> For the complete documentation index, see [llms.txt](https://sayonara.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sayonara.gitbook.io/writeups/ctf/nullcon-berlin-hackim-ctf-2023/crypto/bmpass.md).
# Bmpass
{% file src="/files/UR0lwfy644cs8x1QcH0o" %}
let's open the encrypt.py script
```python
#!/usr/bin/env python3
from Crypto.Cipher import AES
import os, sys
#open's the image and read it as binary
img_in = open(sys.argv[1], "rb").read()
#pad some data to the image
img_in += b'\00' * (16 - (len(img_in) % 16))
#creating a random key using the os.urandom(16)
#and encrypting the image using AES MODE ECB
cipher = AES.new(os.urandom(16), AES.MODE_ECB)
img_out = cipher.encrypt(img_in)
#saving the encrypted image into the name of the image .bmp.enc
open(sys.argv[1] + ".enc", "wb+").write(img_out)
```
the image is encrypted using `MODE ECB` so this can be an **ECB Penguine**
What is the `ECB Penguin` ? The most common encryption algorithm, AES, is a block cipher with 128-bit blocks. A block cipher always encrypts the same contents the same way, given the same key. Naively, that doesn't seem like a problem because that output is still encrypted, and hence "secure", but it reveals information.
this is an exemple of ECB penguine even though it's encrypted using AES MODE ECB but the fact that it encrypts the same contents the same way it reveals information
and to reveal information inside the image encrypted using AES MODE ECB we will use a tool called GIMP `GNU Image Manipulation Program`
if it's not installed by default in your kali linux run those commands
```
sudo apt update
sudo apt install gimp
```
select RGB Aplha and start playing with the with and offset until you see something in the RAW Image Data in this case i found that the offset 1 and with 960 gives us the flag but the image is rotated 180 degrees and flipped horizontally
save the image and then flip the image horizontally and rotate it 180 degress you will get this it's very hard to read
the flag is => ENO{i\_c4N\_s33\_tHr0ugH\_3ncrYpti0n}