$
←

$ Forensics: Marlboro

BITSCTF 2026 By TaklaMan
Flag: BITSCTF{d4mn_y0ur_r34lly_w3n7_7h47_d33p}

Binwalk of the Original

taklaman@ubuntu:~/Downloads/SaveMeFromThisHell$ ~/.cargo/bin/binwalk -Me Marlboro.jpg

                               /home/taklaman/Downloads/SaveMeFromThisHell/Marlboro.jpg
----------------------------------------------------------------------------------------------------------------------
DECIMAL                            HEXADECIMAL                        DESCRIPTION
----------------------------------------------------------------------------------------------------------------------
0                                  0x0                                JPEG image, total size: 3754399 bytes
3754399                            0x39499F                           ZIP archive, file count: 2, total size: 983655
                                                                      bytes
----------------------------------------------------------------------------------------------------------------------

Analyzed 1 file for 85 file signatures (187 magic patterns) in 6.0 milliseconds

Website from this

taklaman@ubuntu:~/Downloads/SaveMeFromThisHell/extractions/Marlboro.jpg.extracted/39499F$ exiftool smoke.png
...
Author                          : aHR0cHM6Ly96YjMubWUvbWFsYm9sZ2UtdG9vbHMv
...

Base64 Decrypt: https://zb3.me/malbolge-tools

XOR Key from this

taklaman@ubuntu:~/Downloads/SaveMeFromThisHell/extractions/Marlboro.jpg.extracted/39499F$ zsteg smoke.png
...
b1,rgb,lsb,xy       .. text: "# Marlboro Decryption Key\n# Format: 32-byte XOR key in hexadecimal\nKEY=c7027f5fdeb20dc7308ad4a6999a8a3e069cb5c8111d56904641cd344593b657\n# Usage: XOR each byte of encrypted.bin with key[i % 32]\np"
...

Decrypted file Content

Content-Type: text/x-malbolge
Interpreter: https://zb3.me/malbolge-tools/#interpreter
Language: Malbolge

D'`$##\!<5|jWVT/eRcONp_oJJHHF!3gfBc!?a_{)(xwYon4rqpi/mlkdibaf_%]ba`_XWVz=YRQPOsSRQ3ONGkKD,BAe(DCBA@?>7[5432V6v.3,P*).-&Jk)"!&}C#cy~wv<zyxZpotm3qSi/gOkd*KJ`ed]\"`Y^]\[TxRQVOTSLpPONMLEiIH*)?>bB$@987[Z:38765.Rsr*/.-&%$#G'~f$#z@~}|{t:[wvonm3kSonmlkdihg`&GFbaZ~^@VUTYRQPtNMLKPImGFKJCBf)E>bB;@?>7[5432Vw/43,POp.'&+*#G!~D1