The Khatrimaza-org-mkv -

$ python3 xor.py hidden.bin s3cr3t_k3y_4_f1ag payload.bin 🎉

$ steghide extract -sf hidden.bin Enter passphrase: stegextract: No hidden data found No luck. The string “protected” hints at AES‑CTR or XOR protection. We search for a possible key inside the MKV – maybe hidden in the metadata .

# 2. List attachments (if any) $ mkvextract attachments khatrimaza-org.mkv :

mkvextract tracks khatrimaza-org.mkv 0:video.h264 1:audio.aac 2:subtitles.srt mkvextract attachments khatrimaza-org.mkv 0:Roboto-Regular.ttf 1:hidden.bin Now we have the following files in our working directory: The Khatrimaza-org-mkv

$ mediainfo khatrimaza-org.mkv General Complete name : khatrimaza-org.mkv Format : Matroska File size : 84.3 MiB Duration : 00:03:45.000 Overall bit rate : 2 028 kb/s

$ hexdump -C hidden.bin | head 00000000 42 49 4e 41 52 59 20 66 69 6c 65 20 73 69 67 6e |BINARY file sign| 00000010 61 74 75 72 65 20 70 72 6f 74 65 63 74 65 64 20 |ature protected | ... The first bytes read – looks like a custom marker added by the challenge creator. 5.2 Entropy check – is it compressed / encrypted? $ ent hidden.bin Entropy = 7.998997 bits per byte. Very high entropy (~8 bits/byte) – it is either compressed or encrypted. 5.3 Try common decompression tools We test a few common formats with binwalk :

2 00:00:03,001 --> 00:00:07,000 Enjoy the movie. Nothing hidden in the subtitles – just a generic welcome message. We quickly glance at them with ffprobe just to be sure there’s nothing weird: $ python3 xor

open('payload.bin', 'wb').write(out) print('Done – payload written to payload.bin') Run it:

Audio ID : 2 Format : AAC Channel(s) : 2 channels Sampling rate : 44.1 kHz Bit rate : 128 kb/s

Text ID : 3 Format : UTF‑8 Nothing suspicious at first glance, but MKV is a very flexible format – it can hold , extra subtitle tracks , chapters , and binary blobs . Those are typical places for a CTF flag. 3. Extract everything from the container We will use mkvextract (part of mkvtoolnix ) to dump all tracks and attachments. 7z) is detected. steghide

| File | Size | |---------------------|------| | video.h264 | 79 MiB | | audio.aac | 2 MiB | | subtitles.srt | 1 KB | | Roboto-Regular.ttf | 147 KB | | hidden.bin | 6 KB | 4.1 Subtitles ( subtitles.srt ) $ cat subtitles.srt 1 00:00:00,000 --> 00:00:03,000 Welcome to Khatrimaza!

DECIMAL HEXadecimal DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 Unknown file type (0x42494E41) No known signature (e.g., gzip, zip, 7z) is detected. steghide , zsteg , exiftool can sometimes extract hidden payloads from generic binaries.