Codemash CTF 2019 - Busted File
Clue
Mommy told you not to store your important files on those old diskettes. Can you repair the file?
Hint
Have you heard of magic numbers?
Approach
Any time I get a file from a CTF, the first thing I do is open it in a hex editor. When opening this file I see that the first four bytes are DE AD BE EF
, which is a classic magic number. Since I have worked with zip files in the past, I knew they started with PK
and then a version number. A quick google search got me the right values. So I replaced the DE AD BE EF
bytes with 50 4B 03 04
and was able to open the file.
This got us a smiling horse:
I opened this file with a hex editor and a search for the string cm
, yields our flag:
cm19-disk-3tte-N0st-algy