<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Stegano on Anthrace | CTF Writeups</title><link>https://anthr4ce.github.io/tags/stegano/</link><description>Recent content in Stegano on Anthrace | CTF Writeups</description><generator>Hugo</generator><language>en-us</language><lastBuildDate>Wed, 30 Jul 2025 00:00:00 +0000</lastBuildDate><atom:link href="https://anthr4ce.github.io/tags/stegano/index.xml" rel="self" type="application/rss+xml"/><item><title>HackDay - Stegano</title><link>https://anthr4ce.github.io/ctf-writeups/hackday/stegano/</link><pubDate>Wed, 30 Jul 2025 00:00:00 +0000</pubDate><guid>https://anthr4ce.github.io/ctf-writeups/hackday/stegano/</guid><description>&lt;hr&gt;&#10;&lt;p&gt;In this challenge, we are provided with a &lt;code&gt;.wav&lt;/code&gt; file that, at first glance, appears to be a simple audio file. Our task is to analyze the file and uncover a hidden flag.&lt;/p&gt;&#10;&lt;hr&gt;&#10;&lt;h4 id="step-1-playing-the-audio"&gt;&#10; &lt;strong&gt;Step 1: Playing the Audio&lt;/strong&gt;&#10; &lt;a class="heading-link" href="#step-1-playing-the-audio"&gt;&#10; &lt;i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"&gt;&lt;/i&gt;&#10; &lt;span class="sr-only"&gt;Link to heading&lt;/span&gt;&#10; &lt;/a&gt;&#10;&lt;/h4&gt;&#10;&lt;p&gt;I started by playing the audio, expecting something unusual—perhaps some hidden message or distortion—but everything sounded normal. There was no apparent clue in the audio playback.&lt;/p&gt;</description></item><item><title>HackDay - Stegano &amp; Forensic</title><link>https://anthr4ce.github.io/ctf-writeups/hackday/forensic/</link><pubDate>Wed, 30 Jul 2025 00:00:00 +0000</pubDate><guid>https://anthr4ce.github.io/ctf-writeups/hackday/forensic/</guid><description>&lt;hr&gt;&#10;&lt;h3 id="forensic-challenge---hidden-flag-extraction"&gt;&#10; &lt;strong&gt;Forensic Challenge - Hidden Flag Extraction&lt;/strong&gt;&#10; &lt;a class="heading-link" href="#forensic-challenge---hidden-flag-extraction"&gt;&#10; &lt;i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"&gt;&lt;/i&gt;&#10; &lt;span class="sr-only"&gt;Link to heading&lt;/span&gt;&#10; &lt;/a&gt;&#10;&lt;/h3&gt;&#10;&lt;p&gt;In this challenge, we have a &lt;strong&gt;ZIP file&lt;/strong&gt; containing a &lt;strong&gt;log file&lt;/strong&gt; and &lt;strong&gt;two images&lt;/strong&gt;.&lt;/p&gt;&#10;&lt;hr&gt;&#10;&lt;h3 id="step-1-log-file-analysis"&gt;&#10; &lt;strong&gt;Step 1: Log File Analysis&lt;/strong&gt;&#10; &lt;a class="heading-link" href="#step-1-log-file-analysis"&gt;&#10; &lt;i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"&gt;&lt;/i&gt;&#10; &lt;span class="sr-only"&gt;Link to heading&lt;/span&gt;&#10; &lt;/a&gt;&#10;&lt;/h3&gt;&#10;&lt;p&gt;I began by analyzing the log file and found &lt;strong&gt;five encoded words&lt;/strong&gt;. I used &lt;strong&gt;dcode.fr&lt;/strong&gt; to decode them:&lt;/p&gt;&#10;&lt;ul&gt;&#10;&lt;li&gt;&lt;code&gt;ercbafr&lt;/code&gt; (ROT13) → &lt;strong&gt;reponse&lt;/strong&gt;&lt;/li&gt;&#10;&lt;/ul&gt;&#10;&lt;p&gt;&lt;img src="images/forensic_1.png" alt="Screenshot"&gt;&lt;/p&gt;&#10;&lt;ul&gt;&#10;&lt;li&gt;&lt;code&gt;c29sdXRpb24=&lt;/code&gt; (Base64) → &lt;strong&gt;solution&lt;/strong&gt;&lt;/li&gt;&#10;&lt;/ul&gt;&#10;&lt;p&gt;&lt;img src="images/forensic_2.png" alt="Screenshot"&gt;&lt;/p&gt;</description></item><item><title>Huntress-CTF - DontBelieveEverythingOnTheInternet</title><link>https://anthr4ce.github.io/ctf-writeups/huntress-ctf/</link><pubDate>Fri, 01 Nov 2024 00:00:00 +0000</pubDate><guid>https://anthr4ce.github.io/ctf-writeups/huntress-ctf/</guid><description>&lt;hr&gt;&#10;&lt;div class="highlight"&gt;&lt;pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"&gt;&lt;code class="language-text" data-lang="text"&gt;&lt;span style="display:flex;"&gt;&lt;span&gt;Don&amp;#39;t believe everything you see on the Internet! &#10;&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt; &#10;&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt;Anyway, have you heard this intro soundtrack from Half-Life 3?&#10;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;p&gt;The challenge starts by downloading an &lt;code&gt;.mp3&lt;/code&gt; file. While trying to process it in Python to extract metadata, I encountered errors. After several attempts, I started to wonder if it was actually an MP3 file—or something else. I wrote a function to determine the real file type:&lt;/p&gt;&#10;&lt;div class="highlight"&gt;&lt;pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"&gt;&lt;code class="language-python" data-lang="python"&gt;&lt;span style="display:flex;"&gt;&lt;span&gt;&lt;span style="color:#f92672"&gt;import&lt;/span&gt; filetype&#10;&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt;&#10;&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt;&lt;span style="color:#66d9ef"&gt;def&lt;/span&gt; &lt;span style="color:#a6e22e"&gt;check_file_type&lt;/span&gt;(filename): &#10;&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt; kind &lt;span style="color:#f92672"&gt;=&lt;/span&gt; filetype&lt;span style="color:#f92672"&gt;.&lt;/span&gt;guess(filename) &#10;&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt; &lt;span style="color:#66d9ef"&gt;if&lt;/span&gt; kind &lt;span style="color:#f92672"&gt;is&lt;/span&gt; &lt;span style="color:#66d9ef"&gt;None&lt;/span&gt;: &#10;&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt; &lt;span style="color:#66d9ef"&gt;return&lt;/span&gt; &lt;span style="color:#e6db74"&gt;&amp;#34;unknown file type.&amp;#34;&lt;/span&gt; &#10;&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt; &lt;span style="color:#66d9ef"&gt;return&lt;/span&gt; &lt;span style="color:#e6db74"&gt;f&lt;/span&gt;&lt;span style="color:#e6db74"&gt;&amp;#34;type: &lt;/span&gt;&lt;span style="color:#e6db74"&gt;{&lt;/span&gt;kind&lt;span style="color:#f92672"&gt;.&lt;/span&gt;mime&lt;span style="color:#e6db74"&gt;}&lt;/span&gt;&lt;span style="color:#e6db74"&gt;, extension: &lt;/span&gt;&lt;span style="color:#e6db74"&gt;{&lt;/span&gt;kind&lt;span style="color:#f92672"&gt;.&lt;/span&gt;extension&lt;span style="color:#e6db74"&gt;}&lt;/span&gt;&lt;span style="color:#e6db74"&gt;&amp;#34;&lt;/span&gt;&#10;&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt;&#10;&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt;filename &lt;span style="color:#f92672"&gt;=&lt;/span&gt; &lt;span style="color:#e6db74"&gt;&amp;#39;src/Half-Life_3_OST.mp3&amp;#39;&lt;/span&gt; &#10;&lt;/span&gt;&lt;/span&gt;&lt;span style="display:flex;"&gt;&lt;span&gt;print(check_file_type(filename))&#10;&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;p&gt;Thanks to this script, I found out that the file was actually a PNG:&lt;/p&gt;</description></item></channel></rss>