EOF{apples_apples_everywhere_raaaah}We started by running the given Python file:
python3 light_and_ryuk.py
This printed a YouTube video link in the terminal.
Opening the YouTube link revealed something interesting in the comments section — there was a Google Drive link, but it appeared to be encrypted using a Caesar cipher.
Instead of writing a script, we used an online Caesar cipher decryption tool. Trying different shifts revealed the decrypted Google Drive link that pointed to an image file named kira.png.
Caesar Cipher Decryption
The encrypted Drive link was shifted using a Caesar cipher. Testing different rotation values (ROT1-25) revealed the correct plaintext URL.
We downloaded the file from Google Drive. The image looked normal, but we suspected hidden data, so we used the strings command to search for the flag pattern:
strings kira.png | grep EOF
The output revealed:
EOF{apples_apples_everywhere_raaaah}
This was the hidden flag, embedded at the end of the PNG file.
Flag: EOF{apples_apples_everywhere_raaaah}
The flag references Ryuk's love of apples from Death Note! 🍎
strings command| Tool / Command | Purpose |
|---|---|
python3 light_and_ryuk.py |
Get YouTube link |
| Browser | Check YouTube comments |
| Online Caesar tool | Decrypt Drive link |
| Google Drive | Download kira.png |
strings kira.png | grep EOF |
Found flag |
| Step | Action | Result |
|---|---|---|
| 1 | Run the Python script | Got YouTube link |
| 2 | Checked YouTube comments | Found Caesar-encrypted Drive link |
| 3 | Decrypted Drive link | Got real Drive URL |
| 4 | Downloaded image | Got kira.png |
| 5 | Extracted hidden text | Found flag |
This challenge cleverly incorporates Death Note references:
A creative OSINT challenge that combines pop culture with technical skills! 📓