Criminal Excel

Description

Looking for secrets in Excel

document.xls

Solution

Get encrypted flag with Strings

➜ strings .\document.xls -n 16
Ludovik                                                                                                      B
_-* #,##0_-;\-* #,##0_-;_-* "-"_-;_-@_-
_-* #,##0.00_-;\-* #,##0.00_-;_-* "-"??_-;_-@_-
koqhys bzgpp_cqvprpkg_tw_ogew
[Content_Types].xml
theme/theme/themeManager.xml
theme/theme/theme1.xml
theme/theme/_rels/themeManager.xml.rels
[Content_Types].xmlPK
theme/theme/themeManager.xmlPK
theme/theme/theme1.xmlPK
theme/theme/_rels/themeManager.xml.relsPK
&C&"Times New Roman,Regular"&12&A
&C&"Times New Roman,Regular"&12Page &P
Microsoft Excel 2003

Get encrypted flag with Excel (or LibreCalc)

criminal-excel-2

Decode flag

koqhys bzgpp_cqvprpkg_tw_ogew looks like a flag. From the looks of it it seems ROT13, but nothing. Vigenere Cipher is also common cipher which utilizes ROT13 (or Ceaser Cipher)

This encryption is weak and can be bruteforced: https://www.dcode.fr/vigenere-cipher

criminal-excel-1

Flag: grodno{excel_forensic_is_real}