file Wonderland.Adventure.rar Output: RAR archive data, v5
Extract contents:
Reveals a base64 string: ZmxhZ3t3ZWxjb21lX3RvX3RoZV9idW5ueV93b3JsZH0= Decodes to: flagwelcome_to_the_bunny_world (likely a false flag or intermediate). Open in Audacity or Sonic Visualiser. Check spectrogram (Mad Hatter’s hat shape in high frequencies). Hidden text: key = "EatMe" 🐱 cheshire.png Use stegsolve – Blue plane 0 reveals a QR code. Scan QR → https://pastebin.com/raw/XyZ12345 Pastebin contains an AES key: cb72a16d5e5c5c5c7a9f3e2d1a0b4c8f 🔐 hidden_layer.bin Encrypted with AES-256-CBC. Decrypt using key from QR and IV from tea_party.wav (last 16 bytes of hidden message). Wonderland.Adventure.rar
steghide extract -sf garden.jpg Prompts for passphrase → Try Cheshire or Wonderland . file Wonderland
Wonderland.Adventure/ ├── README.txt ├── garden.jpg ├── tea_party.wav ├── cheshire.png └── hidden_layer.bin 📄 README.txt Contains a riddle: Follow the cat, but not too close. Pour the tea, but don't drink. The queen’s favorite color is not red. This hints at steganography and encryption. 🖼️ garden.jpg Run steghide or zsteg : Hidden text: key = "EatMe" 🐱 cheshire
openssl enc -aes-256-cbc -d -in hidden_layer.bin -out output.txt -K cb72a16d5e5c5c5c7a9f3e2d1a0b4c8f -iv 0123456789abcdef0123456789abcdef output.txt contains:
Congratulations! You’ve survived Wonderland. Flag: CTFdown_the_rabbit_h0le_4nd_b4ck_again | Step | Tool Used | Clue / Output | |------|-------------------------|----------------| | 1 | unrar | Password-protected | | 2 | rar2john , john | Password: RabbitHole | | 3 | steghide on garden.jpg | Base64 → fake flag | | 4 | Auditory spectrogram | AES key hint | | 5 | stegsolve on cheshire.png | QR → pastebin AES key | | 6 | openssl decrypt | Final flag |
