Scan Surprise (picoCTF 2)

Challenge Author: Jeffery John

Description

I’ve gotten bored of handing out flags as text. Wouldn’t it be cool if they were an image instead?

Process / Notes

  1. Download the zipped file and unzip.
  2. file on the file reveals it’s a small image.
  3. Opening the file shows it’s a QR code.
  4. Without a phone, the hint about using zbar tools led me to try to figure out what those were.
  5. Acquiring zbar tools with sudo apt install zbar-tools
  6. Using zbar-tools directly didn’t work.
  7. Some searching around on YouTube informed me that the command you want to run is zbarimg
  8. zbarimg on the file revealed the text of the flag
  • It can also return a URL it encodes without actually following that link.

Hints

  1. QR codes are a way of encoding data. While they’re most known for storing URLs, they can store other things too.
  2. Mobile phones have included native QR code scanners in their cameras since version 8 (Oreo) and iOS11.
  3. If you don’t have access to a phone, you can also use zbar-toools to convert an image to text.

Core Lessons

  1. QR codes can encode all sorts of information.
  2. How to use zbarimg