87 words
1 minute
BITSCTF 2026 - Marlboro - Forensics Writeup
Category: Forensics
Flag: BITSCTF{d4mn_y0ur_r34lly_w3n7_7h47_d33p}
Challenge Description
Given SaveMeFromThisHell.zip containing Marlboro.jpg. Clues: smoke/fire + “programming language from hell”.
Analysis
-
binwalk Marlboro.jpg→ ZIP appended at offset3754399(0x39499F) -
Extract →
smoke.pngandencrypted.bin -
exiftool smoke.png→ Author:aHR0cHM6Ly96YjMubWUvbWFsYm9sZ2UtdG9vbHMv(Malbolge tools URL) -
zsteg -a smoke.png→KEY=c7027f5fdeb20dc7308ad4a6999a8a3e069cb5c8111d56904641cd344593b657
Solution
# Carve ZIP from JPEGpython -c "data=open('Marlboro.jpg','rb').read();open('smoke.zip','wb').write(data[3754399:])"
unzip smoke.zip
# Get key from zstegzsteg -a smoke.png
# XOR decryptpython -c "from pathlib import Path; key=bytes.fromhex('c7027f5fdeb20dc7308ad4a6999a8a3e069cb5c8111d56904641cd344593b657'); enc=Path('encrypted.bin').read_bytes(); Path('decrypted.bin').write_bytes(bytes(b ^ key[i % len(key)] for i,b in enumerate(enc)))"
# Execute Malbolgepython -m pip install malbolgepython -c "import malbolge; print(malbolge.eval(open('decrypted.bin').read().splitlines()[-1]))" BITSCTF 2026 - Marlboro - Forensics Writeup
https://fuwari.vercel.app/posts/50/bitsctf-2026-marlboro-forensics-writeup/