Forgotten Secrets

The brief

A binary dump was recovered from a compromised server's memory. The attacker tried to hide their tracks, but traces remain buried deep within the raw data. The flag has been obfuscated. It will not appear in a simple string search. Look for patterns, markers, and think about what transformations could hide text in plain sight.

• forgotten-secrets.zip, 253 KB

In short

Forgotten Secrets hides its flag in a 256 KB memory dump of random bytes, planted strings and a fake ELF header. A flat randomness map ruled out a hidden blob, and trying every single byte XOR key against the prefix hiCTF{ found key 0x42 and 22 copies of the flag.

A dump built to mislead

The file is 262,144 bytes that open with an ELF header and then turn to noise. A search for hiCTF finds nothing. The 15 hits for flag are planted, such as flag_not_here_keep_looking.

Noise from the first block to the last

The lab measured the randomness of all 256 blocks of 1 KB. Every block sits between 7.68 and 7.85 bits per byte, close to pure noise. With no quiet region to cut out, the flag had to be changed byte by byte.

256 keys and one known start

Every flag here starts with hiCTF{, which is enough to test a key. The lab tried all 256 single byte XOR keys on the whole file. Key 0x42 turned the bytes 2A 2B 01 16 04 39 into hiCTF{.

22 copies between two markers

Key 0x42 revealed 22 identical copies of the flag. Each one is 27 bytes set between the ASCII markers DEADBEEF and CAFEBABE, the first at offset 143,838.

The insight

XOR with one byte hides text from a string search, but a known prefix like hiCTF{ gives the key away in at most 256 tries.

The flag

hiCTF{m3m0ry_dump_d1g_d33p}