# FM01 - 250pts

## Briefing

> Download the file and find a way to get the flag. Contents: fm01.jpg

Challenge Files:

* [fm01.zip](https://github.com/HHousen/NCS-Competition/tree/e3a1ab990b675bd865fdddd9e5fa5cd7895b3b02/Forensics/FM01/fm01.zip)

## Solution

1. The flag is embedded in the metadata of the image. This can be easily solved by finding strings in `fm01.jpg` and searching for `flag`: `strings fm01.jpg | grep Flag` to find `flag: tr4il3r_p4rk` in the metadata for a Photoshop layer name.
2. Alternatively, simply use `exiftool` to see the flag in a nice layout of the metadata by running `exiftool fm01.jpg`:

   ```
    ...
    History Software Agent          : Adobe Photoshop 22.2 (Windows), Adobe Photoshop 22.2 (Windows)
    History Changed                 : /, /
    Text Layer Name                 : flag: tr4il3r_p4rk
    Text Layer Text                 : flag: tr4il3r_p4rk
    Document Ancestors              : E25BCF5D355B2F2CE5EB55EC6B67C7AF
    Image Width                     : 1920
    ...
   ```

### Flag

`tr4il3r_p4rk`


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ncs2021.haydenhousen.com/forensics/fm01.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.