# Sharif University CTF 2016 : Kick Tort Teen
**Category:** Forensics**Points:** 50**Solves:** 120**Description:**
> Anagram, anyone?>> Download [data.xls](./data.xls)
## Write-up
by [Jashan Bhoora](https://github.com/jashanbhoora)
Upon opening the Excel file we are given, we are presented with a 23x14747 spreadsheet of integers.I notice the Excel warning that Macros have been disabled, so I open the Macro Editor (Alt + F11) and find the following macro.
```VBAFunction FileExists(ByVal FileToTest As String) As Boolean   FileExists = (Dir(FileToTest) <> "")End FunctionSub DeleteFile(ByVal FileToDelete As String)   If FileExists(FileToDelete) Then 'See above      SetAttr FileToDelete, vbNormal      Kill FileToDelete   End IfEnd SubSub DoIt()    Dim filename As String    filename = Environ("USERPROFILE") & "\fileXYZ.data"    DeleteFile (filename)
    Open filename For Binary Lock Read Write As #2    For i = 1 To 14747        For j = 1 To 23            Put #2, , CByte((Cells(i, j).Value - 78) / 3)        Next    Next
    Put #2, , CByte(98)    Put #2, , CByte(13)    Put #2, , CByte(0)    Put #2, , CByte(73)    Put #2, , CByte(19)    Put #2, , CByte(0)    Put #2, , CByte(94)    Put #2, , CByte(188)    Put #2, , CByte(0)    Put #2, , CByte(0)    Put #2, , CByte(0)
    Close #2End Sub```
I haven't done any VBA, but I figure it's writing a file to the Windows environment variable `%USERPROFILE%`.I enable and run the macro, and upon checking `%USERPROFILE%` I find `fileXYZ.data`
Analysing under Ubuntu:
```file fileXYZ.datafileXYZ.data: ELF 64-bit LSB  executable, x86-64, version 1 (GNU/Linux), statically linked, stripped
chmod +x fileXYZ.data./fileXYZ.dataSharifCTF{5bd74def27ce149fe1b63f2aa92331ab}```And there's the flag!
Flag: SharifCTF{5bd74def27ce149fe1b63f2aa92331ab}
## Other write-ups and resources
* <https://github.com/ctfs/write-ups-2016/tree/master/su-ctf-2016/forensics/kick-tort-teen-50>* [0x90r00t](https://0x90r00t.com/2016/02/07/sharif-university-ctf-2016-forensic-50-kick-tort-teen-write-up/)* [P4 Team](https://github.com/p4-team/ctf/tree/master/2016-02-05-sharif/for_50_tort#eng-version)* <https://github.com/QuokkaLight/write-ups/blob/master/sharif-university-ctf-2016/forensics/Kick_Tort_Teen.md>* <https://github.com/smokeleeteveryday/CTF_WRITEUPS/tree/master/2016/SHARIFCTF/forensics/kick_tort_teen>