Rating:

Challenge: **Lost Visual**

Category: **Misc**

Points: **400**

Description: **Not again! I was just going to give you the flag this time, but my cat ruined everything as usual. I had a whole presentation for it, too. Tell you what: if you can fix my presentation, I should be able to recover the flag for you.
NOTE: This CTF uses macros. To enable them for this PowerPoint, click here.
Due to the nature of PowerPoints, you will need a Windows machine or VM with Microsoft PowerPoint to run the macro.
Note: The flag format for this specific challenge is flag{...}**

Solution: **first of all, the macros had to be enabled as [this guide](https://support.microsoft.com/en-us/topic/a-potentially-dangerous-macro-has-been-blocked-0952faa0-37e7-4316-b61d-5b5ed6024216) explains.**

**if we started the presentation, we could notice that a macro checked if the order of the slides was correct, and only if it was it printed the (encrypted) flag,
otherwise a message box indicated this statement**

![](https://i.postimg.cc/wBfhC2hs/Screenshot-224.png)

**we could enable a function, to see hidden writings**

![](https://i.postimg.cc/R0XRM4zh/Screenshot-225.png)

**so at this point, in the upper left corner all the slides had their sorting number**

![](https://i.postimg.cc/8zWkQzMd/Screenshot-226.png)

**at this point we could order the slides, and looking at the presentation again the message box eventually changed**

![](https://i.postimg.cc/J7bQnN8S/Screenshot-227.png)

**in the third slide, a writing could be seen behind the cat on the computer**

![](https://i.postimg.cc/ryBFh4ty/Screenshot-228.png)

**at this point it was necessary to take the first letter of each slide and this made up the encryption key of the flag: ABYSSINIAN**

**at this point, we could go to analyze the macros**

![](https://i.postimg.cc/W3Vw6z65/Screenshot-229.png)

**we could see that there was a block of wrong code, in the "EventManager" macro, it had to be uncommented and corrected**

![](https://i.postimg.cc/NF6M8GDk/Screenshot-230.png)

**the correct code was:**

```
'WHAT A MESS! I'll fix it later...

Dim FlagSlide As Slide
Set FlagSlide = ActivePresentation.Slides.Add(CLng(i) + 1, ppLayoutTitle)

With FlagSlide.Shapes
.Title.TextFrame.TextRange = "Thanks For Your Help!"
.Placeholders(2).TextFrame.TextRange = flag
With .AddTextbox(Orientation:=msoTextOrientationHorizontal, Left:=0, Top:=0, Width:=36, Height:=28)
.TextFrame2.TextRange.Text = "11"
.Visible = msoFalse
End With
End With
```

**now it finally printed the flag, the last part was missing, implement the decrypt of the flag**

![](https://i.postimg.cc/Zqw84Fyp/Screenshot-231.png)

**so here is the final code, with the flag decrypt implementation:**

```
'WHAT A MESS! I'll fix it later...

Dim FlagSlide As Slide
Set FlagSlide = ActivePresentation.Slides.Add(CLng(i) + 1, ppLayoutTitle)

Dim SimpleCipher As New SimpleCipher
Dim decryptedFlag As String
decryptedFlag = SimpleCipher.SimpleDecrypt(flag, "ABYSSINIAN")

With FlagSlide.Shapes
.Title.TextFrame.TextRange = "Thanks For Your Help!"
.Placeholders(2).TextFrame.TextRange = decryptedFlag
With .AddTextbox(Orientation:=msoTextOrientationHorizontal, Left:=0, Top:=0, Width:=36, Height:=28)
.TextFrame2.TextRange.Text = "11"
.Visible = msoFalse
End With
End With
```

**at this point we can enjoy the solve of the last Misc haha**

![](https://i.postimg.cc/zvrKktmm/Screenshot-232.png)

flag: **flag{c0v3r1ng_tH3_v1Su4l_b4s1Cs}**