Curiosity Helped the Cat - Forensics

Task

In the relentless pursuit to reclaim Anthony's stolen invention, we've meticulously sifted through the digital ether, finding a PNG file adorned with whimsical felines. Suspicions now converge upon Alex, a shadowy figure lurking within the depths of cyberspace, his motives shrouded in secrecy.

Solution

We get a cats.png file:

zczygielka@hacks$ file cats.png 
cats.png: PNG image data, 665 x 1182, 8-bit/color RGBA, non-interlaced

Searching for the flag I noticed a string CAPTAINCASHMONEY:

szczygielka@hacks$ strings -a -n 6 cats.png 
zTXtRaw profile type exif
iCCPICC profile
a%Y%>'
3#f&=O
<SNIP>
4:3M(0EP
SFX(D6
$-+(e_7
!.683V3-
CAPTAINCASHMONEY

After opening the cats.png image in StegSolve and use Alpha plane 2 we get the flag, but it is not in the flag format which is RS{}:

Since I had found a suspicious string, I decided to use it as a key to try to decrypt the flag. First I used the Vigenere Cipher decryptor from here. After limiting the alphabet only to letters and providing CAPTAINCASHMONEY as a key, we get the flag:

Flag:

RS{tHe_HaCKer_TeRMiNAL}

Last updated