Amoy Toge.3gp.rar ~upd~ [480p]
$ rar2john Amoy\ Toge.3gp.rar > rar_hash.txt $ john --wordlist=/usr/share/wordlists/rockyou.txt rar_hash.txt ... [...] 1g 0:00:00:00 (amoytoge) (?)
| Step | Tool(s) used | What we learned | |------|--------------|-----------------| | Identify archive & password | file , unrar , rar2john + john | RAR‑5, password = amoytoge | | Extract video | unrar | Obtained Amoy Toge.3gp | | Inspect video | mediainfo , ffplay , exiftool | No visible clues; normal 12‑second clip | | Search for hidden data | binwalk -e | Found ZIP archive at offset 0x3E5A0 | | Extract ZIP | unzip (or dd + unzip ) | Inside: flag.txt | | Read flag | cat / unzip -p | FLAG3GP_5TEGA_H1DD3N | Amoy Toge.3gp.rar
The 3GP container is just a convenient “carrier” file; the hidden ZIP is appended after the legitimate movie data. binwalk (or even a simple dd with the offset) is the typical tool to locate such “trailing data”. $ rar2john Amoy\ Toge
