ASIS CTF 2014: Tortureous sound

May 11, 2014

After downloading and extracting we got a file which was identified as:

$~/asis2014$ file steg_75_235fdd4c364c6d58d79bb6e6fad45ef7
steg_75_235fdd4c364c6d58d79bb6e6fad45ef7: ISO Media, MPEG v4 system, version 2

Ok this looks like an audio or video file. Lets try to open it with a media player.
Great we can open it, and hear that typical SSTV sound. Ok let’s open RX-SSTV and replay the audio file.

Because we did this part so far on a MacBook Pro and RX-SSTV does not run properly within a windows VM, we used another computer running Windows with RX-SSTV and connected them via audio cable.

The first picture we got was this:

2014-05-08_22.36.45

Ok, this looked kind of strange, but in the center it looks like a QR code. Maybe we can tweak it a little bit in audacity. When we opend it in audacity, we noticed there are 5 audio lines, which were played together.
asis2014_audacity

So lets play each audio track seperately and record it with RX-SSTV. So we got these 5 pictures:

2014-05-08_22.41.08

2014-05-08_22.40.20

2014-05-08_22.43.19

SSTV-08May2014-224726

2014-05-08_22.44.28

Apart from the troll face we now can clearly see four parts of the QR code, in the center of each picture. After we cut the parts and merged them, as we thought the need to be ordered, we tried to scan the QR code. But unfortunatelly it didn’t work. 🙁

Ok lets studiy the QR code article on wikipedia. The timing pattern is there and valid. The version and format information is there, too. We wondered ourself a bit about the low error correction, but ok. After studying the QR code for almost 2 hours, we agreed that we need to get it done without writing a QR code parser ourself. Since the timing pattern was correct we would only mirror the three position images together on the top left to bottom right diagonal line, and then add the alignment part in the bottom right. Maybe we needed to flip the alignment image.

When i tried to scan it with my mobile and it took some seconds, i thought ok lets take a look at another task, but suddenly a md5 sum appeared. 

Screenshot_2014-05-10-19-21-47

So the flag is: ASIS_83c37934407754f81e9e2f98ff3d231f
And this is the QR code: QR

That was a great challenge, unfortunately only worth 75 points.

Leave a Reply