# Luna
We are given a [tar archive](Luna.tar.xz). Let's extract it.
```$ tar xf Luna.tar.xz```
Upon extraction, we find two new files:
```$ ls 1.png Luna.tar.xz'so you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon.zip'```
We have an image, and a zip with a strangely long name.
I attempted to unzip the file, but it seems like it needs a password:
```Archive:  so you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon.zip[so you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon.zip] jut password:```
I figured that the password has to be somewhere in the image, so I took a look.
When I opened the image, it was just a white square. I ran `file` on the image to see the specifics:
```$ file 1.png1.png: PNG image data, 300 x 300, 8-bit/color RGB, non-interlaced```
I also ran strings on it to see if there was a password in it somewhere.
```$ strings 1.pngIHDRzTXtRaw profile type exifv,z}O$k[F5<es1.R&dR6"~,94TU4e3s+V]<aaTvfzTXtRaw profile type iptcRiTXtXML:com.adobe.xmp
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 4.4.0-Exiv2"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">  <rdf:Description rdf:about=""    xmlns:iptcExt="http://iptc.org/std/Iptc4xmpExt/2008-02-29/"    xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/"    xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#"    xmlns:plus="http://ns.useplus.org/ldf/xmp/1.0/"    xmlns:DICOM="http://ns.adobe.com/DICOM/"    xmlns:GIMP="http://www.gimp.org/xmp/"    xmlns:dc="http://purl.org/dc/elements/1.1/"    xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/"    xmlns:xmp="http://ns.adobe.com/xap/1.0/"   iptcExt:DigitalSourceType="http://cv.iptc.org/newscodes/digitalsourcetype/softwareImage"   xmpMM:DocumentID="gimp:docid:gimp:456e1492-77c3-4f45-92c3-edd0541a4413"   xmpMM:InstanceID="xmp.iid:3e22a217-d4a0-422b-9bc6-58f60eddf54d"   xmpMM:OriginalDocumentID="xmp.did:cc8dad5e-07b5-4920-9533-fc26a32b80f0"   plus:ModelReleaseStatus="http://ns.useplus.org/ldf/vocab/MR-NON"   DICOM:StudyPhysician="awcIsALegendAndIHopeThisIsAStrongPasswordJackTheRipperBegone"   GIMP:API="2.0"   GIMP:Platform="Linux"   GIMP:TimeStamp="1584748572978367"   GIMP:Version="2.10.18"   dc:Format="image/png"   photoshop:CaptionWriter="j00t"   photoshop:DateCreated="2020-03-20"   xmp:CreatorTool="GIMP 2.10"   xmp:Rating="5">   <iptcExt:LocationCreated>    <rdf:Bag/>   </iptcExt:LocationCreated>   <iptcExt:LocationShown>    <rdf:Bag/>   </iptcExt:LocationShown>   <iptcExt:ArtworkOrObject>    <rdf:Bag/>   </iptcExt:ArtworkOrObject>   <iptcExt:RegistryId>    <rdf:Bag/>   </iptcExt:RegistryId>   <iptcExt:PersonInImage>    <rdf:Bag>     <rdf:li>type="Bag" jutin</rdf:li>    </rdf:Bag>   </iptcExt:PersonInImage>   <xmpMM:History>    <rdf:Seq>     <rdf:li      stEvt:action="saved"      stEvt:changed="/metadata"      stEvt:instanceID="xmp.iid:967142e5-a3e0-4326-8335-bbe854fe7477"      stEvt:softwareAgent="Gimp 2.10 (Linux)"      stEvt:when="-04:00"/>     <rdf:li      stEvt:action="saved"      stEvt:changed="/"      stEvt:instanceID="xmp.iid:8b519cd0-a1e9-41f7-ae1b-5b66b66b699e"      stEvt:softwareAgent="Gimp 2.10 (Linux)"      stEvt:when="-04:00"/>     <rdf:li      stEvt:action="saved"      stEvt:changed="/metadata"      stEvt:instanceID="xmp.iid:b7345da5-469a-491b-86b2-ad14b96f1132"      stEvt:softwareAgent="Gimp 2.10 (Linux)"      stEvt:when="-04:00"/>     <rdf:li      stEvt:action="saved"      stEvt:changed="/metadata"      stEvt:instanceID="xmp.iid:69b7dcf5-be9f-446d-8614-9ddda3bded58"      stEvt:softwareAgent="Gimp 2.10 (Linux)"      stEvt:when="-04:00"/>     <rdf:li      stEvt:action="saved"      stEvt:changed="/"      stEvt:instanceID="xmp.iid:f39a3ecb-64e6-4b8b-98f1-fcb5eb4e1539"      stEvt:softwareAgent="Gimp 2.10 (Linux)"      stEvt:when="-04:00"/>    </rdf:Seq>   </xmpMM:History>   <plus:ImageSupplier>    <rdf:Seq/>   </plus:ImageSupplier>   <plus:ImageCreator>    <rdf:Seq/>   </plus:ImageCreator>   <plus:CopyrightOwner>    <rdf:Seq/>   </plus:CopyrightOwner>   <plus:Licensor>    <rdf:Seq/>   </plus:Licensor>   <dc:description>    <rdf:Alt>     <rdf:li xml:lang="x-default">oops, all #FFD2A4#</rdf:li>    </rdf:Alt>   </dc:description>  </rdf:Description> </rdf:RDF></x:xmpmeta>
iCCPICC profileQp-8Xupq; X+1n5k1  J|N<jf*9O,q,bbKGD	pHYstIMEvIDATx`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!`B0!IEND```
I examined the output, and I found it.
```DICOM:StudyPhysician="awcIsALegendAndIHopeThisIsAStrongPasswordJackTheRipperBegone"```
The password was in plain text!
```awcIsALegendAndIHopeThisIsAStrongPasswordJackTheRipperBegone```
I extracted the zip with that password, and I got two more files:
```Archive:  so you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon.zip[so you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon and you take the moon.zip] jut password:  inflating: jut                       inflating: Just In Case.png```
Here's the image from that extraction:
![](just-in-case.png)
It looks like a screenshot from GIMP. No idea what that's about.
Moving on. Let's look at jut.
I ran `binwalk` on that file, and I found this:
```$ binwalk jut
DECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------45            0x2D            Zlib compressed data, best compression```
Looks like it uses zlib compression. Let's extract it!
```$ dd if=jut bs=1 skip=45 of=arch.zlib17893+0 records in17893+0 records out17893 bytes (18 kB, 17 KiB) copied, 0.0473859 s, 378 kB/s```
To double-check that it's zlib, I ran the file utility on it to double-check:
```$ file arch.zlibarch.zlib: zlib compressed data```
Sure enough, it's zlib.
I used `zlib-flate` to decompress it, and then I piped the output to a file.
```$ (zlib-flate -uncompress < arch.zlib) > uncompressed```
I ran binwalk on it, but with no success.
```$ binwalk uncompressed
DECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------
```
So then I ran the file utility again, and it seems to be ASCII text.
```$ file uncompresseduncompressed: ASCII text```
I ran `more` on it to have a look inside, and it looks like hex!
```$ more uncompressed
exif    536445786966000049492a00080000000a0000010400010000002c01000001010400010000002c0100000201030003000000860000001a010500010000008c0000001b0105000100000094000000280103000100000003000000310102000d0000009c0000003201020014000000aa0000006987040001000000be0000002588040001000000d000000032010000080008000800fc2900005b000000fc2900005b00000047494d5020322e31302e31380000323032303a30333a32302031393a30343a313700010001a0030001000000010000000000000003000200050003000000fa00000004000500030000001201000006000500010000002a01000000000000000000000100000000000000010000000000000001000000000000000100000000000000010000000000000001000000000000000a000000080000010400010000000001000001010400010000000001000002010300030000009801000003010300010000000600000006010300010000000600000015010300010000000300000001020400010000009e01000002020400010000005013000000000000080008000800ffd8ffe000104a46494600010100000100010000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080100010003012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f5aa28a2bc33d70a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a5009e809fa530128a52a57a823ea292800a28a29005145140051451400514514005145140051451```
I used nano to edit out the beginning part. It wasn't valid hex.
New file looks like this:
```$ more uncompressed45786966000049492a00080000000a0000010400010000002c01000001010400010000002c0100000201030003000000860000001a010500010000008c0000001b0105000100000094000000280103000100000003000000310102000d0000009c0000003201020014000000aa0000006987040001000000be0000002588040001000000d000000032010000080008000800fc2900005b000000fc2900005b00000047494d5020322e31302e31380000323032303a30333a32302031393a30343a313700010001a0030001000000010000000000000003000200050003000000fa00000004000500030000001201000006000500010000002a01000000000000000000000100000000000000010000000000000001000000000000000100000000000000010000000000000001000000000000000a000000080000010400010000000001000001010400010000000001000002010300030000009801000003010300010000000600000006010300010000000600000015010300010000000300000001020400010000009e01000002020400010000005013000000000000080008000800ffd8ffe000104a46494600010100000100010000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080100010003012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f5aa28a2bc33d70a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a2800a28a5009e809fa530128a52a57a823ea292800a28a2900514514005145140051451400514514005145140051451400a0e181c6707a569df4117d904b122af43903b1acbad8b6ff48d3761ebb4ad74e1d292947c8c2b3716a463d6869b023891e450c071c8acfe95a89fb8d249eee3f9ff00f5aa6825cd77d0aacfddb2ea43a940b1488c8a1548e80551ad4b9fdfe991c9dd719fe559```
I then used `xxd` to convert the hex to bytes and them I dumped it into a file:
```$ cat uncompressed | xxd -r -p > hex_decoded```
Running `binwalk` on that shows that theres a `JPEG` hiding in there! :O
```$ binwalk hex_decoded
DECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------6             0x6             TIFF image data, little-endian offset of first image directory: 8420           0x1A4           JPEG image data, JFIF standard 1.01```
It might be the flag, let's check it out.
I used `dd` again to get the `JPEG` image:
```$ dd if=hex_decoded bs=1 skip=420 of=flag.jpg4944+0 records in4944+0 records out4944 bytes (4.9 kB, 4.8 KiB) copied, 0.0169934 s, 291 kB/s```
And sure enough when you open it, it's the flag!
![](flag.jpg)
Flag: `WPI{M00N_mOOn}`