[top] - Fc2-ppv-1864525

00000000 66 6c 61 67 7b 46 43 32 5f 50 50 56 5f 31 38 36 |flagFC2_PPV_186......| ...

dd if=fc2_1864525.mp4 of=payload.bin bs=1 skip=124567890 strings payload.bin | grep -i flag # => flagFC2_PPV_1864525_fake Flag:

Extract the trailing bytes:

Using an online Morse decoder (or the morse Python library):

# Get the offset of the final `moov` atom (e.g. 124,567,890) tail -c +124567891 fc2_1864525.mp4 > trailing.bin hexdump -C trailing.bin | head The dump shows plain ASCII: fc2-ppv-1864525

https://video.fc2.com/content/2022/09/1864525_720p.mp4?auth=... wget -O fc2_1864525.mp4 "https://video.fc2.com/content/2022/09/1864525_720p.mp4?auth=..." The file size is ~120 MB – typical for a 720p MP4. 3. File Inspection 3.1 Basic file info file fc2_1864525.mp4 # => ISO Media, MP4 Base Media v1 [ISO 14496-12] ...

exiftool frames/frame_00123.png | grep -i comment No comment fields. Run zsteg on a few frames (install from Ruby gems or use stegsolve for a quick visual test): 00000000 66 6c 61 67 7b 46 43

import re, sys, json, urllib.parse, requests html = open('page.html').read() m = re.search(r'var\s+videoUrl\s*=\s*"([^"]+)"', html) url = urllib.parse.unquote(m.group(1)) print(url) Result (example):