Sticky Note Password Challenge

This was similar to another challenge that was active onsite @ BSidesChicago 2013. I wasn't able to get that one to work, but i was able to get this one to mount.

You are given 3 key things.

1. PNG file
2. youreeitheraoneorazero
3. 80acaf1584dd4730

I used Windows XPSP3, HxD, and TrueCrypt to solve this challenge.

Im sure there is more than one way to do it, please hit me up on twitter > @switchingtoguns

>> Walkthrough

The image looks like this:



Open it up in a hex editor.



Normal PNG files end the file with the IEND chunk, however data may be appended. Search for the IEND tag to see if there is data appended.



There is, copy that out to a new file and save it.



There's not really a good way to identify this as a Truecrypt (TC) container that i am aware of. I tried a few tools and they all failed to id the container. The original challenge was something like 'Truth Tombs' so i had a feeling that it was a truecrypt container.

Truecrypt containers can be opened using keyfiles. I created two txt files and called them file1 and file2. I entered the hex string in one and the 'youreeither...' string in the other. Using one as a keyfile, the other as a pass...both...neither...ramses, etc. I tried MANY combinations and saw this about a billion times.









-__- It haunts my dreams -__-

After much trial and error...the only combination that i was able to get to work was:

1) mount the tc container with only the hexstring as a keyfile. That would fail. Click OK.
2) uncheck the 'use keyfile' checkbox
3) mount the tc container with the password as below...

It complains about a header, but mounts just fine.

Go to my computer and open up the mounted drive to find the flag.




Many thanks to the BSides peeps for putting these fun challenges together.