Challenge Description

Danish (original)

Heimdall har forsøgt at sende en besked til Odin. Dog er filen kommet i de forkerte hænder og måske har jætterne pillet lidt ved filen. Odin har aldrig modtaget filen. Måske du kan hjælpe med at finde ud af hvorfor filen ikke virker? og hvad er det helt præcist er blevet sendt fra Heimdall til Odin?

English (from chatgpt)

Heimdall tried to send a message to Odin. However, the file ended up in the wrong hands, and maybe the giants have tampered with it a bit. Odin never received the file. Perhaps you can help figure out why the file isn’t working? And what exactly was sent from Heimdall to Odin?

File

We are also given the following file:

Solution

Inside the 7z archive is a wav file, but something is wrong with it:

$ 7z x heimdallbesked.7z
[expunged for readability]

$ ls -l heimdallbesked.wav
-rw-r--r-- 1 osiriz osiriz 7329464 Dec  8 01:57 heimdallbesked.wav

$ file heimdallbesked.wav
heimdallbesked.wav: data

Looking at the header in hex and comparing with wikipedia, we can see that the nibbles of each bytes seems to be reversed:

$ xxd heimdallbesked.wav | head -n1
00000000: 2594 6464 b0d6 6f00 7514 6556 666d 7420  %.dd..o.u.eVfmt

So we fix that:

$ hexedit heimdall.wav
$ xxd heimdallbesked.wav | head -n1
00000000: 5249 4646 0b6d f600 5741 5645 666d 7420  RIFF.m..WAVEfmt

$ file heimdallbesked.wav
heimdallbesked.wav: RIFF (little endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 44100 Hz

The file sounds like morse code so using this Morse Code Adaptive Audio Decoder, we get the following:

H E I M D A L L S P R V E D E T A T E S C A N N E G P O R T E N E A T I L N B I F R O S T, O M E N G B L E V R H U R T I G T A B A N N E D P F O R H A T Y L A V E X A L T Y F O R Z M E G E T L A R M+

This forms a sentece with some letters inbetween the words.

The sentence:

heimdall pr[ø]vede at scanne portene til bifrost, men blev hurtigt banned for at lave alt for meget larm.

The letters inbetween:

steganographyxyz

This is a hint that the flag is hidden by steganography, so I tried a lot of different ways here, but ended up with stegolsb wavsteg:

$ stego wavsteg -r -i heimdallbesked.wav -o output.txt -b 30
Files read                     in 0.00s
Recovered 30 bytes             in 0.00s
Written output file            in 0.00s

$ cat output.txt
FDCA{Th0r_H4r_3N_S7Or_H4MM3R}