Description

Anagram, anyone?

data.xls

Resolution

We had a hint : Anagram, and a .xls file, we download it, we see w columns containing numbers with 2 to 3 digits. There are around 15k rows. We export the .xls to a csv for easier parsing and then do some analysis. We find out that there are only 256 unique numbers, interesting huh ? 🙂 That sounds like they represent byte numbers. If we look at the top of the document, most of the first numbers are all 78, the 4 first numbers are different than 78. So it could be a binary format. We analyse a bit more the numbers, they start at 78 and finish at 78 + 256 * 3. We send make a little C# script to transform the file in a binary.

Here it is:

using System;
using System.IO;

class Solution
{
    static void Main(String[] args)
    {
        String[] data = File.ReadAllLines(@"G:\Users\laxa\Desktop\data.csv");
        byte[] arr = new byte[339181];
        int i = 0;
        foreach (string s in data)
        {
            String[] tmp = s.Split(';');
            // each number
            foreach (string z in tmp)
            {
                int n = Convert.ToInt32(z);
                n = n - 78;
                if (n > 0)
                    n /= 3;
                arr[i] = Convert.ToByte(n);
                i++;
            }
        }
        File.WriteAllBytes(@"G:\Users\laxa\Desktop\bla.bin", arr);
        Console.WriteLine("Done!");
        Console.ReadKey();
    }
}

And then we file and execute the binary we get:

$ file bla.bin
bla.bin: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, stripped

$ ./bla.bin
SharifCTF{5bd74def27ce149fe1b63f2aa92331ab}

Flag is “SharifCTF{5bd74def27ce149fe1b63f2aa92331ab}“.