## Description* **Name:** [Zippy](https://ctf.utsacyber.com/challenges#Zippy)* **Artifact:** https://ctf.utsacyber.com/files/9027efdab1df3e4f4a894900c27b7bea/flag.zip* **Points:** 50* **Tag:** Forensics


## Tools* Firefox Version 60.5.1 https://www.mozilla.org/en-US/firefox/60.5.1/releasenotes/* [N]Curses Hexedit 0.9.7 http://www.rogoyski.com/adam/programs/hexedit/* UnZip 6.00 http://infozip.sourceforge.net/UnZip.html
## WriteupWe are going to unzip the compressed file flag.zip but we get an error. We note that the file signature has been modified
```bashroot@1v4n:~/CTF/CSACTF19/forensics/zippy# file flag.zipflag.zip: Zip archive data, made by v?[0x31e], extract using at least v2.0, last modified Fri Sep 23 13:59:38 2011, uncompressed size 22, method=deflateroot@1v4n:~/CTF/CSACTF19/forensics/zippyD# md5sum flag.zip061cefe907f401befd74f5e582d104ad  flag.ziproot@1v4n:~/CTF/CSACTF19/forensics/zippy_GRANTED# unzip flag.zipArchive:  flag.zipfile #1:  bad zipfile offset (local header sig):  0root@1v4n:~/CTF/CSACTF19/forensics/zippy# hexeditor flag.zipFile: flag.zip                                                                  ASCII Offset: 0x00000000 / 0x000000B9 (%00)  00000000  00 00 00 00  14 00 02 00   08 00 CA 90  7C 4E 2B 7D                                                 ............|N+}00000010  D2 2D 14 00  00 00 16 00   00 00 08 00  1C 00 66 6C                                                 .-............fl00000020  61 67 2E 74  78 74 55 54   09 00 03 6B  53 9D 5C 6B                                                 ag.txtUT...kS.\k00000030  53 9D 5C 75  78 0B 00 01   04 E8 03 00  00 04 E8 03                                                 S.\ux...........00000040  00 00 73 0E  76 74 0E 71   AB AE 32 2C  28 A8 8C 07                                                 ..s.vt.q..2,(...00000050  92 20 5C CB  05 00 50 4B   01 02 1E 03  14 00 02 00                                                 . \...PK........00000060  08 00 CA 90  7C 4E 2B 7D   D2 2D 14 00  00 00 16 00                                                 ....|N+}.-......00000070  00 00 08 00  18 00 00 00   00 00 01 00  00 00 A4 81                                                 ................00000080  00 00 00 00  66 6C 61 67   2E 74 78 74  55 54 05 00                                                 ....flag.txtUT..00000090  03 6B 53 9D  5C 75 78 0B   00 01 04 E8  03 00 00 04                                                 .kS.\ux.........000000A0  E8 03 00 00  50 4B 05 06   00 00 00 00  01 00 01 00                                                 ....PK..........000000B0  4E 00 00 00  56 00 00 00   00 00                                                                    N...V.....```We modified the [file signature](http://petlibrary.tripod.com/ZIP.HTM) of 00 00 00 00 > 50 4B 03 04 and saved it as flag_repair.zip

```bashFile: flag.zip                                                                  ASCII Offset: 0x00000004 / 0x000000B9 (%02)  M00000000  50 4B 03 04  14 00 02 00   08 00 CA 90  7C 4E 2B 7D                                                 PK..........|N+}00000010  D2 2D 14 00  00 00 16 00   00 00 08 00  1C 00 66 6C                                                 .-............fl00000020  61 67 2E 74  78 74 55 54   09 00 03 6B  53 9D 5C 6B                                                 ag.txtUT...kS.\k00000030  53 9D 5C 75  78 0B 00 01   04 E8 03 00  00 04 E8 03                                                 S.\ux...........00000040  00 00 73 0E  76 74 0E 71   AB AE 32 2C  28 A8 8C 07                                                 ..s.vt.q..2,(...00000050  92 20 5C CB  05 00 50 4B   01 02 1E 03  14 00 02 00                                                 . \...PK........00000060  08 00 CA 90  7C 4E 2B 7D   D2 2D 14 00  00 00 16 00                                                 ....|N+}.-......00000070  00 00 08 00  18 00 00 00   00 00 01 00  00 00 A4 81                                                 ................00000080  00 00 00 00  66 6C 61 67   2E 74 78 74  55 54 05 00                                                 ....flag.txtUT..00000090  03 6B 53 9D  5C 75 78 0B   00 01 04 E8  03 00 00 04                                                 .kS.\ux.........000000A0  E8 03 00 00  50 4B 05 06   00 00 00 00  01 00 01 00                                                 ....PK..........000000B0  4E 00 00 00  56 00 00 00   00 00                                                                    N...V.....
root@1v4n:~/CTF/CSACTF19/forensics/zippy# file flag_repair.zipflag_repair.zip: Zip archive data, at least v2.0 to extractroot@1v4n:~/CTF/CSACTF19/forensics/zippy# md5sum flag_repair.zipeb4264c865a38184cb23836becdf24a7  flag_repair.ziproot@1v4n:~/CTF/CSACTF19/forensics/zippy# unzip flag.zipArchive:  flag.zip  inflating: flag.txt                root@1v4n:~/CTF/CSACTF19/forensics/zippy# cat flag.cat: flag.: No existe el fichero o el directorioroot@1v4n:~/CTF/CSACTF19/forensics/zippy# cat flag.txtCSACTF{z1ppy_z1p_z1p}```### Flag
`CSACTF{z1ppy_z1p_z1p}`