Tags: forensics stego 

Rating:

# important_notes - Forensics (456 pts)

## Description
> idk im blanking on any lore for this challenge

### Provided files
important_notes.zip - a ZIP archive containing 7 plain-text files \[[download](https://ctfnote.shinmai.wtf:31337/files/downloadFile?id=5wewbMbk9HDkKSy)\]

## Ideas and observations
1. All other files seem like just random (based on the language, likely AI generated) text, but `idea2.txt` and `essay2.txt` have a bunch of extraneous whitespace at the end of the file.
2. The `idea` files contain ideas for CTF challenges, `idea2.txt` is about a stego challenge

## Notes
1. The whitespace at the end of `essay2.txt` is just a bunch of linefeeds
2. `idea2.txt` however has lines containig a mix of tabs and spaces

## Solution
1. Take the block of whitespace at the end of `idea2.txt`
2. Replace `\t` with 1 and ` ` with 0
3. remove lines with a lone `1` on them
4. discard 4 leading zeroes so you have 8 bits per line
5. decode each line as an 8-bit byte for the flag

### Solution CyberChef recipe
See [here](https://gchq.github.io/CyberChef/#recipe=Find%5F%2F%5FReplace%28%7B%27option%27%3A%27Extended%20%28%5C%5Cn%2C%20%5C%5Ct%2C%20%5C%5Cx%2E%2E%2E%29%27%2C%27string%27%3A%27%5C%5Ct%27%7D%2C%271%27%2Ctrue%2Cfalse%2Ctrue%2Cfalse%29Find%5F%2F%5FReplace%28%7B%27option%27%3A%27Simple%20string%27%2C%27string%27%3A%27%20%27%7D%2C%270%27%2Ctrue%2Cfalse%2Ctrue%2Cfalse%29Find%5F%2F%5FReplace%28%7B%27option%27%3A%27Regex%27%2C%27string%27%3A%27%5C%5Cn1%5C%5Cn%27%7D%2C%27%5C%5Cn%27%2Ctrue%2Cfalse%2Ctrue%2Cfalse%29Find%5F%2F%5FReplace%28%7B%27option%27%3A%27Regex%27%2C%27string%27%3A%270%7B4%7D%28%2E%2E%2E%2E%2E%2E%2E%2E%29%24%27%7D%2C%27%241%27%2Ctrue%2Cfalse%2Ctrue%2Cfalse%29From%5FBinary%28%27Line%20feed%27%2C8%29&input=ICAgICAJCSAJIAkJCgkKICAgICAgCSAgICAgCgkKICAgICAJCQkgCSAgCgkKICAgICAJCSAJICAgCgkKICAgICAJCSAJICAJCgkKICAgICAJCQkgIAkJCgkKICAgICAgCSAgICAgCgkKICAgICAJCSAJICAJCgkKICAgICAJCSAgCSAgCgkKICAgICAJCSAgCSAJCgkKICAgICAJCSAgICAJCgkKICAgICAgCSAgICAgCgkKICAgICAJCSAJICAJCgkKICAgICAJCQkgIAkJCgkKICAgICAgCSAgICAgCgkKICAgICAJCSAgCSAJCgkKICAgICAJCQkgICAgCgkKICAgICAJCSAJICAJCgkKICAgICAJCSAgIAkJCgkKICAgICAgCSAJCQkgCgkKICAgICAgCSAgICAgCgkKICAgICAJCSAgIAkJCgkKICAgICAJCSAgICAJCgkKICAgICAJCSAJCQkgCgkKICAgICAgCSAgCQkJCgkKICAgICAJCQkgCSAgCgkKICAgICAgCSAgICAgCgkKICAgICAJCSAJCSAgCgkKICAgICAJCSAgCSAJCgkKICAgICAJCQkgCSAgCgkKICAgICAgCSAgICAgCgkKICAgICAJCSAgICAJCgkKICAgICAJCSAJCQkgCgkKICAgICAJCQkJICAJCgkKICAgICAJCSAJCQkJCgkKICAgICAJCSAJCQkgCgkKICAgICAJCSAgCSAJCgkKICAgICAgCSAgICAgCgkKICAgICAJCSAJIAkJCgkKICAgICAJCSAJCQkgCgkKICAgICAJCSAJCQkJCgkKICAgICAJCQkgCQkJCgkKICAgICAgCSAgICAgCgkKICAgICAJICAJICAJCgkKICAgICAgCSAgICAgCgkKICAgICAJCQkgCSAgCgkKICAgICAJCSAJICAgCgkKICAgICAJCSAJICAJCgkKICAgICAJCSAJCQkgCgkKICAgICAJCSAJIAkJCgkKICAgICAgCSAgICAgCgkKICAgICAJCQkgCSAgCgkKICAgICAJCSAJICAgCgkKICAgICAJCSAgICAJCgkKICAgICAJCQkgCSAgCgkKICAgICAgICAJIAkgCgkKICAgICAJCQkgCQkJCgkKICAgICAJCSAgIAkJCgkKICAgICAJCQkgCSAgCgkKICAgICAJCSAgCQkgCgkKICAgICAJCQkJIAkJCgkKICAgICAJCSAJICAgCgkKICAgICAgCQkgCSAgCgkKICAgICAJCQkgIAkgCgkKICAgICAJICAgCSAgCgkKICAgICAJIAkJCQkJCgkKICAgICAJCSAgCSAgCgkKICAgICAJCQkgIAkgCgkKICAgICAgCQkgICAJCgkKICAgICAJCQkgCQkgCgkKICAgICAgCQkgIAkJCgkKICAgICAJIAkJCQkJCgkKICAgICAJCSAgIAkgCgkKICAgICAJIAkgIAkgCgkKICAgICAgCQkgICAgCgkKICAgICAJIAkgCQkJCgkKICAgICAJCSAJCQkgCgkKICAgICAgCQkgICAJCgkKICAgICAgCQkgIAkJCgkKICAgICAgCQkgCSAJCgkKICAgICAJIAkJCQkJCgkKICAgICAJCSAJCSAJCgkKICAgICAJCSAJCSAJCgkKICAgICAJICAJCSAJCgkKICAgICAJCSAJCSAJCgkKICAgICAJCSAJCSAJCgkKICAgICAJICAJCSAJCgkKICAgICAJCSAJCSAJCgkKICAgICAJCQkJCSAJCgkK)

`wctf{h4rD_dr1v3_bR0Wn135_mmMmmMm}`

Original writeup (https://gist.github.com/shinmai/5720d1f0a214d0878cfb530eb975c469#important_notes---forensics-456-pts).