Description

A PowerPoint macro-enabled file (Forensics is fun.pptm) is provided. The flag is hidden somewhere inside it.

Overview

• Office Open XML formats (.docx, .xlsx, .pptm, etc.) are ZIP archives containing XML files and supporting assets.
• Renaming or unzipping a .pptm directly reveals all internal files, including any hidden ones.
• A file named hidden inside ppt/slideMasters/ contains a base64-encoded flag.

Background: Office Open XML

• Microsoft Office formats since 2007 use the Open Packaging Convention: the file is a ZIP archive.
• Unzipping a .pptm gives a directory tree: ppt/, docProps/, _rels/, etc.
• Any data can be stashed in arbitrary files inside this archive; the application ignores unknown files.

Solution

Step 1: Treat the PPTM as a ZIP

• binwalk confirms ZIP signatures inside the file.
• Unzipping directly (or running binwalk -e) extracts the full directory tree.

run_bash(["unzip", "\"Forensics is fun.pptm\""])

Step 2: Locate the Hidden File

• Inspecting the extracted contents reveals an unusual file: ppt/slideMasters/hidden.
• This file has no extension and does not belong to any standard PPTM component.

Step 3: Decode the Contents

• The file contains a base64-encoded string.
• Decoding it (with padding added) and splitting on : yields the flag.

with open("ppt/slideMasters/hidden", "r") as f:
    content = f.read()

decoded = base64.b64decode(content + "==").decode()
result = decoded.split(": ")[-1]

Flag

picoCTF{D1d_u_kn0w_ppts_r_z1p5}