Mo Beigi

Challenge

HV19.H2 Hidden Two

For easy download, get it here: HV19-SantaRider.zip

Solution

During the Day 7 challenge HV19.07 Santa Rider, we notice there is a ZIP file available to download.
This ZIP file has the typical guid file name and contains one file called 3DULK2N7DcpXFg8qGo9Z9qEQqvaEDpUCBB1v.mp4.
The inner MP4 file has the same hash as the one shown on the webpage so it is of no particular interest.

We attempt to decode the file name string using base64:

It looks like it may be partially decoding correctly so we instead try to base58 decode this and finally this gives us our flag!

Flag:  HV19{Dont_confuse_0_and_O}

Note: It is painful to note that base32, base64, base85, base91 decoding was attempting on this file name was attempted within the first 15 minutes of the challenge but unfortunately base58 was not attempted until much, much later. In the mean time we attempted many other things such as switching the Day 7 binary to match wire configuration in backdrop and inspecting the videos audio stream. Rough one!