picoCTF Solutions
picoCTF 2021ForensicsEasy

Matryoshka doll

Published: April 2, 2026

Description

Matryoshka dolls are nested -- can you extract the flag from this nested image? Download dolls.jpg.

Setup

Download dolls.jpg.

wget <url>/dolls.jpg

Solution

  1. Step 1Scan for embedded files with binwalk
    Run binwalk on dolls.jpg. It will report additional file signatures embedded inside the JPEG -- specifically nested PNG files and ZIP archives. Extract everything with the --dd flag.
    binwalk dolls.jpg
    binwalk --dd='.*' dolls.jpg
    Learn more

    binwalk scans a binary file for known file format magic bytes (signatures). A JPEG file starts with bytes FF D8 FF; a ZIP file starts with 50 4B 03 04; a PNG with 89 50 4E 47. binwalk identifies these signatures at any offset, revealing files hidden after or within the primary file.

    The --dd='.*' flag tells binwalk to extract all recognized signatures to a directory named _dolls.jpg.extracted/. Without this flag, binwalk only reports offsets but does not extract.

  2. Step 2Repeat extraction on each nested image
    Navigate into the extracted directory and find the nested image file. Run binwalk --dd='.*' on it. Repeat this process four times total -- each image contains another image inside it. After the fourth extraction, you will find flag.txt.
    cd _dolls.jpg.extracted/
    binwalk --dd='.*' base_images/2_c.jpg
    binwalk --dd='.*' base_images/3_c.jpg
    binwalk --dd='.*' base_images/4_c.jpg
    cat flag.txt
    Learn more

    This is a steganography-by-polyglot technique: a file that is simultaneously a valid JPEG (the outer image) and a ZIP archive (containing the inner image). Most image viewers display only the JPEG portion and ignore the trailing data. The challenge nests four layers deep, mimicking a Matryoshka (Russian nesting doll).

    The base_images/ directory convention comes from binwalk's extraction naming -- it creates subdirectories based on the offset where the nested file was found. The final flag.txt appears as a plain text file inside the innermost archive.

Flag

picoCTF{...}

binwalk detects file format magic bytes inside any binary -- files can be nested arbitrarily and binwalk will find them all.

More Forensics