We start by downloading the provided files.
We are given two sample .cow files. Putting them through the provided
Let's examine the provided
xxd Cow\ 1.cow | less
xxd Cow\ 2.cow | less
Looking at the hexdump of the files, we can see that both start with
Checking the
xxd Mad\ Cow.001 | grep "1337 beef"
00e00000: 1337 beef f2f5 e5f5 ffff fff2 b6b7 bbad .7..............
Comparing the endings of the two
000a2cf0: 5b3f 0447 8056 ffff ffff b6ba b1bb 4d6f [?.G.V........Mo
000a2d00: 6f6f
000e7a50: 3868 9a06 a078 2571 2a20 9d23 99ff ffff 8h...x%q* .#....
000e7a60: ffb6 bab1 bb4d 6f6f 6f
Both end with
We can use python to extract the
with open("Mad Cow.001", "rb") as f:
data = f.read()
start = data.find(b"\x13\x37\xbe\xef")
end = data.find(b"\xff\xff\xb6\xba\xb1\xbb\x4d\x6f")
# save the file
with open("extracted.cow", "wb") as f:
f.write(data[start:end])
We run the script and verify if the file looks is correct:
python3 extract.py
xxd extracted.cow | less
It looks good, so we put it in the cow decrytor:
python3 cow_decryptor.py -i extracted.cow -o decrypted_cow.png
We get the following image:
The image contains the flag:
byuctf{incredi-bull}