PlaidCTF CTF 2015: Unknown

Category: Forensics  
Points: 30  
Solves: 290
Description:
We recovered this file from a nearby computer. Maybe you can tell us what it means?

root@kali:~/plaid# file unknown

unknown: ASCII text

 root@kali:~/plaid# head unknown
\begindata{raster,1}
2 0 65536 65536 0 0 640 400
bits 1 640 400
5a5c0b2f620b86f56c220475ab06266540dc7a04d980a3111a8008526d2a82813........

Google search :

http://www.fileformat.info/format/cmu/spec/c4cfb8404a304ea687b344485c445eb2/view.htm

Format of ATK raster images

The raster data object writes a standard ATK data stream beginning with
a \begindata line and ending with a \enddata line.  Between these comes
a header and possibly an image body.

The first line of the header looks like this:

2 0 65536 65536 0 0 484 603

Where the values are these:

RasterVersion:  '2' 
This specification describes the second version of this encoding.

Options: '0'
This field may specify changes to the image before displaying it:

raster_INVERT(1<<0)/* exchange black and white */
raster_FLIP(1<<1)/* exch top and bottom */
raster_FLOP(1<<2)/* exch left and right */
raster_ROTATE(1<<3)/* rotate 90 clockwise */

xScale, yScale:  '65536 65536'  ..........


http://www.fileformat.info/format/cmu/sample/index.htm

SAMPLE.CMU an example of raster image

Lets search tool that can open CMU extension .

Xnview can open  CMU extension . http://www.xnview.com

rename unknown to unknown.CMU and open it using xnview :



flag{l0l_CMU_da_b3s}