DaVinci

Challenge details

Name	Da Vinci
Hint	Try to find the secret hiding inside these pictures and learn the truth about Mona Lisa!
Difficulty	Easy - Retired [0]
Rated difficulty
First blood	D3s0late
Creator	nickvourd

We are presented with three files:

monalisa.jpg
plans.jpg
Thepassword_is_the_small_name_of_the_actor_named_Hanks.jpg

Looking at the title of the last picture and the picture itself, we can guess that the password is TOM.

$ steghide extract -sf Thepassword_is_the_small_name_of_the_actor_named_Hanks.jpg
Enter passphrase: TOM
wrote extracted data to "[email protected]"

$ cat [email protected]
Hey Filippos,
This is my secret key for our folder.... (key:020e60c6a84db8c5d4c2d56a4e4fe082)
I used an encryption with 32 characters. hehehehehe! No one will find it! ;)
Decrypt it... It's easy for you right?
Don't share it with anyone...plz!

if you are reading that, call me!
I need your advice for my new CTF challenge!

Kisses,
-Luc1f3r

We have an MD5 string, 020e60c6a84db8c5d4c2d56a4e4fe082. Throwing it into CrackStation reveals leonardo.

Examining monalisa.jpg with strings exposes Mona.jpg and famous.zip. Running strings against Plans.jpg reveals a YouTube link.

Now that we know there are two files inside the Mona Lisa, let's run binwalk.

$ binwalk -e monalisa.jpg

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             JPEG image data, JFIF standard 1.01
450363        0x6DF3B         Zip archive data, name: famous.zip
450440        0x6DF88         Encrypted Zip archive data, name: Mona.jpg
568411        0x8AC5B         End of Zip archive
568537        0x8ACD9         End of Zip archive

This extracts famous.zip. Unzip it with the leonardo password, then extract data from the new Mona.jpg using steghide. TOM and leonardo don't work, so we try the name of the YouTube video: Guernica. Success.

$ steghide extract -sf Mona.jpg
Enter passphrase: Guernica
wrote extracted data to "key".

$ cat key
VTBaU1EyVXdNSGRpYTBKbVZFUkdObEZHT0doak1UbEZUVEJDUldaUlBUMD0=

$ echo 'U0ZSQ2UwMHdia0JmVERGNlFGOGhjMTlFTTBCRWZRPT0=' | base64 -d
SFRCe00wbkBfTDF6QF8hc19EM0BEfQ==

$ echo 'SFRCe00wbkBfTDF6QF8hc19EM0BEfQ==' | base64 -d

With those Base64 decodes finished, so is this challenge. Onwards and upwards!