File Extensions
~# cat Question
Sometimes its not about having the "correct" extension... What is considered "correct" anyway 🤔 Can multiple things be correct? 🧐
FILE: challenge.pptx
The challenge gave us a clue about extension. The first thing we can do is run file, a utility, on it to check the file type of the file.
┌──(tev㉿kali)-[~/AYCEP]
└─$ file challenge.pptx
challenge.pptx: Microsoft OOXMLDespite the file extension being .pptx, it really is a OOXML. This essentially means that it is type of zip file despite the .pptx extension. We can change the extension of challenge.pptx to a zip file and then unzip it
┌──(tev㉿kali)-[~/AYCEP]
└─$ mv challenge.pptx challenge.zip
┌──(tev㉿kali)-[~/AYCEP]
└─$ unzip challenge.zip
Archive: challenge.zip
inflating: [Content_Types].xml
inflating: _rels/.rels
inflating: docProps/app.xml
inflating: docProps/core.xml
inflating: docProps/thumbnail.jpeg
creating: ppt/_rels/
inflating: ppt/_rels/presentation.xml.rels
creating: ppt/media/
inflating: ppt/media/image1.jpeg
inflating: ppt/presentation.xml
inflating: ppt/presProps.xml
creating: ppt/slideLayouts/
creating: ppt/slideLayouts/_rels/
inflating: ppt/slideLayouts/_rels/slideLayout1.xml.rels
inflating: ppt/slideLayouts/_rels/slideLayout10.xml.rels
inflating: ppt/slideLayouts/_rels/slideLayout11.xml.rels
inflating: ppt/slideLayouts/_rels/slideLayout2.xml.rels
inflating: ppt/slideLayouts/_rels/slideLayout3.xml.rels
inflating: ppt/slideLayouts/_rels/slideLayout4.xml.rels
inflating: ppt/slideLayouts/_rels/slideLayout5.xml.rels
inflating: ppt/slideLayouts/_rels/slideLayout6.xml.rels
inflating: ppt/slideLayouts/_rels/slideLayout7.xml.rels
inflating: ppt/slideLayouts/_rels/slideLayout8.xml.rels
inflating: ppt/slideLayouts/_rels/slideLayout9.xml.rels
inflating: ppt/slideLayouts/slideLayout1.xml
inflating: ppt/slideLayouts/slideLayout10.xml
inflating: ppt/slideLayouts/slideLayout11.xml
inflating: ppt/slideLayouts/slideLayout2.xml
inflating: ppt/slideLayouts/slideLayout3.xml
inflating: ppt/slideLayouts/slideLayout4.xml
inflating: ppt/slideLayouts/slideLayout5.xml
inflating: ppt/slideLayouts/slideLayout6.xml
inflating: ppt/slideLayouts/slideLayout7.xml
inflating: ppt/slideLayouts/slideLayout8.xml
inflating: ppt/slideLayouts/slideLayout9.xml
creating: ppt/slideMasters/
creating: ppt/slideMasters/_rels/
inflating: ppt/slideMasters/_rels/slideMaster1.xml.rels
inflating: ppt/slideMasters/slideMaster1.xml
creating: ppt/slides/
creating: ppt/slides/_rels/
inflating: ppt/slides/_rels/slide1.xml.rels
inflating: ppt/slides/_rels/slide2.xml.rels
inflating: ppt/slides/_rels/slide3.xml.rels
inflating: ppt/slides/slide1.xml
inflating: ppt/slides/slide2.xml
inflating: ppt/slides/slide3.xml
inflating: ppt/tableStyles.xml
creating: ppt/theme/
inflating: ppt/theme/theme1.xml
inflating: ppt/viewProps.xml Unzipping the zip file gives us a few directories, but the main one of concern is ppt. Going into that directory we can see a few different xml files that contain content. When we cat one of them out we will get the flag.
┌──(tev㉿kali)-[~/AYCEP]
└─$ cd ppt
┌──(tev㉿kali)-[~/AYCEP/ppt]
└─$ ls
media presProps.xml slideLayouts slides theme
presentation.xml _rels slideMasters tableStyles.xml viewProps.xml
┌──(tev㉿kali)-[~/AYCEP/ppt]
└─$ cat presentation.xml
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<p:presentation xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:p="http://schemas.openxmlformats.org/presentationml/2006/main" saveSubsetFonts="1"><p:sldMasterIdLst><p:sldMasterId id="2147483712" r:id="rId1"/></p:sldMasterIdLst><p:sldIdLst><p:sldId id="256" r:id="rId2"/><p:sldId id="257" r:id="rId3"/><p:sldId id="258" r:id="rId4"/></p:sldIdLst><p:sldSz cx="12192000" cy="6858000"/><p:notesSz cx="6858000" cy="9144000"/><p:defaultTextStyle><a:defPPr><a:defRPr lang="en-US"/></a:defPPr><a:lvl1pPr marL="0" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl1pPr><a:lvl2pPr marL="457200" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl2pPr><a:lvl3pPr marL="914400" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl3pPr><a:lvl4pPr marL="1371600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl4pPr><a:lvl5pPr marL="1828800" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl5pPr><a:lvl6pPr marL="2286000" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl6pPr><a:lvl7pPr marL="2743200" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl7pPr><a:lvl8pPr marL="3200400" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl8pPr><a:lvl9pPr marL="3657600" algn="l" defTabSz="914400" rtl="0" eaLnBrk="1" latinLnBrk="0" hangingPunct="1"><a:defRPr sz="1800" kern="1200"><a:solidFill><a:schemeClr val="tx1"/></a:solidFill><a:latin typeface="+mn-lt"/><a:ea typeface="+mn-ea"/><a:cs typeface="+mn-cs"/></a:defRPr></a:lvl9pPr></p:defaultTextStyle></p:presentation>
<!--Good job finding this, here is the fłag: ZmxhZ3tEaWRfeTB1X2tuMHdfcDB3M3JwMGludHNfNHIzX2pVc1RfejFwX2ZpTDNzfQ==--> The flag we received is base64 encrypted, we can simply just decrypt it to get the flag in plaintext.
┌──(tev㉿kali)-[~/AYCEP/ppt]
└─$ echo "ZmxhZ3tEaWRfeTB1X2tuMHdfcDB3M3JwMGludHNfNHIzX2pVc1RfejFwX2ZpTDNzfQ==" | base64 -d
flag{Did_y0u_kn0w_p0w3rp0ints_4r3_jUsT_z1p_fiL3s} Flag: flag{Did_y0u_kn0w_p0w3rp0ints_4r3_jUsT_z1p_fiL3s}
Last updated