Souvenirs

A JPEG with a ZIP archive appended after the image data. Carve it out and read the postcards inside.

Solve

1. Scan the image to find the appended archive:

binwalk souvenirs.jpg
# 0          0x0     JPEG image, total size: 39593 bytes
# 39593      0x9AA9  ZIP archive, file count: 5, total size: 2074 bytes

2. Carve the trailing ZIP from offset 0x9AA9 (39593) and unzip it:

dd if=souvenirs.jpg of=carved.zip bs=1 skip=39593
unzip carved.zip -d carved_out

(binwalk -e souvenirs.jpg also works and drops the same files under extractions/souvenirs.jpg.extracted/9AA9/postcards/.) 3. Read the text files under the extracted postcards/ directory; the flag is in 04_oman.txt:

cat carved_out/postcards/04_oman.txt

Flag: SVIUSCG{p0stc4rds_h1dd3n_p4st_th3_FFD9_h0r1z0n}