# MacroHard WeakEdge
Category: Forensics AUTHOR: MADSTACKS
**Diclaimer! None of the challenge files are mine!**
## Description```I've hidden a flag in this file. Can you find it? Forensics is fun.pptm```
## PowerPoint
Now, here's the thing. If you've done `Weird File` (writeup [here](https://github.com/xnomas/PicoCTF-2021-Writeups/tree/main/Weird_File)) you already know that a PowerPoint file can be unzipped and it's contents looked through! Also, we have a big hint in the name of this challenge `Macro`. And to prove this, just run `binwalk`:```root@kali:~/CTFs/Picoctf-2021/macrohard_weakedge-solved# binwalk Forensics\ is\ fun.pptm 
DECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------0             0x0             Zip archive data, at least v2.0 to extract, compressed size: 674, uncompressed size: 10660, name: [Content_Types].xml1243          0x4DB           Zip archive data, at least v2.0 to extract, compressed size: 259, uncompressed size: 738, name: _rels/.rels2063          0x80F           Zip archive data, at least v2.0 to extract, compressed size: 951, uncompressed size: 5197, name: ppt/presentation.xml3064          0xBF8           Zip archive data, at least v2.0 to extract, compressed size: 189, uncompressed size: 311, name: ppt/slides/_rels/slide46.xml.rels3316          0xCF4           Zip archive data, at least v2.0 to extract, compressed size: 688, uncompressed size: 1740, name: ppt/slides/slide1.xml4055          0xFD7           Zip archive data, at least v2.0 to extract, compressed size: 657, uncompressed size: 1681, name: ppt/slides/slide2.xml4763          0x129B          Zip archive data, at least v2.0 to extract, compressed size: 659, uncompressed size: 1681, name: ppt/slides/slide3.xml5473          0x1561          Zip archive data, at least v2.0 to extract, compressed size: 657, uncompressed size: 1682, name: ppt/slides/slide4.xml6181          0x1825          Zip archive data, at least v2.0 to extract, compressed size: 658, uncompressed size: 1682, name: ppt/slides/slide5.xml......43914         0xAB8A          Zip archive data, at least v2.0 to extract, compressed size: 657, uncompressed size: 1681, name: ppt/slides/slide58.xml44623         0xAE4F          Zip archive data, at least v2.0 to extract, compressed size: 189, uncompressed size: 311, name: ppt/slides/_rels/slide47.xml.rels...47899         0xBB1B          Zip archive data, at least v2.0 to extract, compressed size: 189, uncompressed size: 311, name: ppt/slides/_rels/slide13.xml.rels48151         0xBC17          Zip archive data, at least v2.0 to extract, compressed size: 646, uncompressed size: 8783, name: ppt/_rels/presentation.xml.rels49122         0xBFE2          Zip archive data, at least v2.0 to extract, compressed size: 192, uncompressed size: 311, name: ppt/slides/_rels/slide1.xml.rels...59700         0xE934          Zip archive data, at least v2.0 to extract, compressed size: 189, uncompressed size: 311, name: ppt/slides/_rels/slide45.xml.rels59952         0xEA30          Zip archive data, at least v2.0 to extract, compressed size: 2063, uncompressed size: 13875, name: ppt/slideMasters/slideMaster1.xml62078         0xF27E          Zip archive data, at least v2.0 to extract, compressed size: 1281, uncompressed size: 4678, name: ppt/slideLayouts/slideLayout1.xml...75061         0x12535         Zip archive data, at least v2.0 to extract, compressed size: 1187, uncompressed size: 4200, name: ppt/slideLayouts/slideLayout11.xml76312         0x12A18         Zip archive data, at least v2.0 to extract, compressed size: 277, uncompressed size: 1991, name: ppt/slideMasters/_rels/slideMaster1.xml.rels76663         0x12B77         Zip archive data, at least v2.0 to extract, compressed size: 188, uncompressed size: 311, name: ppt/slideLayouts/_rels/slideLayout1.xml.rels...79284         0x135B4         Zip archive data, at least v2.0 to extract, compressed size: 188, uncompressed size: 311, name: ppt/slideLayouts/_rels/slideLayout11.xml.rels79547         0x136BB         Zip archive data, at least v2.0 to extract, compressed size: 1732, uncompressed size: 8399, name: ppt/theme/theme1.xml81329         0x13DB1         Zip archive data, at least v1.0 to extract, compressed size: 2278, uncompressed size: 2278, name: docProps/thumbnail.jpeg83660         0x146CC         Zip archive data, at least v2.0 to extract, compressed size: 2222, uncompressed size: 7168, name: ppt/vbaProject.bin85930         0x14FAA         Zip archive data, at least v2.0 to extract, compressed size: 397, uncompressed size: 818, name: ppt/presProps.xml86374         0x15166         Zip archive data, at least v2.0 to extract, compressed size: 387, uncompressed size: 811, name: ppt/viewProps.xml86808         0x15318         Zip archive data, at least v2.0 to extract, compressed size: 172, uncompressed size: 182, name: ppt/tableStyles.xml87029         0x153F5         Zip archive data, at least v2.0 to extract, compressed size: 342, uncompressed size: 666, name: docProps/core.xml87682         0x15682         Zip archive data, at least v2.0 to extract, compressed size: 556, uncompressed size: 3784, name: docProps/app.xml88548         0x159E4         Zip archive data, at least v2.0 to extract, compressed size: 81, uncompressed size: 99, name: ppt/slideMasters/hidden100071        0x186E7         End of Zip archive, footer length: 22
```The output is really big, so I shortened it. Hmm... notice anything peculiar? 
### Extracting and snooping```bashroot@kali:~/CTFs/Picoctf-2021/macrohard_weakedge-solved/writeup# ls'Forensics is fun.pptm'root@kali:~/CTFs/Picoctf-2021/macrohard_weakedge-solved/writeup# 7z x Forensics\ is\ fun.pptm 
7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,3 CPUs Intel(R) Core(TM) i7-8550U CPU @ 1.80GHz (806EA),ASM,AES-NI)
Scanning the drive for archives:1 file, 100093 bytes (98 KiB)
Extracting archive: Forensics is fun.pptm--Path = Forensics is fun.pptmType = zipPhysical Size = 100093
Everything is Ok
Files: 153Size:       237329Compressed: 100093```Awesome! Now we can just look through it.```bashroot@kali:~/CTFs/Picoctf-2021/macrohard_weakedge-solved/writeup# ls -la *-rw-r--r-- 1 root root  10660 Dec 31  1979 '[Content_Types].xml'-rw-r--r-- 1 root root 100093 Mar 30 12:59 'Forensics is fun.pptm'
docProps:total 20drwx------ 2 root root 4096 Mar 30 12:59 .drwxr-xr-x 5 root root 4096 Mar 30 12:59 ..-rw-r--r-- 1 root root 3784 Dec 31  1979 app.xml-rw-r--r-- 1 root root  666 Dec 31  1979 core.xml-rw-r--r-- 1 root root 2278 Dec 31  1979 thumbnail.jpeg
ppt:total 56drwx------ 7 root root 4096 Mar 30 12:59 .drwxr-xr-x 5 root root 4096 Mar 30 12:59 ..-rw-r--r-- 1 root root 5197 Dec 31  1979 presentation.xml-rw-r--r-- 1 root root  818 Dec 31  1979 presProps.xmldrwx------ 2 root root 4096 Mar 30 12:59 _relsdrwx------ 3 root root 4096 Mar 30 12:59 slideLayoutsdrwx------ 3 root root 4096 Mar 30 12:59 slideMastersdrwx------ 3 root root 4096 Mar 30 12:59 slides-rw-r--r-- 1 root root  182 Dec 31  1979 tableStyles.xmldrwx------ 2 root root 4096 Mar 30 12:59 theme-rw-r--r-- 1 root root 7168 Dec 31  1979 vbaProject.bin-rw-r--r-- 1 root root  811 Dec 31  1979 viewProps.xml
_rels:total 12drwx------ 2 root root 4096 Mar 30 12:59 .drwxr-xr-x 5 root root 4096 Mar 30 12:59 ..-rw-r--r-- 1 root root  738 Dec 31  1979 .rels
```Just confirming the file structure that `binwalk` provided. Now! What did you see in tha big output? I saw this: `ppt/vbaProject.bin`, `ppt/slideMasters/hidden`. Time to check these out! 
## Macro (Hard)
```bashroot@kali:~/CTFs/Picoctf-2021/macrohard_weakedge-solved/writeup# strings ppt/vbaProject.bin VBAProjestdole>*\G{00020430-6}#2.0#0#C:\Windows\Syst em32\tlb#OLE AutomatiEOffDic2DF8D04C-5BFA-101B-BDE5gram Files\CommoMicrosoft Shared\OFFICE16\MSO.0DLL#M [email protected] ObLibraryule1Gsorry_but_this_isn't_it...```Oh? It's not? Well no worries, we still have the second file to look through.
## Weak (Edge)
```bashroot@kali:~/CTFs/Picoctf-2021/macrohard_weakedge-solved/writeup# cat ppt/slideMasters/hidden Z m x h Z z o g c G l j b 0 N U R n t E M W R f d V 9 r b j B 3 X 3 B w d H N f c l 9 6 M X A 1 f Q```Riiiight.. well looking at it, this string looks like base64.
## Flag
I just replaced the spaces with nothing in SublimeText. `ZmxhZzogcGljb0NURntEMWRfdV9rbjB3X3BwdHNfcl96MXA1fQ` looks even more like base64, doesn't it?
```bashecho ZmxhZzogcGljb0NURntEMWRfdV9rbjB3X3BwdHNfcl96MXA1fQ | base64 -dflag: picoCTF{D1d_u_kn0w_ppts_r_z1p5}base64: invalid input```Awesome! 