Trending Tags
The Archive Behind the Chunk
The Archive Behind the Chunk
- Author: Utkarsh
This is a steganography challenge involving image metadata, an encrypted payload, and a custom PNG chunk.
We are given:
1
2
CTF1.png
CTF2.png
First, inspect CTF1.png using exiftool:
1
exiftool CTF1.png
The metadata contains a Base64-encoded payload and the hint:
1
key - thor
Decode the payload and decrypt it using age:
1
2
base64 -d encoded.txt > secret.age
age -d -p secret.age
Using the password thor reveals a link to a Word document.
The document contains several images. Inspecting their metadata reveals the first half of the flag in one image’s Description field.
Next, inspect CTF2.png. Running:
1
pngcheck -v CTF2.png
reveals an unusual custom PNG chunk. The hidden data can also be located using:
1
strings CTF2.png | grep drive.google.com
This reveals a Google Drive folder containing a video. The video provides the second half of the flag.
Combining both fragments gives:
1
CYS{W4k4nd443v3R}
The flag would be:
CYS{W4k4nd443v3R}
Flag
CYS{W4k4nd443v3R}