Home >

Cyber Defense CTF > Forensics

Back <> Next

You’ll probably need some tools to fix this one. Hexedit, HxD or hexed.it are commonly used.

Here we are given a file to download ‘magic_repairman.png’. If we try to open the file from the start we get an error message telling us the file is corrupted.

We can take the advice in the prompt and open the imagewith a hex editor:

hexedit magic_repairman.png

magic_repairman_1

If you are familiar with file headers, we can easily spot the header here is incorrectly showing .RNG instead of .PNG. We can simply look up the hex code for a capitol ‘P’ and change the value in the hexeditor. Here is a site with the table.

We will quickly see that the code for R is 52, and it needs to be changed to 50. We can save our changes and then view the flag in the image!

magic_repairman_2

Back <> Next