c4ptur3-th3-fl4g Walkthrough | TryHackMe

Introduction

Hey everyone! 👋

In this write-up, I'll be documenting my experience completing c4ptur3-th3-fl4g, a beginner-friendly CTF room on TryHackMe.

I'll walk through my approach, the commands and tools I used, the answers I found, and the lessons I took away from the challenge.

Task 1 — Translation & Shifting

The first task introduced several common encoding and cipher techniques. The objective was to identify the format of each message and transform it into readable text.

For this task, I primarily used CyberChef, a useful tool for encoding, decoding, and analysing data.

1. Leet Speak

The first message was:

c4n y0u c4p7u23 7h3 f149?

This uses Leet Speak, a writing style in which numbers and symbols replace letters that look or sound similar.

By translating the substituted characters back into letters, I obtained:

Answer: can you capture the flag?

2. Binary

The next challenge provided a sequence of binary digits.

Binary represents data using 0 and 1. When groups of eight bits represent characters, the sequence can be decoded into text.

In CyberChef, I used the From Binary operation with a space delimiter and a byte length of eight.

The decoded message was:

Answer: lets try some binary out!

3. Base32

Next, I encountered a Base32-encoded string.

Base32 represents data using a restricted alphabet of letters and digits. It is an encoding method, not encryption, so the data can be decoded without a secret key.

I used CyberChef's From Base32 operation to decode the input.

The result was:

Answer: base32 is super common in CTF's

4. Base64

The following challenge used Base64 encoding.

Base64 represents binary data using a set of 64 possible characters. In CyberChef, I selected From Base64 and supplied the encoded input.

The decoded message explained the underlying concept:

Answer: Each Base64 digit represents exactly 6 bits of data.

5. Hexadecimal

The next input consisted of hexadecimal byte values:

68 65 78 61 64 65 63 69 6d 61 6c 20 6f 72 20 62 61 73 65 31 36 3f

Hexadecimal, also called Base16, uses the characters 0–9 and A–F. It is commonly used to represent binary data in a more readable form.

Using CyberChef's From Hex operation, I decoded the sequence into:

Answer: hexadecimal or base16?

6. ROT13

The next encoded message was:

Ebgngr zr 13 cynprf!

ROT13 is a substitution cipher that rotates each letter 13 positions through the alphabet. Applying the same transformation again restores the original text.

I selected the ROT13 operation in CyberChef and obtained:

Answer: Rotate me 13 places!

7. ROT47

The next challenge used ROT47, another rotation cipher that operates on printable ASCII characters.

I used CyberChef's ROT47 operation with a rotation amount of 47.

The resulting message was:

Answer: You spin me right round baby right round (47 times)

8. Morse Code

Morse code represents letters and numbers using combinations of dots and dashes.

I used CyberChef's From Morse Code operation, configured with spaces between letters and line breaks between words.

The decoded message was:

Answer: TELECOMMUNICATION ENCODING

9. Decimal Encoding

The next input contained decimal numbers representing character values.

CyberChef's From Decimal operation converted these values into readable text.

The output was:

Answer: Unpack this BCD

10. A More Complicated Encoding Chain

The final message was more challenging because it involved multiple layers of encoding.

Instead of assuming that one decoding operation would be enough, I used CyberChef's Magic operation to explore possible decoding methods. I then built a sequence of transformations to work through the encoded data.

The operations I used included:

• From Base64
• From Morse Code
• From Binary, with a byte length of eight
• ROT47
• From Decimal

Applying these transformations in sequence eventually produced the message:

Answer: Let's make this a bit trickier...

This was a useful reminder that a message can be encoded multiple times. Identifying one layer does not necessarily reveal the original content.

Task 2 — Spectrograms

The second task introduced audio spectrograms.

A spectrogram represents the frequencies present in an audio signal over time. Depending on how the audio was created, visual patterns in a spectrogram can reveal information that is not obvious when listening to the sound.

Step 1: Open the audio file

I downloaded the task file and opened it in Audacity.

From my Kali Linux terminal, I used:

audacity secretaudio_1559007588454.wav

audacity secretaudio_1559007588454.wav

Step 2: Inspect the spectrogram

After opening the file, I changed the track's display from its normal waveform view to Spectrogram using the track menu.

The frequency representation revealed a message hidden in the audio data.

The answer was:

Answer: Super Secret Message

This task demonstrated that audio files can contain visual information hidden in their frequency patterns, not just sounds that can be heard.

Task 3 — Steganography

Steganography is the practice of concealing information inside another file, such as an image or an audio recording.

For this challenge, I downloaded the provided image and used Steghide to extract its hidden data.

Step 1: Extract the concealed data

I ran the following command:

steghide extract -sf stegosteg_1559008553457.jpg

steghide extract -sf stegosteg_1559008553457.jpg

Steghide prompted me for a passphrase. After supplying the required passphrase, the extraction completed and wrote the hidden data to a text file named steganopayload2248.txt.

Step 2: Read the extracted file

I used the cat command to inspect the contents of the extracted text file:

cat steganopayload2248.txt

cat steganopayload2248.txt

The terminal displayed:

SpaghettiSteg

Answer: SpaghettiSteg

The important lesson here is that an image may look ordinary while still containing additional data. Tools such as Steghide can help identify and extract that concealed information when the relevant format and passphrase are known.

Task 4 — Security Through Obscurity

The final task explored the idea of security through obscurity: relying on secrecy or an unusual presentation instead of properly securing a system or its data.

I downloaded the supplied file, meme_1559010886025.jpg, and inspected its contents from the terminal.

Step 1: Inspect the file

I ran:

cat meme_1559010886025.jpg

cat meme_1559010886025.jpg

Because the file contained binary data, most of the terminal output was unreadable. However, some recognizable strings appeared within the output, including a filename and a hidden message.

The first filename and extension requested by the room were:

Answer: hackerchat.png

Step 2: Identify the hidden text

Continuing to inspect the readable data revealed the message:

Answer: AHH_YOU_FOUND_ME!

This challenge reinforced an important point: a file's extension or appearance does not guarantee that its contents are what they seem. Inspecting a file's structure and embedded data can reveal information that is not visible when opening it normally.

What I Learned

Completing this room gave me hands-on practice with several useful CTF techniques.

Encoding and decoding: I became more familiar with Leet Speak, binary, Base32, Base64, hexadecimal, ROT13, ROT47, Morse code, and decimal representations.

CyberChef: I practised using individual operations and combining them into a multi-step decoding chain when a message had several layers.

Audio analysis: I learned how to switch an audio track to spectrogram view in Audacity and inspect visual patterns in the frequency data.

Steganography: I used Steghide to extract concealed information from an image and inspect the resulting text file.

File inspection: I saw how inspecting the contents of a file can reveal readable information that is not immediately apparent from its filename or extension.

My rating: 8/10