Forens/BuckSpeak
00. Metainfo
| CTF: | niteCTF 2024 |
| Category: | Forensics |
| CTFtime | CTFtime |
01. Description
BuckBeak From the task description: Buckbeak is trying to say something deep but is frustrated as nobody bücking understands him. Can you help him out? This is a fairly difficult challenge, filled with traps and endless subtasks. But let’s start from the beginning. We are given a file bucking.wav, which plays some sound. Searching “bücking” on Google reveals a character from Harry Potter and a cipher related to musical notes, which is available on Wikipedia.
This makes sense since it might be some kind of cipher. I don’t know much about music, but further searching led me to this website, which explains the cipher in detail.
02. AnthemScore
AnthemScore is a program that converts played music into sheet music. Unfortunately, the trial version only processes 30 seconds and needs to be adjusted to 3/4, but I managed to work around it.
After manually analyzing and decoding, the sentence obtained is…
usephrasetruefansreadthebookstohearsomethingdeep
Is this the flag? Oh no. Is this a cipher? Also no.
03. Deep Sound
When uploading the file to the Deep Sound program, it asks for a password. Is the password usephrasetruefansreadthebookstohearsomethingdeep? Oh no, that would be too simple.
The actual password is:
truefansreadthebooks
03. mkvinfo & mkvextract
Okay, we have a file screech.mkv, and it contains a video of Buckbeak, but is this the end? Oh no, that would be too simple ;)
I analyzed it for several hours and found nothing. I extracted the audio, reversed it, and still nothing… However, I decided to analyze the file again.
mkvinfo screech.mkv
# + Attachments
# | + Attached
# | + File name: Buckbeak.otf
# | + MIME type: application/x-truetype-font
# | + File data: size 109032
# | + File UID: 17636095151199042832
# | + Attached
# | + File name: Mechanical-g5Y5.otf
# | + MIME type: application/x-truetype-font
# | + File data: size 112136
# | + File UID: 4317686372283026958
Oh, there are fonts Buckbeak.otf.
I extracted them.
mkvextract attachments screech.mkv 1:Buckbeak.otf
The attachment #1, ID 17636095151199042832, MIME type application/x-truetype-font, size 109032, is written to 'Buckbeak.otf'.
04. Font Buckbeak.otf
I installed this font. For a while, I was so confused that I didn’t know what to do. However, Lazarus suggested copying the text UnderstaNDAblE Buckbēaĸ SCRéècHiɳg-ɲoǐşēЅz using this font. Then we get the flag. I had also previously ripped the subtitles, but I’ll leave that as a task for you to explore.
05. Summary
This was quite an interesting and unconventional challenge that required learning new things. It was a bit frustrating, but in the end, I was happy to discover the solution.
Zostaw komentarz