> For the complete documentation index, see [llms.txt](https://blog.yenwai.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.yenwai.com/ctf/gctf-2023/miscellaneous/master-hidden-within-the-slides.md).

# Master Hidden Within The Slides

## Challenge details

<figure><img src="https://3330117967-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd6lVP7UgVVHIkHqAlU1O%2Fuploads%2FxhxlVMnSNSpOgj59ecRk%2Fimage.png?alt=media&amp;token=3a26af1d-9f2b-4e95-81d6-944fe7bb2a52" alt="" width="304"><figcaption><p>description</p></figcaption></figure>

## Solution

Opening up the attached PowerPoint file showed that there are 4 slides in total, nothing much. I even tried to move the images and texts around to see if there were something hiding beneath them.

<figure><img src="https://3330117967-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd6lVP7UgVVHIkHqAlU1O%2Fuploads%2FumJM181EiqMxX3LgO2mT%2Fimage.png?alt=media&amp;token=d7e2926e-53d2-495d-b34a-b8277571a8be" alt=""><figcaption></figcaption></figure>

Since the challenge title mentioned "master", I recalled that there's something known as "slide master" in PowerPoint. A quick search led us to the answer. Clicked on the first link.

<figure><img src="https://3330117967-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd6lVP7UgVVHIkHqAlU1O%2Fuploads%2FLED948A683JXAQgizG68%2Fimage.png?alt=media&amp;token=8bfeb5ef-3913-49c3-91f5-70886085b3da" alt=""><figcaption></figcaption></figure>

The Microsoft documentation has detailed instructions on how to access the slide master.

<figure><img src="https://3330117967-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd6lVP7UgVVHIkHqAlU1O%2Fuploads%2FmvxE32davKEflL3n9PEm%2Fimage.png?alt=media&amp;token=407e542a-5f64-4340-bf34-6dda7ee8837e" alt=""><figcaption></figcaption></figure>

Inspecting through every slide, we've found a weird string among one of them, which indeed looks like a base64 encoded string.

<figure><img src="https://3330117967-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd6lVP7UgVVHIkHqAlU1O%2Fuploads%2FYQPfBoQ8NS2S1cFewqzw%2Fimage.png?alt=media&amp;token=20dcd01b-0604-49c4-ab02-e20e6c807a92" alt=""><figcaption></figcaption></figure>

Throw that into CyberChef and we'll get the flag.

<figure><img src="https://3330117967-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd6lVP7UgVVHIkHqAlU1O%2Fuploads%2FRiEytOsqTPU2Gnd55N0A%2Fimage.png?alt=media&amp;token=f4913485-1f99-4ab7-bdbe-7925d73b9e9b" alt=""><figcaption></figcaption></figure>

In the case that you have no idea what encoding it uses, you can try your luck by pasting it into CyberChef. Sometimes, a magic wand might appear and if you click on it, the site will automatically solve it for you.&#x20;

<figure><img src="https://3330117967-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fd6lVP7UgVVHIkHqAlU1O%2Fuploads%2FgmciBBhJb4aaFj7VykAw%2Fimage.png?alt=media&amp;token=728e80da-6a2f-4108-a12f-f275120ccf5e" alt=""><figcaption></figcaption></figure>

## Flag

> `GCTF{Sl1d3sss_M4staaaaaaa}`
