MacroHard WeakEdge

Description

Solution

1. Step 1Extract the PPTM as a ZIP archive
   PPTM files (like DOCX, XLSX, and all OOXML formats) are ZIP archives containing XML files, images, and other resources. Rename or use unzip directly on the file to extract its contents.
   unzip "Forensics is fun.pptm" -d forensics_extractedCopied!

   ls forensics_extracted/Copied!
   Learn more

   Office Open XML (OOXML) is a ZIP-based format used by all modern Microsoft Office documents (.docx, .xlsx, .pptx, .pptm, etc.). The "m" suffix indicates macro-enabled files. Inside the ZIP you find XML files describing content, a _rels/ directory for relationships, and a ppt/ (or word/) directory for the main content.

   Treating Office documents as ZIP archives is standard practice in forensics, malware analysis, and CTF challenges. Many attackers hide payloads or embed data in the less-examined subdirectories of these archives.

2. Step 2Find and decode the hidden file
   Inside the extracted archive, navigate to ppt/slideMasters/. There is an unusual file called 'hidden' containing a base64 string with spaces between each character. Remove the spaces with tr, then decode with base64.
   cat forensics_extracted/ppt/slideMasters/hiddenCopied!

   cat forensics_extracted/ppt/slideMasters/hidden | tr -d ' ' | base64 -dCopied!
   Learn more

   The ppt/slideMasters/ directory normally contains XML files defining slide master layouts. A file simply named hidden (with no extension) is anomalous and immediately suspicious. The spaces between base64 characters are an obfuscation trick -- tr -d ' ' strips all spaces before decoding.

   tr (translate) with the -d flag deletes specified characters from the input stream. tr -d ' ' removes all space characters, leaving a clean base64 string for base64 -d to decode.

Flag

picoCTF{...}

Office OOXML formats (.pptm, .docx, .xlsx) are renamed ZIP archives -- always try extracting them with unzip to find hidden files.