Google CTF – FLOPPY

Using the credentials from the letter, you logged in to the Foobanizer9000-PC. It has a floppy drive…why? There is an .ico file on the disk, but it doesn’t smell right..

The first thing I did after downloading this icon file was open it up it notepad to see if anything stood out. For some reason there is some text “driver.txt” that shows up twice, that could be a coincidence…but most likely there is another file hiding in here.

I tried copying the file and renaming it as a .zip file – no luck.

Let’s dig in a little deeper…

Using a hex editor, I opened the file so I could look and see if anything else seems out of place.

Looking at the hex, there is a section of all 0’s followed by PK, and then that driver.txt bit from earlier.

I looked up what a PK header meant, and discovered that it is standard for a zip file
https://users.cs.jmu.edu/buchhofp/forensics/formats/pkzip.html

So we now most likely have a zip file hiding in this icon file.

Using my hex editor, I extracted the bits starting and ending with PK and saved them as a new file, foo.ico.zip

After extracting this file, I was able to open it with 7zip and extract the contents

Sure enough, driver.txt has our flag!

CTF{qeY80sU6Ktko8BJW}