Reflectlt

Platform: CyberAreaCTF | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-07-15 | Status: Solved Techniques: appended_data_carving, base64_decode, exif_base64_hint, recursive_zip_extraction, reversed_filename_password

Summary

Task: JPEG with a decoy geolocation photo hides an appended AES-encrypted ZIP matryoshka; an EXIF base64 hint points to filenames. Solution: carve the appended ZIP, then recursively open each layer using the reverse of its single inner filename as the AES password until flag.txt (base64) yields the flag.

Reflectlt — CyberAreaCTF

Description

Где то я уже видел это место....

English summary: We are given reflectIt.jpg.zip. The visible photo is a night scene (blue fountain, illuminated light-ball sculptures near a curved tower) that baits image geolocation. The title Reflectlt mimics ReflectIt (lowercase l vs capital I); the "reflect" wordplay is the key hint (mirror / reverse). The goal is to recover the flag.

Analysis

The visible landmark is a decoy — reverse image search / geolocation is a rabbit hole. The real path is forensic recon of the JPEG: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

• EXIF hint — exiftool shows ImageDescription is base64: Q2hlY2sgY2FyZWZ1bGx5IGZpbGVuYW1lIGluc2lkZSBhbmQgb3V0c2lkZSAg → decodes to Check carefully filename inside and outside .
• Appended data — binwalk reflectIt.jpg reveals an AES-encrypted ZIP appended at offset 163417 (0x27E59), member czp7lvqv.zip (WinZip AES, compression method 99 / 0x9901). This is a JPEG+ZIP polyglot.

Combining the title ("reflect" = reverse) with the EXIF hint ("filename inside and outside") gives the scheme: the AES password of an archive is the reverse of the filename it contains. Each ZIP holds exactly one inner ZIP — a matryoshka of ~67 layers. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Proven examples:

• embedded.zip contains czp7lvqv.zip → password vqvl7pzc
• czp7lvqv.zip contains xt920egp.zip → password pge029tx
• … 67 layers …
• final 1lzyxqy9.zip contains flag.txt → password galf (reverse of flag)

Solution

1. Unzip the outer archive → reflectIt.jpg (ignore the __MACOSX fork).
2. exiftool reflectIt.jpg → decode the base64 ImageDescription hint.
3. binwalk reflectIt.jpg → find the AES ZIP appended at 0x27E59.
4. Carve it: dd if=reflectIt.jpg of=embedded.zip bs=1 skip=163417.
5. Recursively extract: for each archive, read its single inner filename, reverse the stem to get the AES password, extract, repeat until flag.txt.
6. Base64-decode flag.txt. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""Recursively extract the reflected-filename AES ZIP chain."""
from pathlib import Path
import subprocess
import zipfile

archive = Path("embedded.zip")
for depth in range(100):
    with zipfile.ZipFile(archive) as zf:
        names = zf.namelist()
    if len(names) != 1:
        raise RuntimeError(f"Unexpected archive contents at depth {depth}: {names}")
    member = Path(names[0])
    password = member.stem[::-1]          # REVERSE the inner basename
    print(f"{depth}: {archive} -> {member} (password {password})")
    subprocess.run(["7z", "x", "-y", f"-p{password}", str(archive)],
                   check=True, stdout=subprocess.DEVNULL)
    archive = member
    if archive.suffix.lower() != ".zip":
        print(f"Final artifact: {archive}")
        break

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Then decode the final layer:

 bash read-only • copy allowed Copy
python3 -c 'import base64;print(base64.b64decode(open("flag.txt","rb").read()).decode())'
# Q1lCRVJBUkVBe3kwdV9mMW5hbGx5X2dldF9pdH0= -> CYBERAREA{REDACTED}

Dead-ends (for other solvers)

• Reverse image search / geolocation of the fountain+tower scene — intended decoy.
• Guessing obvious passwords (reflectIt, Reflectlt, non-reversed inner names).
• zip2john / hashcat brute force — unnecessary; no cracking once the reflect scheme is seen. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍