> For the complete documentation index, see [llms.txt](https://kunalwalavalkar.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kunalwalavalkar.gitbook.io/write-ups/ctflearn/cryptography/tux.md). # Tux! > The flag is hidden inside the Penguin! Solve this challenge before solving my 100 point Scope challenge which uses similar techniques as this one. > > [Tux.jpg](https://ctflearn.com/challenge/download/973) Let's check the metadata of the image using the `exiftool` utility. ``` $ exiftool Tux.jpg ExifTool Version Number : 12.40 File Name : Tux.jpg Directory : . File Size : 5.6 KiB File Modification Date/Time : 2020:07:22 09:33:14+05:30 File Access Date/Time : 2023:10:09 10:13:06+05:30 File Inode Change Date/Time : 2023:10:09 10:13:35+05:30 File Permissions : -rw-r--r-- File Type : JPEG File Type Extension : jpg MIME Type : image/jpeg JFIF Version : 1.01 Resolution Unit : None X Resolution : 1 Y Resolution : 1 Comment : ICAgICAgUGFzc3dvcmQ6IExpbnV4MTIzNDUK. Image Width : 196 Image Height : 216 Encoding Process : Baseline DCT, Huffman coding Bits Per Sample : 8 Color Components : 3 Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2) Image Size : 196x216 Megapixels : 0.042 ``` We can see that the `Comment` field is encoded using Base64. We can use Cyberchef to decode it.
So the `Comment` was a password. But we don't have anything to unlock yet. The `binwalk` utility is used for searching a given binary image for embedded files and executable code, ``` $ binwalk -e tux.jpg DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 JPEG image data, JFIF standard 1.01 WARNING: Extractor.execute failed to run external extractor 'jar xvf '%e'': [Errno 2] No such file or directory: 'jar', 'jar xvf '%e'' might not be installed correctly 5488 0x1570 Zip archive data, encrypted at least v1.0 to extract, compressed size: 39, uncompressed size: 27, name: flag 5679 0x162F End of Zip archive, footer length: 22 ``` Let's check what embedded files were extracted. ``` $ ls tux.jpg _tux.jpg.extracted ``` We can `cd _tux.jpg.extracted` and check what's in there. ``` $ ls tux.jpg _tux.jpg.extracted ``` * So there is a ZIP file that we need to extract. This is where the password that we decrypted becomes useful. ``` $ unzip 1570.zip Archive: 1570.zip [1570.zip] flag password: replace flag? [y]es, [n]o, [A]ll, [N]one, [r]ename: y extracting: flag ``` * Now all we have to do is `cat` the flag. ``` $ cat flag CTFlearn{Linux_Is_Awesome} ``` ### Flag ``` CTFlearn{Linux_Is_Awesome} ```