This is the other challenge that I wrote for the @bsjtf CTF for BSides Chicago. As this one was also unsolved I wanted to give you a walk through on how to solve this one. The challenge (Lightswitch Matrix) starts with this text:
TARGET: Eagle Weapons and Ammunition
LOCATION: Tybee Island, GA (32° 0′ N / 80° 50′ W)
Tybee Island is a nice vacation spot. However, we know that there is a rogue operations base being disguised as Eagle Weapons and Ammunition. We intercepted some spreadsheets and the following image. We haven’t been able to make heads or tails of what is going on. We need you to be quick on this one. The last thing we need is an incident at an ammunition factory during a dinner at The Crab Shack.
The file is attached.
Good luck agent!
Now, if you have played this CTF before you will know that often times the names of the challenge and the “random” text is not always “random”. There were two very big hints in this write up. First, Lightswitch. On/Off…. The second was “intercepted some spreadsheets”. As this is a steganography challenge, the idea is that something is being hidden inside the attached file.
You download the image and dump strings or look at it in a hex editor and you will noticed what appears to be binary appended to the png. Also, if you looked at the header where the editor name should be you only see “29×29”. This was your third clue. I also tweeted that out on the bsjtf twitter account.
While this looks like binary, it’s not. Well it is, but it’s the simplest form. On/Off. If you arranged the binary in a 29 column by 29 row matrix you got this.
Even at a first glance you can tell that there is something there. However very few fonts will give you want you wanted. This is why I hinted at spreadsheets both in the description and on the bjstf twitter account. If you imported this into a spreadsheet you got this. Setting the column width and row height to be the same.
Now, let’s move to the On/Off. The idea here was to turn the 0’s off (white) and the 1’s on (black). Even if you switched black with white it would have still been easily identifiable. This resulted with what is clearly an unfinished QR code.
At this point, you only needed to fix the corners and it would be a valid QR code when scanned gave you the flag.
And there you have it. Go ahead, scan the code.