VolgaCTF 2013 WriteUp - stegasic 500
With these words this challenge starts. We can download a gzipped archive which contains the plain text version of war and peace. So we extract this file. At google we find another plain text version of this book. Now we can compare both files, but this surprises us. Both files are completely the same.
Therefore we have to take a closer look at the archive file. At the first glance we cannot find any abnormalities. So we create a new archived version of the book and compare each other. Now we see that almost every byte is different. Ok, we know now that some information is possibly hidden in this archive file. The organizer gives us a little hint with one word - gzsteg.
A search with google shows us that gzsteg is an old steganography addition for gzip by Andy Brown and Ken Pizzini. We only find patches for the sources of gzip. So we try to patch the current version of gzip, but this fails. Therefore we download the version 1.2.4. Patching this sources causes no problems. After compiling the sources we have a gzip binary which can extract hidden files in gzipped archives. Ok, lets go.
Now we have another file. The file command shows us that this file is a text file, too. This file contains a little commercial text, but we don't know what we have to do with this text.
Dear Friend ; Especially for you - this red-hot announcement
. This is a one time mailing there is no need to request
removal if you won't want any more . This mail is being
sent in compliance with Senate bill 2216 , Title 8
; Section 304 ! This is not multi-level marketing .
Why work for somebody else when you can become rich
within 46 WEEKS . Have you ever noticed the baby boomers
are more demanding than their parents & nearly every
commercial on television has a .com on in it ! Well,
now is your chance to capitalize on this . WE will
help YOU use credit cards on your website & turn your
business into an E-BUSINESS ! You can begin at absolutely
no cost to you . But don't believe us ! Ms Simpson
who resides in Pennsylvania tried us and says "Now
I'm rich, Rich, RICH" ! We assure you that we operate
within all applicable laws . Because the Internet operates
on "Internet time" you must make a commitment soon
. Sign up a friend and you'll get a discount of 20%
! Thank-you for your serious consideration of our offer
! Dear Professional ; This letter was specially selected
to be sent to you ! We will comply with all removal
requests . This mail is being sent in compliance with
Senate bill 1618 , Title 6 , Section 305 ! THIS IS
NOT A GET RICH SCHEME ! Why work for somebody else
when you can become rich as few as 48 weeks ! Have
you ever noticed people will do almost anything to
avoid mailing their bills and more people than ever
are surfing the web ! Well, now is your chance to capitalize
on this . We will help you sell more plus deliver goods
right to the customer's doorstep . You can begin at
absolutely no cost to you . But don't believe us !
Ms Jones who resides in Georgia tried us and says "Now
I'm rich, Rich, RICH" ! We assure you that we operate
within all applicable laws ! You have no reason not
to act now . Sign up a friend and you get half off
. Warmest regards ! Dear Colleague ; We know you are
interested in receiving breath-taking news ! If you
no longer wish to receive our publications simply reply
with a Subject: of "REMOVE" and you will immediately
be removed from our database ! This mail is being sent
in compliance with Senate bill 2716 ; Title 1 ; Section
309 . This is NOT unsolicited bulk mail ! Why work
for somebody else when you can become rich within 86
months ! Have you ever noticed the baby boomers are
more demanding than their parents and people love convenience
! Well, now is your chance to capitalize on this .
We will help you sell more & deliver goods right to
the customer's doorstep ! You can begin at absolutely
no cost to you . But don't believe us . Ms Jones who
resides in Pennsylvania tried us and says "I've been
poor and I've been rich - rich is better" ! This offer
is 100% legal ! Don't delay - order today . Sign up
a friend and your friend will be rich too . Thanks
. Dear Friend , We know you are interested in receiving
cutting-edge information ! If you are not interested
in our publications and wish to be removed from our
lists, simply do NOT respond and ignore this mail .
This mail is being sent in compliance with Senate bill
1622 , Title 1 , Section 303 . THIS IS NOT A GET RICH
SCHEME . Why work for somebody else when you can become
rich within 11 days ! Have you ever noticed people
are much more likely to BUY with a credit card than
cash and nearly every commercial on television has
a .com on in it ! Well, now is your chance to capitalize
on this . We will help you process your orders within
seconds plus process your orders within seconds ! You
can begin at absolutely no cost to you . But don't
believe us ! Prof Jones of Nebraska tried us and says
"I was skeptical but it worked for me" . We are licensed
to operate in all states . Do not go to sleep without
ordering . Sign up a friend and you get half off !
Warmest regards .
We feed google with the first line of this text and find some information about hidden messages in commercials and a link to a website which can extract this messages. We paste the commercial text into the textfield from this site and get the hidden message and the containing flag.
Your flag is H564FD06941E352A453CA46346DD56701940