[Forensics] N0Named Wargame 회사 찾기(50p) Write Up

 

N0Named Wargame Forensics 분야 회사 찾기(50p) 문제에 대한 Write Up입니다.

 

[N0Named] Challenge 회사 찾기

 

'FINDAJOB.zip' 파일을 다운로드하고 실행해보니 압축이 풀리지 않는다.

 

먼저, hex 값을 보도록 하자.

 

Hex - FINDAJOB.zip

 

ZIP 파일의 헤더 시그니처는 '50 4B 03 04'이지만, 해당 파일의 헤더 시그니처에 '50 50 03 04'로 장난을 쳐 놓았다.

 

알맞게 수정한 후 압축을 해제하면,

 

여기가 좋겠군!

                  ________            _______
         /N \ N \/_______/     ______/\      \  / \/ /\ \/ /\  \_____________
        /\ \ \ \/______ /     /D    /:\\      \ ::\  /::\  /::{ /____  ____ __
       /\ \ \ \/_______/     /:\\  /:A:\\______\F:/  A::/  \::///   / /   //
      /\ \ \ \/_______/    _/____\/:\:\:/_____ / / /\ \/ /\ \///___/ /___//___
_____/___ \ \/_______/    /\::::::\M:\:/_____ / \ /::\  /::\ /____  ____  ____
         \ \/_______/    /:\\::::::\\:/_____ /   \\::/  \::///   / /   / /   /
          \/_______/    /:\:\\______\/______/_____\\/ /\ \///___/ /___/ /_____
\          \______/    /:\:\:I_____:/\      \ ___ /  /::\ /____  ____  _/\::::
\\__________\____/    /:\:\:/_____:/:\\      \__ /_______/____/_/___/_ /  \:::
//__________/___/   _/____:/_____:/:\:\\______\ /                     /\  /\::
///\          \/   /\ .----.\___:/:\:\:/_____ // \                   /  \/  \:
///\\          \  /::\\ \_\ \\_:/:\:\:/_____ //:\ \                 /\  /\  /\
//:/\\          \//\::\\ \ \ \\/:\:\:/_____ //:::\ \               /  \/  \/+/
/:/:/\\_________/:\/:::\`----' \\:\:/_____ //o:/\:\ \_____________/\  /\  / /
:/:/://________//\::/\::L_______\\:/_____ ///\_\ \:\/____________/  \/  \/+/\
/:/:///_/_/_/_/:\/::\ \:/__  __ /:/_____ ///\//\\/:/ _____  ____/\  /\  / /  \
:/:///_/_/_/_//\::/\:\///_/ /_//:/______/_/ :~\/::/ /____/ /___/  \/  \/+/\  /
/:///_/_/_/_/:\/::\ \:/__  __ /:/____/\  / \Y:\/:/ _____  ____/\  /\  / /  \/
:///_/_/_/_//\::/\:\///_/ /_//:/____/\:\____\\::/ /____/ /___/  \/  \/+/\  /\
///_/_/_/_/:\/::\ \:/__  __ /:L____/\:\/____/\\/____________/\  /\  / /  \/  \
//_/_/_/_//\::/\:\///_/ /_//::::::/\:\/____/  /----/----/--/  \/  \/+/\  /\  /
/_/_/_/_/:\/::\ \:/__  __ /\:::::/\:\/____/ \/____/____/__/\  /\  / /  \/  \/_
_/_/_/_//\::/\:\///_/ /_//\:\::::\:\/____/ \_I___________/  \/  \/+/\  /\  /
/_/_/_/:\/::\ \:/__  __ /\:\:\::::\/____/   \ _ _ _ _ _ /\  /\  / /  \/  \/___
_/_/_//\::/\:\///_/ /_//\:\:\:\              \_________/  \/  \/+/\  /\  /   /
/_/_/:\/::\ \:/__  __ /\:\:\:\:\______________\       /\  /\  / /  \/  \/___/_
_/_//\::/\:\///_/ /_//::\:\:\:\/______________/      /  \/  \/+/\  /\  /   /
/_/:\/::\ \:/__  __ /::::\:\:\/______________/\     /\  /\  / /  \/  \/___/___
_//\::/\:\///_/ /_//:\::::\:\/______________/  \   /  \/  \/+/\  /\  /   /   /
/:\/::\ \:/__  __ /:\:\::::\/______________/    \ /\  /\  / /  \/  \/___/___/
/\::/\:\///_/ /_//:\:\:\                         \  \/\\\/+/\  /\  /   /   /+/
K/::\ \:/__  __ /:\:\:\:\_________________________\ ///\\\/  \/  \/___/___/ /_
::/\:\///_/ /_//:\:\:\:\/_________________________////::\\\  /\  /   /   /+/
::\ \:/__  __ /:\:\:\:\/_________________________/:\/____\\\/  E/___/___/ /___
/\:\///_/ /_//:\:\:\:\/_________________________/:::\    /\/\  /   /   /+/   /
\ \:/__  __ /:\:\:\:\/_________________________/:::::\  ///  \/___/___/ /___/_
:\//C_O /_//:\:\:\:\/_________________________/:\:::::\///\  /   /  __________
\:/__  __ /:\:\:\:\/_________________________/:::\:::::\/  \/___/__/\
///_/ /_//:\:\:M:\/_________________________/:\:::\:::::\  /   /  /::\
/__  __ /\::\:\:\/_________________________/_____::\:::::\/___/__/:/\:\
/_/ /_//::\::\:\/_____________________/\/_/_/_/P/\  \           /::\ \:\
_  __ /:\::\:8\/_____________________/\/\   /\_\\/\  \ 8       /:/\:\ \:\
/ /_//A     \|______________________//\N/\::\/__\\/\  \|______/::\ \:\ \:\
 __ /  \  \                        /:\/:\/\_______\/\        /:/\:\ \:\/::\
/_//    8      -8  --  --  --  -- //\::/\\/_/_/_/_/_/ --  --/::\ \:\ \::/\:\
_ /     |\  \   |________________/:\/::\///__/ /__//_______/:/\:\ \:\/::\ \:\
__________\     \               //\::/\:/___  ___ /       /::\ \:\ \::/\:\ \:\
::::::::::\\  \  \             /:\/::\///__/ /__//       /:/\:\ Y:\/::\ \:\ \:}

 

뭐.. 이런 방대한 그림?같은 문자열이 나오는데 중괄호와 대문자만 두고 모두 필터링하면 플래그가 출력된다.

 

Flag : NND{AFAMILYLIKECOMP88AN88Y}