c4ptur3th3fl4g

Category: Forensics / CTF Difficulty: Easy Objective: Recover flags hidden in audio and image files using Steganography tools.

1. Executive Summary

This assessment focused on identifying hidden data within multimedia files. We utilized Audacity to recover a visual flag from an audio spectrogram, Steghide to extract a hidden text file from a JPEG (using a blank password), and Binwalk to carve a hidden RAR archive from a meme image. The RAR archive contained a final PNG which required further analysis.

Key Tools:

• Audacity: Spectrogram analysis.
• Steghide: JPEG steganography extraction.
• Binwalk: Firmware/File carving and extraction.
• Unrar: Archive decompression.

2. Challenge A: Audio Steganography

File: secretaudio_1559007588454.wav

The Analysis

Listening to the audio reveals mostly noise or garbled sounds. This is a hallmark of “Spectral Steganography,” where an image is encoded into the sound waves.

Solution

1. Open the file in Audacity.
2. Click the dropdown arrow on the track name (Left panel).
3. Select Spectrogram.
4. Result: The text/flag appears visually in the graph.

3. Challenge B: Image Steganography

File: stegosteg_1559008553457.jpg

The Analysis

We suspect data is embedded inside the JPEG. The standard tool for JPEG steganography is steghide.

Exploration (Trial & Error)

You initially tried to extract data but likely hit a password prompt.

steghide extract -sf stegosteg_1559008553457.jpg
# Enter passphrase: <typed something>
# Error: could not extract any data

The Solution

Often in CTFs, the password is empty (blank).

steghide extract -sf stegosteg_1559008553457.jpg
# Enter passphrase: <Press Enter>
# wrote extracted data to "steganopayload2248.txt".

Flag Content:

cat steganopayload2248.txt
# Output: SpaghettiSteg

4. Challenge C: File Carving (The Meme)

File: meme_1559010886025.jpg

Enumeration

We start by checking if other files are appended to the end of the image.

binwalk meme_1559010886025.jpg

Output:

DECIMAL       DESCRIPTION
------------------------------------------------
0             JPEG image data
74407         RAR archive data, version 5.x  <-- SUSPICIOUS
74478         PNG image

Extraction

We use binwalk to automatically extract the files.

binwalk -e meme_1559010886025.jpg
cd _meme_1559010886025.jpg.extracted

Decompression (The “Unzip” Issue)

Inside the extracted folder, we find 122A7.rar.

• Attempt 1: unzip -> Failed (It’s not a zip file).
• Attempt 2: tar -> Failed (It’s not a tarball).
• Success: unrar.

unrar e 122A7.rar
# Extracted: hackerchat.png

Final Analysis (hackerchat.png)

We have a new image: hackerchat.png. You ran strings on it.

strings hackerchat.png

• Alternative Method: For PNGs, zsteg is usually cleaner than strings.

zsteg hackerchat.png

• Result: This usually reveals the final flag hidden in the zText chunks or LSB data of the PNG.

5. Summary of Flags