No One Ever Got Fired For…

Challenge:

… BUT THEY SHOULD HAVE!!! We spent 20 MILLION DOLLARS for this refrigerator-sized BOX, and we have to pay money for every program that we run! And then when we try to pull the data off, we get garbage like this! No one can read it! None of our standard Windows or Mac OS X systems can read this junk… We can't even figure out what it is supposed to be.

What about you? Do you think you can help us?

Enter the flag exactly as it appears in the file.

Stupid Data File We Can't Read
SHA1SUM: 09e37394bf3ba981e5f56d40ec16eb14ab7fbe66

Solution:

The challenge description contained enough clues to establish a solid hunch that the file was EBCDIC encoding. The full phrase, "No one ever got fired for buying IBM", was popular back in the 70's. Additionally, based on some quick OSINT the photo appears to be a Qantas computer room with IBM System/360 mainframes.

We loaded the file into CyberChef and built a recipe to decode IBM EBCDIC US-Canada (37) and locate strings with a minimum length of ten:

We also found a command line solution using dd to perform the translation:

$ dd if=no-one-ever-got-fired.dat conv=ascii | strings -n10
PHZyY3_4^CT~
qO6H2<OB4*
]-MB*DA$Uh
BUILD-PCS-WITH-LINUX-INSTEAD
xx]9F:x3<X
ALV:GaU2v*{

The accepted flag was, flag{BUILD-PCS-WITH-LINUX-INSTEAD}.

Published:

Updated:

Leave a comment