KnightCTF 2022

Unzip Me – MISC Challenge Writeup | KnightCTF 2022

Analysis

When opening the provided file in a hex editor, the header did not look like a normal ZIP signature 50 4B 03 04 Instead, the bytes appeared swapped, showing 4B 50 04 03 This indicated that the file had been saved with wrong endianness.

Fix

The quickest way to repair this is with CyberChef:

  1. Use the Swap Endianness operation.
  2. Set the size to 2 (RAW mode), since the file was swapped in 2-byte chunks.
  3. Export the result as a new file.

After applying this transformation, the file opens as a valid ZIP and reveals a flag.txt.

0 people love this