Santa's Report

Platform: grodno_new_year_2026 | Category: Steganography | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-10 | Status: Solved Techniques: archive_extraction, file_format_analysis, hex_analysis, thumbnail_inspection

Summary

Task: ODT file (Report.docx) with hidden Santa's favorite day. Solution: Extract ZIP archive and find flag embedded in Thumbnails/thumbnail.png using strings/xxd.

Santa's Report — Grodno New Year 2026

Description

Мы получили перехватили зашифрованный отчет о деятельности Деда Мороза. Все что осталось, это понять его любимый день года.

---

We intercepted an encrypted report on Santa Claus's activities. All that remains is to determine his favorite day of the year.

File: Report.docx

Analysis

Step 1: File Format Identification

 bash read-only • copy allowed Copy
$ file Report.docx
Report.docx: Zip archive data, at least v2.0 to extract

Despite the .docx extension, the file is a ZIP archive. This is typical for Office Open XML (DOCX) and OpenDocument (ODT) formats. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Extracting Contents

 bash read-only • copy allowed Copy
$ unzip -o Report.docx -d extracted
Archive:  Report.docx
 extracting: extracted/mimetype
   creating: extracted/Configurations2/
   creating: extracted/Configurations2/accelerator/
   creating: extracted/Configurations2/floater/
   ...
  inflating: extracted/content.xml
  inflating: extracted/Thumbnails/thumbnail.png
  ...

The structure indicates ODT (OpenDocument Text) format.

Step 3: Analyzing content.xml (Red Herring)

In content.xml, text with white color (hidden text) was found:

 xml read-only • copy allowed Copy
<text:span text:style-name="T1">Скрытый текст...</text:span>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The document also contained a link to https://2cyr.com/decode/ (Cyrillic decoder). This turned out to be a red herring.

Step 4: Checking thumbnail.png

ODT files contain a document thumbnail in Thumbnails/thumbnail.png. Let's check it:

 bash read-only • copy allowed Copy
$ xxd extracted/Thumbnails/thumbnail.png | head -20
00000000: 8950 4e47 0d0a 1a0a 0000 000d 4948 4452  .PNG........IHDR
00000010: 0000 00c8 0000 0100 0802 0000 0038 7e5c  .............8~\
...
000000b0: 6772 6f64 6e6f 7b6d 795f 6c6f 766c 6579  grodno{my_lovley
000000c0: 5f30 365f 3132 7d00 0000 0049 454e 44ae  _06_12}....IEND.

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The flag was found in the PNG file's IDAT chunk!

Alternative method:

 bash read-only • copy allowed Copy
$ strings extracted/Thumbnails/thumbnail.png | grep -i grodno
grodno{REDACTED}

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Full solution

# Download the file
curl -sO "http://ctf-spcs.mf.grsu.by/files/5a97ebba8baa09becabc5ea6e2174bcc/Report.docx"

# Check file type
file Report.docx

# Extract the archive
unzip -o Report.docx -d extracted

# Search for flag in thumbnail
strings extracted/Thumbnails/thumbnail.png | grep -i grodno

Cultural Context

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The hint "favorite day of the year" points to December 6 (06.12) — Saint Nicholas Day. Saint Nicholas is the prototype of Santa Claus in Western tradition.

Note: The flag contains a typo "lovley" instead of "lovely" — this is intentional and is part of the flag.

Lessons

1. Always check the thumbnail — often used for hiding data in ODT/DOCX
2. Red herrings — obvious "hints" may be false leads
3. Check all files in the archive, not just the main content
4. Use strings and xxd for quick text search in binary files ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍