# ASIS Cyber Security Contest Finals 2014: Natural algorithm
**Category:** Stego, Recon**Points:** 150**Description:**
> Find flag in the [image](sunflower_2b870888a7b24ca81ff00529550ecd5f).
## Write-up
Let’s see what [the provided file](sunflower_2b870888a7b24ca81ff00529550ecd5f) could be:
```bash$ file sunflower_2b870888a7b24ca81ff00529550ecd5fsunflower_2b870888a7b24ca81ff00529550ecd5f: xz compressed data```
So, we extract the file using the built-in `xz` or `unxz` commands:
* `xz -dc < sunflower_2b870888a7b24ca81ff00529550ecd5f > sunflower`* `unxz < sunflower_2b870888a7b24ca81ff00529550ecd5f > sunflower`
Alternatively, extract the provided file using [p7zip](http://p7zip.sourceforge.net/):
```bash7z x sunflower_2b870888a7b24ca81ff00529550ecd5f```
Let’s find out what the extracted file is:
```bash$ file sunflowersunflower: TIFF image data, little-endian```
Renaming the file to `sunflower.tiff` and opening it in an image viewer reveals a picture of a sunflower (who’d have thought?!). [A reverse image search](https://goo.gl/XVhPvX) shows lots of results regarding [Fibonacci numbers](https://en.wikipedia.org/wiki/Fibonacci_number) in nature.
Maybe we should read each byte from the file whose offset corresponds to a Fibonacci number? Let’s see what happens if we do that:
```python#!/usr/bin/env python# coding=utf-8import os
file_path = 'sunflower.tiff'file_size = os.stat(file_path).st_sizef = open(file_path, 'rb')
current_offset = 1next_offset = 1result = ''while next_offset <= file_size:  current_offset, next_offset = next_offset, current_offset + next_offset  f.seek(current_offset)  result += f.read(1)print result```
Running the above Python script prints:
```I*. ASIS_md5(Fib[10^6])```
So, we need to figure out what the `10^6`th Fibonacci number is, then calculate its MD5 hash. Luckily, we don’t have to compute this number ourselves — there is [a website dedicated to it](http://www.upl.cs.wisc.edu/~bethenco/fibo/)!
Copying the number from there and removing all line breaks should result in [a very long string](https://gist.githubusercontent.com/anonymous/e787672f2f174db5e9cd/raw/2dca7ad19e560fafb5f5d4f8a1246a983891cf16/fibonacci-1000000.txt) with MD5 hash `e73d27576c4f40d414d9f666c3c79554`.
The flag is `ASIS_e73d27576c4f40d414d9f666c3c79554`.
## Other write-ups and resources
* none yet