Pragyan CTF — Welcome (Forensics)

A short forensics walkthrough from Pragyan CTF's Welcome challenge.

To begin the CTF, we’re provided with a link to an image. It seems like a normal image at first, but let’s check what it really is using binwalk:

$ binwalk -e welcome.jpeg

DECIMAL   HEXADECIMAL   DESCRIPTION
------------------------------------------------------------
0         0x0           JPEG image data, JFIF standard 1.01
10600     0x2968        Zip archive data, uncompressed size: 9886, name: d.zip
20483     0x5003        End of Zip archive, footer length: 22

There’s a zip file hiding inside the image. Extracting d.zip gives us two files: a.zip and secret.bmp.

$ file secret.bmp
secret.bmp: ASCII text

So secret.bmp isn’t really an image — it’s a wall of junk text with a base64-looking chunk at the very end. Decoding that last chunk reveals a password, which unlocks the next stage of the challenge.

The exact junk string and the decoded password are left out of this migrated copy — grab them from your web.archive.org copy if you want the full original write-up.

Originally published at https://snazzysanoj.in/pragyan-ctf-welcome-forensics/