# REDACTED

**Challenge Name: REDACTED**

**Category: Forensics**&#x20;

**Difficulty: Easy**&#x20;

**Description: I have forgotten my AI's name, can you find it?**

<figure><img src="https://3959829653-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKsbQ7f9jhHpgfkJbVM1s%2Fuploads%2FrG6ztGP0xZbqr80cbeaf%2Fimage.png?alt=media&#x26;token=8a10cc0a-0db2-45d5-89f5-b1b3933e06ec" alt=""><figcaption></figcaption></figure>

The challenge provided us with a file called `REDACTED.h5` . So, the standard operating procedure in any Forensics challenge is to check the "actual" file type of the file with the `file` command in Linux.  As we can see, the file provided is a Hierarchical Data Format Format file.

&#x20;

<figure><img src="https://3959829653-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKsbQ7f9jhHpgfkJbVM1s%2Fuploads%2F7IL9J26u55X8KGNr0Vvy%2Fimage.png?alt=media&#x26;token=8d01ca5f-2874-4353-8b1c-3ddfdd351495" alt=""><figcaption></figcaption></figure>

In any Forensics challenge, when faced with an unknown file type. The best course of action is to find a tool that can read the file or if you don't want to, use `strings` to display visible strings within the file. Doing that reveals a json list to us of which one of them is a weird string,`SUNURjI0e25hTWVfb0ZfN2hFX2c0TUV9`. If you do a lot of CTFs, you would recognise this weird string to be a Base64-encoded string. Don't worry if you don't recognise it, it takes time and experience to know.

<figure><img src="https://3959829653-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FKsbQ7f9jhHpgfkJbVM1s%2Fuploads%2Fwwsg4W0Hp0HvkQhmAnmh%2Fimage.png?alt=media&#x26;token=12fd5fa5-a981-41a4-8b2e-a340a95993d5" alt=""><figcaption></figcaption></figure>

Using a tool that's already in Linux called `base64`, we can use `echo` with the `|` (pipe operator) to pass the string to the tool with the argument `-d` to decode the string. Doing so reveals the flag!

{% code overflow="wrap" fullWidth="false" %}

```
Flag: ICTF24{naMe_oF_7hE_g4ME}                                                                                                                                                                    
```

{% endcode %}
