2019 Stonecutters - The Bus that Couldn't Slow Down
# convert -coalesce qr.gif out.png
Then, we needed a CLI tool that would read each QR code and append the text to a file.
For that task, we found and used zbarimg.
To install: # apt-get install zbar-tools
Then, we tested it by reading the out-82.png file which looked like this:
# zbarimg out-82.png
QR-Code:0L+AjS39CixqeFrAAAAAElFTkSuQmCC
scanned 1 barcode symbols from 1 images in 0.07 seconds
The help information for zbarimg informed us that we could clean up the output by using the --raw and -q options to remove the "QR-Code:" prefix as well as the timing information.
To produce a file that contained all of the strings, we used the following for-loop:
# for i in {0..82}; do zbarimg --raw -q out-$i.png >> qr.txt;done
Then, we removed all of the new lines from the output file to make it one long line with the following command:
# sed ':a;N;$!ba;s/\n//g' qr.txt
The output looked like base64 encoded data, and though we could have easily piped it to base64 -d -w0, we expected a more CTFy challenge with multiple encoding types so we pasted the base64 blob into Cyberchef and decoded it. The output looked like this:
.PNG
.
...
IHDR... ... .....ó.;Å....IDATx.í.KvâH.EI3À3.
<SNIP>
The magic bytes indicated that this was a PNG file with no other encoding/encryption done to it, so we used Cyberchef's save output feature to obtain the final image:
QR-Code:flag{Look into my QR codes. You are getting sleepy. Sleepy. Sleeeeeeeeepy.}
scanned 1 barcode symbols from 1 images in 0.08 seconds
Though this was an easier challenge, it is important to note that QR codes coupled with command line tools can impact offensive security tests in a meaningful way. For example using them to circumvent DLP solutions, bridge air-gapped systems, or to add a twist to a social-engineering campaign. A CTF challenge like this can get the creative juices flowing!
Thanks for reading!
@strupo_
Find us on Twitter: @teamWTG