Challenge Description:

You can look all day, but can you catch it before it slips away?

the Gif: here

None

Solution :

We're given a GIF file full of QR codes, each changing rapidly from frame to frame. The challenge statement hints that only one of the QR codes hides the real flag, while the others contain random strings or decoys.

First, I downloaded the GIF (qrs.gif) and confirmed it was animated:

None

To analyze each QR code individually, I used ffmpeg to extract all frames as images:

None

Now I have a lot of PNG images like:

None

Manually scanning each frame would be impossible. So I wrote a short Python script using pyzbar and Pillow to decode all QR codes automatically.

from pyzbar.pyzbar import decode
from PIL import Image
import os, re

for f in sorted(os.listdir("frames")):
    if not f.endswith(".png"):
        continue
    path = os.path.join("frames", f)
    data = decode(Image.open(path))
    if data:
        content = data[0].data.decode(errors='ignore')
        if re.search(r'flag|ctf', content, re.IGNORECASE):
            print(f"[FLAG FOUND in {f}] → {content}")
        else:
            print(f"{f}: {content}")

The script started printing the decoded content of each frame. Most of them contained random Base64-looking strings like:

None

They definitely looked like Base64. That's why i tried this code to see the real content :

from pyzbar.pyzbar import decode
from PIL import Image
import os, re, base64

def try_base64_decode(s):
    try:
        decoded = base64.b64decode(s.strip(), validate=True)
        return decoded.decode('utf-8', errors='ignore')
    except Exception:
        return None

for f in sorted(os.listdir("frames")):
    if not f.endswith(".png"):
        continue

    path = os.path.join("frames", f)
    data = decode(Image.open(path))

    if data:
        content = data[0].data.decode(errors='ignore').strip()
        decoded_b64 = try_base64_decode(content)

        flag_detected = re.search(r'QnQSec', decoded_b64 if decoded_b64 else content)

        if flag_detected:
            print(f"[FLAG FOUND in {f}] → {decoded_b64 if decoded_b64 else content}")
        else:
            print(f"{f}: {decoded_b64 if decoded_b64 else content}")
None

Flag found: QnQSec{C4TCH_M3_1F_Y0U_C4N}