RTCP - Treeeeeeee

Posted on sam. 25 janvier 2020 in CTF

solves : 38

Point : 200

It appears that my cat has gotten itself stuck in a tree... It's really tall and I can't seem to reach it. Maybe you can throw a snake at the tree to find it?

Oh, you want to know what my cat looks like? I put a picture in the hints.

We got a 7z archive. Let's unpack it!

$ 7z e treemycatisin.7z        

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=fr_FR.UTF-8,Utf16=on,HugeFiles=on,64 bits,8 CPUs Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz (806EA),ASM,AES-NI)

Scanning the drive for archives:
1 file, 266897 bytes (261 KiB)

Extracting archive: treemycatisin.7z
--
Path = treemycatisin.7z
Type = 7z
Physical Size = 266897
Headers Size = 261108
Method = LZMA2:3m
Solid = +
Blocks = 1

Everything is Ok                                                              

Folders: 27848
Files: 1337
Size:       2146274
Compressed: 266897

We have a bunch of folder and files. It will be impossible to go through all of it.

$ ls -al
total 5348
drwxr-xr-x 27849 nlegall nlegall 583720 janv. 27 19:30 .
drwxr-xr-x     3 nlegall nlegall    160 janv. 27 19:28 ..
drwx------     2 nlegall nlegall     40 sept. 19 18:23 003Q6
drwx------     2 nlegall nlegall     40 sept. 19 18:23 004P77DAN
drwx------     2 nlegall nlegall     40 sept. 19 18:23 007CXMN
[...]
drwx------     2 nlegall nlegall     40 sept. 19 18:23 ZZXJO9L
drwx------     2 nlegall nlegall     40 sept. 19 18:23 ZZYSGJ8
drwx------     2 nlegall nlegall     40 sept. 19 18:23 ZZZGZF3L

The find command is your best friend in this case. The only files are .jpg files. Let's find them all and try to check the size for each. For better understandable, we can sort and uniq to count how many time each file size occur.

$ find . -name "*.jpg" -exec ls -ld {} \; | awk '{print $5}' | sort -n | uniq -c
    681 1496
    655 1718
      1 2208
$ find . -name "*.jpg" -exec ls -ld {} \; | grep 2208
-rw-r--r-- 1 nlegall nlegall 2208 sept. 19 19:20 ./ENP92.jpg

Hum, only one presents a size of 2208.

ENP92.jpg

Let's write down the image and got the flag : rtcp{meow_sharp_pidgion_rice_tree}.