ICON-SKETCH
Challenge
the pee people found the first version of the gaslightCTF icon... apparently theres a flag in here?
File given: icon.zip, a single icon.png.
Approach
Check properties. The image is an Apple Pencil or Procreate sketch export, and those pack a lot of metadata into EXIF and XMP fields that don't normally get looked at. Pulling the file's properties surfaces base64 sitting right in the title:
dHpob3J0c2cuLi57cjUuZy4uZy5oZi4uLi4ud18uLi5rLi5oPy4=
Decoding it gives something that's clearly not readable text yet, but is the right shape:
tzhortsg...{r5.g..g.hf.....w_...k..h?.
That's a reverse-alphabet substitution (Atbash), and running it through gets most of the way to a flag:
gaslight...{i5.t..t.su.....d_...p..s?.
The other half is hiding in a second field, the "AOT" title, also base64:
MmUgMmUgMmUgMmUgMmUgMmUgMmUgMmUgNDMgNTQgNDYgMmUgMmUgMmUgNWYgMmUgNjggMzQgMmUgNWYgMmUgMmUgNzAgNzAgMzAgNzMgMzMgMmUgMmUgMzIgNjIgNWYgMmUgMzEgNzMgMmUgMmUgN2Q=
which decodes to a run of hex byte pairs, and those turn into:
........CTF..._.h4._..pp0s3..2b_.1s..}
Putting it together
Each decoded half has the flag's characters sitting in different positions, with everything else left as dots. Lining them up fills in the gaps:
gaslight...{i5.t..t.su.....d_...p..s?.
........CTF..._.h4._..pp0s3..2b_.1s..}