- category: Forensics
- points: 50
Description
Layers are here.
Writeup
We are given an image Layer.jpg :
If we search for a flag directly using strings on the file we get :
1
2
| strings Layers.jpg| grep -i UUT
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)" xmp:CreateDate="2019-04-24T19:13:26+04:30" xmp:MetadataDate="2019-04-24T19:13:26+04:30" xmp:ModifyDate="2019-04-24T19:13:26+04:30" xmpMM:InstanceID="xmp.iid:6e14b5a5-6194-4e4a-b78e-f71bbb92395f" xmpMM:DocumentID="adobe:docid:photoshop:39915134-669f-11e9-8555-e8884e2d43b9" xmpMM:OriginalDocumentID="xmp.did:e3606230-6b16-8a49-975e-c9718a22e944" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" dc:format="image/jpeg"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:e3606230-6b16-8a49-975e-c9718a22e944" stEvt:when="2019-04-24T19:13:26+04:30" stEvt:softwareAgent="Adobe Photoshop CC 2015 (Windows)"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:6e14b5a5-6194-4e4a-b78e-f71bbb92395f" stEvt:when="2019-04-24T19:13:26+04:30" stEvt:softwareAgent="Adobe Photoshop CC 2015 (Windows)" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> <photoshop:TextLayers> <rdf:Bag> <rdf:li photoshop:LayerName="uutctf{can_you_see_me}" photoshop:LayerText="uutctf{can_you_see_me}"/> </rdf:Bag> </photoshop:TextLayers> </rdf:Description> </rdf:RDF> </x:xmpmeta>
|
We can see in the end’s output that there’s the flag
photoshop:LayerText="uutctf{can_you_see_me}"
Flag
uutctf{can_you_see_me}