2 minutes
NC3CTF 2022 Stego
10
We get a file called et-nul
,
running file
tells us it is a long line of ASCII characters:
$ file et-nul
et-nul: ASCII text, with very long lines (1330), with no line terminators
The file contains:
0110000110011111100011111110000111101111111101111111100000000011000011011000001101100000000000000011111111011110110000000000000001100001101111001111110001111110011111111011000011011110111100011100011011000011011000001100110000110000000000110000000000001110001101100000110110000000000000000001100000110011000000000000000111000110011001100001101100001101100000001110001101111000011001111001101100000000000000110011000011000000000011000000000000111100110110000011011000000000000000000110000011001100000000000000011110011001100110000000110000000110000000111100110111100001100110110110110000000011111110011100001111110000001100000000000011011011011000001101100000000000000000011000001100110000000000000001101101100110001111110001111110011111100011011011001100000111011001111011000000000000001100110000110000000000110000000000001100111101100000110110000000000000000001100000110011000000000000000110011110011000000001100000001101100000001100111100000000011001100011101100001101100000110011000011000000000011000000000000110001110110000011011000000000000000000110000011001100000000000000011000111001100110000110110000110110000000110001110111100001100110000110011111100011111110000111101111111100001100001111111011000011001111111001111111101111111000011000011110111111110111111101100001101111001111110001111110011111111011000011011110111100
By splitting the text into 7 lines of equal length the message reveals itself (don’t focus too hard or you wont see it):
0110000110011111100011111110000111101111111101111111100000000011000011011000001101100000000000000011111111011110110000000000000001100001101111001111110001111110011111111011000011011110111100
0111000110110000110110000011001100001100000000001100000000000011100011011000001101100000000000000000011000001100110000000000000001110001100110011000011011000011011000000011100011011110000110
0111100110110000000000000011001100001100000000001100000000000011110011011000001101100000000000000000011000001100110000000000000001111001100110011000000011000000011000000011110011011110000110
0110110110110000000011111110011100001111110000001100000000000011011011011000001101100000000000000000011000001100110000000000000001101101100110001111110001111110011111100011011011001100000111
0110011110110000000000000011001100001100000000001100000000000011001111011000001101100000000000000000011000001100110000000000000001100111100110000000011000000011011000000011001111000000000110
0110001110110000110110000011001100001100000000001100000000000011000111011000001101100000000000000000011000001100110000000000000001100011100110011000011011000011011000000011000111011110000110
0110000110011111100011111110000111101111111100001100001111111011000011001111111001111111101111111000011000011110111111110111111101100001101111001111110001111110011111111011000011011110111100
We then got the flag: NC3{ET_NUL_TIL_NISSEN!}
I farezonen
We are given the image dz.jpg
Trying steghide
with no passphrase doesn’t find any thing.
We can instead use stegseek
to try and find a passphrase that works:
$ stegseek dz.jpg rockyou.txt
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek
[i] Found passphrase: "0815julemaus"
[i] Original filename "flag.txt"
[i] Extracting to "dz.jpg.out"
$ cat dz.jpg.out
nc3{yes_endnu_en_stegoopgave}
We have now found the flag
Juledigtet
We are given the image juledigt.png
We can see the text is flipped on its head, we can flip it vertically to fix it
All the green squares are different shades of green, if we take the RGB value of the first three green squares we get:
# 146e14
# 146314
# 143314
The green channel in these values is the only thing that changes,
and if we convert the green channel values to ASCII from Hex we get nc3
If we then continue taking the green channel value for each green square we get:
6e 63 33 7b 52 47 42 5f 6d 65 6e 5f 6b 75 6e 5f 64 65 6e 5f 67 72 6f
65 6e 6e 65 21 31 65 74 21 7d
which converted to ASCII gives us the flag:
nc3{RGB_men_kun_den_groenne!1et!}