Forgotten Secrets

Task description

A binary dump was recovered from a compromised server’s memory. The attacker tried to hide their tracks, but traces remain buried deep within the raw data. The flag has been obfuscated — it will not appear in a simple string search. Look for patterns, markers, and think about what transformations could hide text in plain sight.

Approach

Analysis

We are given a 256 KB binary dump (forgotten_secrets.bin). Extracting printable ASCII strings ([\x20-\x7e]{6,}) reveals many repeated decoy strings (such as This is not the flag you are looking for, flag_not_here_keep_looking, base64_encoded_nothing_useful_here, /etc/shadow, password123!@#), along with a conspicuous repeating marker pattern starting around offset 143830:

DEADBEEF*+\x01\x16\x049/q/r0;\x1d&7/2\x1d&s%\x1d&qq2?CAFEBABE

Between the DEADBEEF and CAFEBABE markers is a 27-byte payload:

b'*+\x01\x16\x049/q/r0;\x1d&7/2\x1d&s%\x1d&qq2?'

Checking the XOR difference between the first bytes *+ (0x2a, 0x2b) and the expected flag prefix hi (0x68, 0x69) gives a single-byte XOR key of 0x42 (0x2a ^ 0x68 = 0x42).

Solution

XORing the 27-byte payload between DEADBEEF and CAFEBABE with 0x42 recovers the flag:

import re

with open("forgotten_secrets.bin", "rb") as f:
    data = f.read()

match = re.search(b"DEADBEEF(.*?)CAFEBABE", data, re.DOTALL)
payload = match.group(1)
flag = bytes(b ^ 0x42 for b in payload).decode()
print(flag)

Output:

hiCTF{m3m0ry_dump_d1g_d33p}

Lessons

• Decoy strings are noise — look for structural markers that bracket a payload.
• A single-byte XOR cipher is trivially broken when even a few bytes of plaintext are known, such as the flag prefix.