KapKan

kapKan was a Forensics Challenge from HTB x Uni CTF 2020. We are given a blank word document named invoice.docx, opening the file gives us a blank word document. Although, on opening we get the following warning:

The warning suggests there is something going on deeper within this file. We go on to open to document in some text editor and investigate. After a quick scan through we find the following interesting tag:

<w:fldSimple w:instr=" QUOTE 112 111 119 101 114 115 104 101 108 108 32 45 101 112 32 98 121 112 97 115 115 32 45 101 32 83 65 66 85 65 69 73 65 101 119 66 69 65 68 65 65 98 103 65 51 65 70 56 65 78 65 65 49 65 69 115 65 88 119 66 78 65 68 77 65 88 119 66 111 65 68 65 65 86 119 66 102 65 68 69 65 78 119 66 102 65 72 99 65 77 65 66 83 65 69 115 65 78 81 66 102 65 69 48 65 78 65 65 51 65 68 77 65 102 81 65 61 ">

Placing the series of numbers in CyberChef and converting "From Decimal", we receive the following string:

The ending string looks like Base64, copying this and running a "From Base64" operation gives us the flag: