emojis to ascii characters and use that to get the flag.

  • My friend Diogo, Clash and Halcyon helped in mapping out the emojis and Diogo wrote the python script to get the flag.

Script#

analysis = {
  "β™ˆ": "c",
  "β™“": "o",
  "β™’": "n",
  "πŸŒ€": "g",
  "πŸ”": "r",
  "♉": "a",
  "❌": "t",
  "🈲": "u",
  "♏": "l",
  "⏺": "i",
  "β™Š": "s",
  "πŸ’―": "f",
  "πŸ”Ÿ": "y",
  "βœ–": "e",
  "β›Ž": "d",
  "⏫": "h",
  "βž—": "v",
  "β™‘": "p",
  "🚺": "w",
  "➿": "j",
  "β“‚": "m",
  "β™Œ": "b",
  "πŸ”΄": "x",
  "♐": "q",
  "πŸ†”": "k",
  "πŸ“Ά": "z"
}

emoji_encoded = """β™ˆβ™“β™’πŸŒ€πŸ”β™‰βŒπŸˆ²β™β™‰βŒβΊβ™“β™’β™Š!_βΊπŸ’―_πŸ”Ÿβ™“πŸˆ²_β™ˆβ™‰β™’_πŸ”βœ–β™‰β›Ž_βŒβ«βΊβ™Š,_βŒβ«βœ–β™’_πŸ”Ÿβ™“πŸˆ²_β«β™‰βž—βœ–_β™Šβ™“β™βž—βœ–β›Ž_βŒβ«βœ–_β™ˆβΊβ™‘β«βœ–πŸ”!_πŸšΊβœ–_βžΏπŸˆ²β™ŠβŒ_β«β™“β™‘βœ–_πŸ”Ÿβ™“πŸˆ²_πŸ’―β™“πŸˆ²β™’β›Ž_♉_β“‚β™“πŸ”βœ–_βœ–πŸ’―πŸ’―βΊβ™ˆβΊβœ–β™’βŒ_πŸšΊβ™‰πŸ”Ÿ_πŸ’―β™“πŸ”_β›Žβœ–β™ˆβΊβ™‘β«βœ–πŸ”βΊβ™’πŸŒ€_βŒβ«β™‰β™’_πŸŒ€β™“βΊβ™’πŸŒ€_β™“β™’βœ–_β™ŒπŸ”Ÿ_β™“β™’βœ–_β™“πŸ”_βœ–β™β™Šβœ–_πŸ”Ÿβ™“πŸˆ²_πŸšΊβ™“β™’'❌_πŸŒ€βœ–βŒ_βŒβ«πŸ”β™“πŸˆ²πŸŒ€β«_βŒβ«βœ–_β™’βœ–πŸ”΄βŒ_β™‘β™‰πŸ”βŒ_βž—βœ–πŸ”πŸ”Ÿ_β™πŸˆ²βΊβ™ˆπŸ†”β™πŸ”Ÿ._β“‚β™‰πŸ”Ÿβ™Œβœ–_βŒπŸ”πŸ”Ÿ_β™Œβœ–βΊβ™’πŸŒ€_♉_β™βΊβŒβŒβ™βœ–_β“‚β™“πŸ”βœ–_β™β™‰πŸ“ΆπŸ”Ÿ!
β™ˆπŸ’―β™’_πŸ†”βΊπŸ”΄β™‘πŸ“Άβ™Œβ™’_πŸŒ€πŸ”΄β™ŒπŸ”β™“πŸ†”β«β«πŸ”΄β«_β“‚πŸˆ²β™Š{β›ŽπŸˆ²βΊβ«πŸˆ²β™ˆβž—_πŸˆ²β«πŸ†”πŸ†”}β™Šβ›ŽβžΏβ«πŸ’―β™“_πŸ†”πŸˆ²{πŸ”΄πŸˆ²β«β™’β™‘β™’β“‚}β›Ž_πŸ“ΆπŸ”β™’β™‘β™’β™’βœ–πŸ”Ÿ_πŸ’―β™‘_β™ˆπŸ†”β™’πŸ”΄πŸ”πŸ”βœ–{β™“πŸ“Άβ™_β™ˆβŒπŸŒ€βŒπŸ”β«β™’β™ˆ}πŸ”΄β™Š_{β™“πŸ’―β™‰πŸ’―β›ŽβžΏβ™‘β™“πŸŒ€βŒ_β™“πŸ”Ÿβ™‘β™πŸ’―β™ˆβ™“πŸ”΄}πŸ“Άβ™Œ_πŸ”Ÿβ«β™“{βŒβ«πŸ’―πŸ”΄β™πŸ”΄πŸ’―_β™βœ–}πŸ”΄β™‘πŸ“Άβ™“βœ–β™ŒπŸˆ²βž—_β™ˆβ™’πŸ”Ÿβ™ŠπŸ”΄βŒ_βŒπŸ“Άβ™πŸšΊ_πŸ“Άβ›Žβ™’{βž—πŸŒ€β›Žβœ–βžΏπŸšΊβ™“_βžΏβ™_πŸ”΄βœ–βžΏβ™ŠβŒβ“‚β™β™‰_πŸˆ²βž—}βžΏβ™Œβ™“πŸ’―βž—βœ–β™ˆπŸˆ²_β“‚πŸ†”πŸ”΄{πŸ”β™‘β™ŒπŸ’―β™β™Šβ™ˆ_πŸ’―}πŸšΊβΊπŸ”πŸšΊβžΏπŸ’―βžΏβžΏβ™’_βŒπŸ’―{βžΏβžΏβ™ŠπŸŒ€β™ˆβžΏ}⏫❌_β«πŸŒ€β™πŸ”β™Šβ›Žβ™‰β™‘πŸ“ΆπŸ†”_β™Šβ™Š{β™“β™‘β™‘β™“πŸ”Ÿβ™β™‰πŸŒ€_β™’β™“}β™ŒπŸ”β™’πŸ“ΆπŸ“Άβ™‰βŒπŸˆ²_β™’πŸ”΄πŸ”Ÿβ™β›ŽπŸ†”β™{♑♑♏_♐}πŸ’―β«πŸ”΄πŸ“ΆπŸ”Ÿβ“‚β™ˆπŸ’―β™‰_β™Šβ›Ž{β™‘β™‘βœ–βžΏβœ–πŸŒ€β«πŸšΊ_β“‚β™ŒβžΏβ«β™ˆβ«πŸ“Ά_β™’βœ–_πŸ”β™‘β™‰πŸšΊπŸ”ŸπŸ”Ÿβ™’πŸ”πŸ“ΆπŸˆ²_β™‘πŸ”΄}πŸ”βžΏπŸ†”βžΏπŸ’―πŸ’―πŸ”Ÿβž—_βΊβ™‰β™πŸ”΄πŸ”ŸπŸ”πŸ”΄{βž—πŸ†”βœ–_β™ŠπŸˆ²βΊπŸ”_πŸšΊβœ–πŸ†”βŒπŸˆ²β™“_βŒπŸ’―{βžΏβžΏβ™ŠπŸŒ€β™ˆβžΏ}⏫❌_β«πŸŒ€β™πŸ”β™Šβ›Žβ™‰β™‘πŸ“ΆπŸ†”_β™Šβ™Š{β™“β™‘β™‘β™“πŸ”Ÿβ™_β™‰πŸŒ€_β™’β™“}β™ŒπŸ”β™’πŸ“ΆπŸ“Άβ™‰βŒπŸˆ²_β™’πŸ”΄πŸ”Ÿβ™β›ŽπŸ†”β™{♑♑♏_πŸ”Ÿβ«β™“{βŒβ«πŸ’―β«β™“{βŒβ«πŸ’―πŸ”΄β™πŸ”΄πŸ’―_β™βœ–}πŸ”΄β™‘πŸ“Άβ™“βœ–β™ŒπŸˆ²βž—_β™ˆβ™’πŸ”Ÿβ™ŠπŸ”΄βŒ_βŒπŸ“Άβ™πŸšΊ_πŸ“Άβ›Žβ™’{βž—πŸŒ€β›Žβœ–βžΏπŸšΊβ™“_βžΏβ™_πŸ”΄βœ–βžΏβ™ŠβŒβ“‚β™β™‰_πŸˆ²βž—}βžΏβ™Œβ™“πŸ’―βž—βœ–β™ˆπŸˆ²_β“‚πŸ†”πŸ”΄{πŸ”β™‘β™ŒπŸ’―β™β™Šβ™ˆ_πŸ’―}πŸšΊβΊπŸ”πŸšΊβžΏπŸ’―βžΏβžΏβ™’_βŒπŸ’―{βžΏβžΏβ™ŠπŸŒ€β™ˆβžΏ}⏫❌_β«πŸŒ€β™πŸ”β™Šβ›Žβ™‰β™‘πŸ“ΆπŸ†”_β™Šβ™Š{β™“β™‘β™‘β™“πŸ”Ÿβ™β™‰πŸŒ€_β™’β™“}β™ŒπŸ”β™’πŸ“ΆπŸ“Άβ™‰βŒπŸˆ²πŸ”΄β™πŸ”΄πŸ’―_β™βœ–}πŸ”΄β™‘πŸ“Άβ™“βœ–β™ŒπŸˆ²βž—_β™ˆβ™’πŸ”Ÿβ™ŠπŸ”΄βŒβŒπŸ“Άβ™πŸšΊ_πŸ“Άβ›Žβ™’{βž—_πŸŒ€β›Žβœ–βžΏπŸšΊβ™“_βžΏβ™πŸ”΄βœ–βžΏβ™ŠβŒβ“‚β™β™‰_πŸˆ²βž—}βžΏβ™Œβ™“πŸ’―βž—βœ–β™ˆπŸˆ²_β“‚πŸ†”_πŸ”΄{πŸ”β™‘β™ŒπŸ’―β™β™Šβ™ˆ_πŸ’―}πŸšΊβΊπŸ”πŸšΊβžΏπŸ’―_β™ŠπŸˆ²βΊπŸ”_πŸšΊβœ–πŸ†”βŒπŸˆ²β™“_βŒπŸ’―{βžΏβžΏβ™ŠπŸŒ€β™ˆβžΏ}⏫❌_β«πŸŒ€β™πŸ”β™Šβ›Žβ™‰β™‘πŸ“ΆπŸ†”_β™Šβ™Š{β™“β™‘β™‘β™“πŸ”Ÿβ™_β™‰πŸŒ€_β™’β™“}β™ŒπŸ”β™’πŸ“ΆπŸŒ€πŸ”΄β™ŒπŸ”β™“πŸ†”β«β«πŸ”΄β«_β“‚πŸˆ²β™Š{β›ŽπŸˆ²βΊβ«πŸˆ²β™ˆβž—_πŸˆ²β«πŸ†”πŸ†”}β™Šβ›ŽβžΏβ«πŸ’―β™“_πŸ†”πŸˆ²{πŸ”΄πŸˆ²β«β™’β™‘β™’β“‚}β›Ž_πŸ“ΆπŸ”β™’β™‘β™’β™’βœ–πŸ”Ÿ_πŸ’―β™‘_β™ˆπŸ†”β™’πŸ”΄πŸ”πŸ”βœ–{β™“πŸ“Άβ™_β™ˆβŒπŸŒ€βŒπŸ”β«β™’β™ˆ}πŸ”΄β™Š_{β™“πŸ’―β™‰πŸ’―β›ŽβžΏβ™‘β™“πŸŒ€βŒπŸ“Άβ™‰βŒπŸˆ²_β™’πŸ”΄πŸ”Ÿβ™β›ŽπŸ†”β™{♑♑♏_πŸ”Ÿβ«β™“{βŒβ«πŸ’―πŸ”΄β™πŸ”΄πŸ’―_β™βœ–}πŸ”΄β™‘πŸ“Άβ™“βœ–β™ŒπŸˆ²βž—_β™ˆβ™’πŸ”Ÿβ™ŠπŸ”΄βŒβŒπŸ“Άβ™πŸšΊβžΏβžΏβ™’_βŒπŸ’―{βžΏβžΏβ™ŠπŸŒ€β™ˆβžΏ}⏫❌_β«πŸŒ€β™πŸ”β™Šβ›Žβ™‰β™‘πŸ“ΆπŸ†”_β“‚β™ŒβžΏβ«β™ˆβ«πŸ“ΆπŸ”΄_β™’βœ–_πŸ”β™‘β™‰πŸšΊπŸ”ŸπŸ”Ÿβ™’πŸ”πŸ“ΆπŸˆ²_β™‘πŸ”΄}πŸ”βžΏπŸ†”βžΏπŸ’―πŸ’―πŸ”Ÿβž—_βΊβ™‰β™πŸ”΄_πŸ”ŸπŸ”πŸ”΄{βž—πŸ†”βœ–_β™ŠπŸˆ²βΊπŸ”πŸšΊβœ–πŸ†”βŒπŸˆ²β™“_β™Œβ™βž—{β™‰β™ˆβ™ŒπŸšΊβŒβ«πŸŒ€_β›Žβ™‰β™Œβœ–β™“πŸ“ΆπŸ”Ÿβœ–πŸšΊβ™“_β™Œβ™“β™’βž—πŸ”΄β™β™‰β™“βΊβ«_πŸŒ€β™‰}πŸˆ²βœ–β™‰πŸ”Ÿβ“‚β™’πŸŒ€β™_♏{β™Œβ™’βžΏβ™’βœ–β™ˆβ™’πŸ’―β™’_βœ–}πŸ”΄_β™ŒπŸ”ŸπŸ†”βŒπŸŒ€βœ–πŸ”ŸβŒ_β™Œβ™“βžΏβ™Šβ“‚βžΏπŸ”΄πŸ’―β™‰β“‚_πŸŒ€β™Šβ“‚βž—{β™Œβ™’βŒπŸ“ΆπŸšΊπŸ’―_βž—β™Œβœ–β™‰β™βŒβ™Šβ™ŒπŸšΊβ™Œ_πŸŒ€πŸˆ²β™‘β™Œβ™“βŒπŸ†”βž—β™Œ}πŸ”_β™ˆβ™‰β™ŠβŒβ™“πŸ”β™Šβ™ˆβŒπŸ’―{β™Šβ™‰β™’β™ˆβ™“β™ˆβ«β™“_πŸ’―β™β™‰πŸŒ€_β™βžΏπŸ“Άβ“‚β™β™‘πŸŒ€}_β™‘πŸ’―{βŒπŸšΊβ™β™βΊπŸ”β™πŸ”_β™“πŸ†”β™ŒπŸ”πŸ“ΆπŸ“ΆβŒπŸšΊπŸ”βœ–_β“‚πŸ“Άβ“‚β™πŸŒ€β™‘β“‚β™πŸ†”πŸ”΄_πŸšΊβ›ŽπŸ†”πŸˆ²β“‚βœ–β™’β™Œβ™‘πŸ†”_βž—β™ˆ}πŸˆ²πŸ’―βŒβœ–βœ–β™βŒπŸ“Ά_β™’βŒβ™Š{πŸ“ΆπŸ†”β™ŠβžΏβΊβŒβ›Ž_βΊβŒβ›ŽπŸšΊβ›ŽπŸ“Ά_🈲}🈲_β™ˆπŸ†”β«{πŸ”Ÿβ™β«βŒπŸ”ŸπŸ”΄_πŸ”΄β™ˆβ™‰β™’β™ŒπŸ”βœ–πŸ”΄πŸ’―β™’_πŸ“Ά}πŸ“ΆπŸ†”πŸ“ΆπŸ“ΆβžΏπŸ†”πŸ†”πŸ’―πŸŒ€_βΊπŸšΊβ™“β™‘βΊ{πŸšΊβ™“βœ–πŸ”β™ˆ_β›Žβ™β™‰β“‚}β«β›ŽπŸ’―πŸšΊ_⏫🚺"""

for x, y in analysis.items():
    emoji_encoded = emoji_encoded.replace(x, y)

print(emoji_encoded)

flag

castorsCTF{sancoho_flag_qjzmlpg}

Β© Aayushman Choudhary 2021

CastorsCTF | Two Paths