Hexillology

Forensics [25 pts]

This problem is titled Hexillogoly, so right from the start we know it has something to do with Hex and Hexadecimal.

 Okay, lets open the link in a new tab. Its a png.

 

 Nothing too particular stands out, just some rather bland colors and shapes.

Originally, when I heard the word Hex my mind automatically went to hex editors. So I quickly jumped into my good friend hexed.it and uploaded the image.

 

 Nothing really stands out, I see two repeating lengths in the hex, but I didn’t look too long at that. Of course, I did a quick Ctrl + F to search for the string ‘tjctf’ but found nothing.

 

 After a few minutes of searching and thinking, I nearly facepalmed myself in the head because I missed something really obvious. Hex doesn’t mean just hexadecimal used in files and memory. Hex can also be used as a format to store Colors in, on websites for example. “hurr durr let me open up this image in a hex editor and search the hexadecimal for clues hur durr”

 

Anyway, after my idiot phase ended I quickly opened up the image in Gimp and took a look at the colors it contained.

 

 I used the Color Picker tool to pick out the first greyish color, so I could view the color hex.

 

 In Gimp’s case, the Hex number is shown as ‘HTML notation’:

 

 I went online to color hex lookup site to verify that what I was looking at was the real color.

 

 After that, I simply copied the 6-digit number into a Hex-to-Ascii converter and

 

 ta-da! It begins to spell out the flag!

 Okay, lets repeat the process for the other colors. Grab the HTML notation of the middle shape next and enter it into the converter alongside the first one.

 
 

 It follows the pattern, so I continue.

 

 After I have entered all the colors into the converter, we are left with what appears to be a flag. It doesn’t seem to have a readable message in it, but when I tried it it worked. Here is the flag:

 
 
 
 

Flag: tjctf{pYJrfQK0dbaTPG}

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s