FCSC 2021 - Intro - Dérèglement

One-minute read
writeup
fcsc • intro • forensics
Table of contents :

A problem was encountered while writing the policy and the Microsoft Office format file is corrupted. You have to find its content to get the flag.

SHA256(2021-fcsc-reglement_de_participation.docx) = 7538e4b5a4b392e6810e1bd6360dcf000424cf66c6b1dcc8f296751785c1b020.

Files :

Solving the challenge

DOCX files are zip files containing the XML files making up the document as well as its attached files (images, files, etc.). We will therefore unzip it like this:

$ cp 2021-fcsc-reglement_de_participation.docx 2021-fcsc-reglement_de_participation.zip
$ unzip 2021-fcsc-reglement_de_participation.zip
Archive:  2021-fcsc-reglement_de_participation.zip
  inflating: [Content_Types].xml     
   creating: docProps/
  inflating: docProps/app.xml        
  inflating: docProps/core.xml       
   creating: _rels/
  inflating: _rels/.rels             
   creating: word/
   creating: word/_rels/
  inflating: word/_rels/document.xml.rels  
  inflating: word/document.xml       
  inflating: word/styles.xml         
  inflating: word/numbering.xml      
  inflating: word/settings.xml       
  inflating: word/fontTable.xml      
   creating: word/media/
  inflating: word/media/image1.jpeg

The word/media/ folder contains the files attached to the document, the other files are XML files detailing the structure and content of the Word document.

As we know the format of the flag (FCSC{.*}) we can perform a quick search in the files thanks to a recursive grep:

$ grep -o -r "FCSC{.*}"
word/document.xml:FCSC{9bc5a6d51022ac}

And we get the flag :

FCSC{9bc5a6d51022ac}