Milkshake

2 minutes to read

We are given an MP3 file called Milkshake.mp3. We can take a look at the printable strings or metadata:

$ file Milkshake.mp3
Milkshake.mp3: Audio file with ID3 version 2.4.0, extended header, contains:MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, JntStereo MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, JntStereo

$ strings -20 Milkshake.mp3
The Neptunes Present-Clones-ADTRCK
 000007A5 000006CA 00007311 000075EA 0001A567 0001A567 00008000 00008000 0000005C 0000005CCOMM
 000007A5 000006CA 00007311 000075EA 0001A567 0001A567 00008000 00008000 0000005C 0000005CTPE1
Chad Hugo/Pharrell Williams
!$&),/257:=@CFHKMPSVY\^adgiloqtwy|~

$ exiftool Milkshake.mp3
ExifTool Version Number         : 12.42
File Name                       : Milkshake.mp3
Directory                       : .
File Size                       : 1511 kB
File Modification Date/Time     : 2017:08:28 16:05:06+02:00
File Access Date/Time           :
File Inode Change Date/Time     :
File Permissions                : -rw-rw-r--
File Type                       : MP3
File Type Extension             : mp3
MIME Type                       : audio/mpeg
MPEG Audio Version              : 1
Audio Layer                     : 3
Sample Rate                     : 44100
Channel Mode                    : Joint Stereo
MS Stereo                       : Off
Intensity Stereo                : Off
Copyright Flag                  : False
Original Media                  : True
Emphasis                        : None
VBR Frames                      : 1568
VBR Bytes                       : 1510503
VBR Scale                       : 100
Encoder                         : LAME3.99r
Lame VBR Quality                : 0
Lame Quality                    : 0
Lame Method                     : VBR (new/mtrh)
Lame Low Pass Filter            : 22.1 kHz
Lame Bitrate                    : 32 kbps
Lame Stereo Mode                : Joint Stereo
ID3 Size                        : 451
Warning                         : Invalid ID3 frame size
Audio Bitrate                   : 295 kbps
Duration                        : 0:00:41 (approx)

But nothing interesting at all. We can open the audio file in Audacity:

Milkshake 1

If we change to the spetrogram view, we will notice something strange:

Milkshake 2

And if we zoom a bit, we will see the flag:

Milkshake 3

This technique does not break the audio file because the flag is set on high frequency values, and humans cannot distinguish frequencies higher than 20 kHz.

Anyway, the flag is: HTB{str4wberry_milkshak3}.