# Curiosity Helped the Cat - Forensics

## Task

In the relentless pursuit to reclaim Anthony's stolen invention, we've meticulously sifted through the digital ether, finding a PNG file adorned with whimsical felines. Suspicions now converge upon Alex, a shadowy figure lurking within the depths of cyberspace, his motives shrouded in secrecy.

## Solution

We get a `cats.png` file:

```
zczygielka@hacks$ file cats.png 
cats.png: PNG image data, 665 x 1182, 8-bit/color RGBA, non-interlaced
```

Searching for the flag I noticed a string `CAPTAINCASHMONEY`:

```
szczygielka@hacks$ strings -a -n 6 cats.png 
zTXtRaw profile type exif
iCCPICC profile
a%Y%>'
3#f&=O
<SNIP>
4:3M(0EP
SFX(D6
$-+(e_7
!.683V3-
CAPTAINCASHMONEY
```

After opening the `cats.png` image in StegSolve and use Alpha plane 2 we get the flag, but it is not in the flag format which is RS{}:

<figure><img src="https://1764482864-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsK05LA2NAjKs68dl8qHP%2Fuploads%2F25nkPBmwU1eVVwYP3FhT%2Fimage.png?alt=media&#x26;token=8ab0f35d-e847-44b0-adfc-2a9e95414001" alt="" width="331"><figcaption></figcaption></figure>

Since I had found a suspicious string, I decided to use it as a key to try to decrypt the flag. First I used the Vigenere Cipher decryptor from [here](https://www.dcode.fr/vigenere-cipher). After limiting the alphabet only to letters and providing `CAPTAINCASHMONEY` as a key, we get the flag:

<figure><img src="https://1764482864-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FsK05LA2NAjKs68dl8qHP%2Fuploads%2FE58pm0rBlq9X24cAIvUu%2Fimage.png?alt=media&#x26;token=506122c6-b532-44c8-ab4d-7f5d68e07025" alt=""><figcaption></figcaption></figure>

Flag:

```
RS{tHe_HaCKer_TeRMiNAL}
```