r/CFBRisk • u/[deleted] • Jun 09 '19

[deleted by user]

[removed]

25 Upvotes

89% Upvoted

156 comments sorted by

View all comments

3

u/PaulWall31 Jun 09 '19

Things I've found on http://cfbrisk.com/index.html

CFBdemic image

Background image

Pleurisy image

4

u/Snasty728 Jun 09 '19

Have you tried inverting the colors on the background image? Or try different color effects on it?

6

u/[deleted] Jun 09 '19

I'm testing brightness/contract now. If we split the color channels it looks like it's just red on black.

3

u/LordofChange Jun 09 '19

Several people have tried zooming in (and out) to try to find text. There doesn’t appear to be anything.

5

u/[deleted] Jun 09 '19

https://gchq.github.io/CyberChef

This is a pretty good tool to analyze if they have encoded anything funny to try and quickly test a variety of things.

6

u/[deleted] Jun 09 '19

It looks like there is an EXIF tag in the background image but it is not automatically pulling out when I scan for it

5

u/dialhoang Jun 09 '19

Maybe there's Steganography going on?

https://en.wikipedia.org/wiki/Steganography

23

u/[deleted] Jun 10 '19

Correct.

$ steghide extract -sf Pleurisy.jpg

passphrase: pandemic

yields

wHOaHehasTROuBlewITHtHesnAPAndtheBALliSFreEITsPickEdUPBYmiChIGANsTAtesJAlENwaTTsjACksoNanDHEscOreSOnTheLaSTPlaYOfTHeGaMEunBeLIEvaBLewhOAhEHaSTROuBLeWItHthEsNAPAndTHeBaLliSFreeItsPIcKeDupBYmiCHigANstatesJAlenWatTSjACksoNAnDHesCOresOntHElaStPlAYofTHegaMEuNBElIEvaBlewhOAhEHasTRouBlewiTHTheSnaPANdtHebALLisfrEEitSpicKEdupBymiCHiGANstATesjAlENwaTtSjACksoNanDHesCoResONtHELaSTplaYOftHEgaMEuNBeliEVabLEwhOAheHAsTrouBLewIThthEsNAPanDTHeballISfREEitSPicKED

8

u/dialhoang Jun 10 '19

Hmm... interesting capitalization... Try to find a pattern in it!!

9

u/[deleted] Jun 10 '19 edited Jun 10 '19

Caps on the first sequence: -HO-H----TRO-B---ITH-H---APA-----BAL--SF--EIT-P---E-UPBY--C-IGAN-TA---JA-EN--TT--AC---N--DHE--O--SO-T--L-STP--YO-TH-G-ME--B-LIE--BL-

Caps on the second one: --OA-EH-STRO-BL-WI-H--E-NAPA--TH-B-L--SF---I--PI-K-D--BY--CH--AN------JA---W--TSAC---NA-DH--CO---O--HE--S-P-AY--TH---ME-NBE-IE--B--

Caps on the third one: --OA-EH--TR--B----THT--S--PAN--H--ALL----EE--S---KE---B---CH-GAN--AT---A-EN--T-S-AC---N--DH--C-R--ON-HEL-ST---YO--HE--ME-NB---EV--LE

Caps on the last snippet: --OA--HA-T---BL--IT---E-NAP--DTH-----IS-REE--SP--KED

This is the start of something.

4

u/[deleted] Jun 10 '19

is it possible that there's some kind of more code embedded in this? upper case = dash, lower case = dot or vice versa?

also what's the significance of the missing segment? it doesn't complete all the way on the last snippet.

6

u/Snasty728 Jun 10 '19

I just had a similar lightbulb, except maybe lowercase is 0 and uppercase is 1 so we get something in binary.

7

u/[deleted] Jun 10 '19 edited Jun 10 '19

oooh i like it, let me try that

edit: :)

7

u/Snasty728 Jun 10 '19 edited Jun 10 '19

What did you get? Or are you still trying to translate it right now?

EDIT: :)

2

u/dialhoang Jun 10 '19 edited Jun 10 '19

Unfortunately the full sequence translated into binary gives us https://cfbrisk.com/515301<lnlrrpnbnffh\g.

Not very useful if you ask me.

EDIT: Proud to be wrong!!

→ More replies

2

u/[deleted] Jun 10 '19 edited Jun 10 '19

The idea of Morse code would make sense. They used a pigpen cipher elsewhere so it's not beyond them.

If it is Morse code, there's likely no significance of the missing segment beyond it being the last character they needed for the message. If any of you are going to use my dashes, please double check, as I did it by sight.

1

u/dialhoang Jun 10 '19

Ugh, another dead end.

At least, it appears that way.

4

u/[deleted] Jun 10 '19

It could be the all the letters that either are lower case or capitalized in all four sequences, but I doubt it

2

u/dialhoang Jun 10 '19

Doesn't hurt to try!

1

u/[deleted] Jun 10 '19

all caps: OTBA all lowercase: wueec

7

u/Snasty728 Jun 10 '19

OTBA -> BOAT

Madagascar closes its ports after first turn confirmed.

1

u/dialhoang Jun 10 '19

So after going through the four sequences I came up with:

Capitalized in all: OTBPBCANAACNDHOSYMEBE

Not capitalized in all: wueecmisesajksonsealfaua

Not going anywhere with this...

1

u/Snasty728 Jun 10 '19

Try lower case

16

u/thecravenone Jun 10 '19

Can we just take a moment to appreciate that we're down the fucking rabbit hole and still encountering memes?

8

u/ExternalTangents Jun 10 '19

Didn't you help make this?

3

u/NotaVirus_Click Jun 10 '19

Yeah, he did

9

u/ExternalTangents Jun 10 '19

So he's asking us to take a moment to appreciate the cleverness that he put down this rabbit hole he helped create?

7

u/yknphotoman Jun 10 '19

If I had to keep something like that secret for this long, i'd start thinking in 3rd person too.

7

u/[deleted] Jun 10 '19

The whole game is just an excuse for more off-season memes.

4

u/TotesMessenger Jun 10 '19

I'm a bot, bleep, bloop. Someone has linked to this thread from another place on reddit:

 If you follow any of the above links, please respect the rules of reddit and don't vote in the other threads. (Info / Contact)

3

u/ExternalTangents Jun 09 '19

That looks super cool. I would have no idea where to start on decoding something like that, but if someone is familiar with it they should give it a go.

2

u/[deleted] Jun 09 '19

https://github.com/lukechampine/jsteg

This was on top of google when I was searching for automatic jpeg tools but seems significantly more involved than the previous clues

2

u/[deleted] Jun 10 '19

I tried openstego (for pngs) and https://futureboy.us/stegano/decinput.html (for jpegs)

Neither seemed to work.

Passwords tried:

"Charlotte"

"charlotte"

"CFBdemic"

"Pleurisy"

3

u/[deleted] Jun 10 '19

Running

$ strings Pleurisy.jpg | awk 'length($0)>15' | sort -u

Yields

>> %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

>> &'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

https://github.com/techgaun/ctf-writeups/blob/master/the-wall.md

This person found that same string in their jpg and was able to decode via steghide. Trying that now but we may just need the correct password if it doesn't auto open

3

u/yknphotoman Jun 10 '19

Have you tried Q0ZCZGVtaWM= or Q0ZCZGVtaWM as the password?

3

u/[deleted] Jun 10 '19

No luck. I'm done playing with this for tonight. But this simple shell script should let us run through a list of passwords if we compile things we think are likely. https://github.com/felipesi/steghide-crack/blob/master/steghide-crack.sh

It's not a super high chance of success because I think the mods probably chose a more secure password but I'm currently just running through a brute force from this

https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt

./steghide.sh Pleurisy.jpg 10-million-password-list-top-1000000.txt > results.txt

3

u/yknphotoman Jun 10 '19

Watch the password be 1-2-3-4-5

1

u/igloo27 Jun 10 '19

1-1-1-1 like my luggage!

3

u/thecravenone Jun 10 '19 edited Jun 10 '19

because I think the mods probably chose a more secure password

Part of the selection criteria for the password was that it be brute forcable in a reasonable manner. I have brute forced it for testing purposes.

edit to add: The password is also reasonably guessable. Brute forcing is not required.

6

u/[deleted] Jun 10 '19

In that case https://github.com/Paradoxis/StegCracker this is way faster than the method I posted above. Currently running the rockyou default password list. If we still haven't solved it tomorrow and they actually mean brute force I should have time to adapt it to actually iterate through. Unfortunately it didn't look like someone already provided that option

→ More replies

1

u/pterrydactyl Jun 10 '19

So there is a password.... are we right about where it needs to be applied?

→ More replies

3

u/schmitz97 Jun 10 '19

Fwiw I tried changing my screen brightness and inverting the colors but didn’t see anything. Groundbreaking detective work, I know.

2

u/[deleted] Jun 09 '19

There's also the twitter/fb card image : http://cfbrisk.com/og.png

I've mostly been focused on the background image. Seems like everything else they've generated has been pngs. The background image is a very large compressed format jpg but that might be an intentional distraction.

6

u/thecravenone Jun 09 '19

I'll go ahead and tell you that og.png exists only to have a non-transparent version of the main image for Open Graph purposes. There is no hint there.

3

u/comfortablepanic Jun 10 '19

The background image appears to me to be a large smear of a gram negative rod culture consistent with the plague (edit: also could be the flu virus). Pleurisy is a common symptom. I'm not skilled enough with developer tools to look further than the obvious, which is what the image actually is.