# Hydra![image](img.png)We got this png file of a hydra. The size of 5,1 MB tells that it is more than meets the eye.Running `strings` on it reveals at bunch of stuff:```LINUX                           CDROM                                                                                                                                                                                                                                                                                                                                                                                                GENISOIMAGE ISO 9660/HFS FILESYSTEM CREATOR (C) 1993 E.YOUNGDALE (C) 1997-2006 J.PEARSON/J.SCHILLING (C) 2006-2007 CDRKIT TEAM                                                                                                                 2019051714090300201905171409030000000000000000002019051714090300
CD001BEA01NSR02TEA01CDROM5CDEA45F00000F97OSTA Compressed UnicodeOSTA Compressed Unicode*genisoimage*UDF LV InfoOSTA Compressed UnicodeCDROM*genisoimage+NSR02*genisoimageOSTA Compressed UnicodeCDROM*OSTA UDF Compliant*genisoimageCDROM5CDEA45F00000FE0OSTA Compressed UnicodeOSTA Compressed Unicode*genisoimage*UDF LV InfoOSTA Compressed UnicodeCDROM*genisoimage+NSR02*genisoimageOSTA Compressed UnicodeCDROM*OSTA UDF Compliant*genisoimage*genisoimageOSTA Compressed UnicodeCDROMOSTA Compressed UnicodeCDROM*OSTA UDF Compliant*genisoimageflag.txt*genisoimageFLAG.TXT;1Looking for flag....%PDF1337.pdfExif7/j{TG-m%%EOFIEND```
Okay so the file is fishy and running `foremost` on it gives the following output:```$ tree.├── audit.txt├── gif│   └── 00008375.gif└── png    └── 00008369.png```
The png file could be opened and gave![pngfile](pngfile.png)The gif file could not be opened so we tried to dig deeper in it.We spent a lot of time trying to get something useful out of the gif file with multiple tools until we realised that we had neglected the png file.
Running strings on it revelead this funny thing:
```
<x:xmpmeta xmlns:x='adobe:ns:meta/' x:xmptk='Image::ExifTool 10.80'><rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'> <rdf:Description rdf:about=''  xmlns:dc='http://purl.org/dc/elements/1.1/'>  <dc:rights>   <rdf:Alt>    <rdf:li xml:lang='x-default'>Copyright</rdf:li>   </rdf:Alt>  </dc:rights> </rdf:Description></rdf:RDF></x:xmpmeta>
IEND```Aha, exiftool meaning metadata in the file!
Running exiftool gave:```exiftool png/00008369.pngExifTool Version Number         : 11.01File Name                       : 00008369.pngDirectory                       : pngFile Size                       : 2.6 kBFile Modification Date/Time     : 2019:05:24 20:38:18+02:00File Access Date/Time           : 2019:05:24 20:41:45+02:00File Inode Change Date/Time     : 2019:05:24 20:38:18+02:00File Permissions                : rw-r--r--File Type                       : PNGFile Type Extension             : pngMIME Type                       : image/pngImage Width                     : 282Image Height                    : 120Bit Depth                       : 8Color Type                      : PaletteCompression                     : Deflate/InflateFilter                          : AdaptiveInterlace                       : NoninterlacedPalette                         : (Binary data 210 bytes, use -b option to extract)Transparency                    : 0Copyright Notice                : frps{Fj0eqs15u_sy4t_u1qq3a_1a_z3g4}Application Record Version      : 4XMP Toolkit                     : Image::ExifTool 10.80Rights                          : CopyrightImage Size                      : 282x120Megapixels                      : 0.034```
The copyright notice looks like the flag but it is scrambeled.Testing with regular rot13 gave the flag:`secf{Sw0rdf15h_fl4g_h1dd3n_1n_m3t4}`
Nice forensic challenge!
Takeaways:* always test all files* understand the joke