hideme picoCTF 2023 Solution

Description

1. Step 1Analyze the PNG file with binwalk
   Run binwalk to identify embedded data in the PNG. Two offsets show up: 0x9B3B is the ZIP central-directory entry for the secret/ directory marker, and 0x9B7C is the actual file entry for secret/flag.png. The 0x9B7C entry is the one that holds the payload bytes.
   bash

   binwalk flag.png

   Copied!

   DECIMAL	HEX	DESCRIPTION
   0	0x0	PNG image, 512 x 504, 8-bit/color RGBA, non-interlaced
   41	0x29	Zlib compressed data, compressed
   39739	0x9B3B	Zip archive data, at least v1.0 to extract, name: secret/
   39804	0x9B7C	Zip archive data, at least v2.0 to extract, compressed size: 2944, uncompressed size: 3095, name: secret/flag.png
   42983	0xA7E7	End of Zip archive, footer length: 22

   Learn more

   binwalk is a firmware and file analysis tool that scans a binary for known magic-byte signatures. It recognizes hundreds of file formats - ZIP, gzip, PNG, ELF, JPEG, and more - by comparing byte patterns at every offset against its signature database. When it finds a match, it reports the decimal and hexadecimal offset along with a human-readable description.

   This technique works because most file formats are self-delimiting: they start with a recognizable header (a "magic number") and often end with a trailer. A ZIP archive begins with the bytes PK\x03\x04; a PNG starts with \x89PNG\r\n\x1a\n. Concatenating a valid PNG with a valid ZIP produces a file that image viewers display correctly (they stop at the PNG IEND chunk) while ZIP-aware tools see the appended archive. This is a classic polyglot file technique used in both steganography and malware delivery.

   In digital forensics, binwalk is routinely applied to firmware dumps, memory images, and suspicious attachments to surface embedded executables, configuration files, or compressed archives. The -e flag extracts all recognized components automatically, making it a powerful first step in any file analysis workflow.

2. Step 2Extract the embedded ZIP archive
   Unzip the PNG file directly (you could also use binwalk -e flag.png):
   bash

   unzip flag.png

   Copied!
   Learn more

   Because the PNG file is simultaneously a valid ZIP archive (a polyglot), standard tools that look for the ZIP central directory at the end of the file will happily extract it. unzip finds the end-of-central-directory record regardless of what precedes it, so unzip flag.png works exactly like unzip archive.zip.

   Alternatively, binwalk -e flag.png carves out all detected archives and writes them to a _flag.png.extracted/ directory. Both methods achieve the same result; the direct unzip call is slightly faster since binwalk would need to re-scan. In real forensic workflows, binwalk -e is preferred because it handles nested archives (archives within archives) and formats other than ZIP automatically.

3. Step 3Navigate and view the flag
   Change to the secret directory and verify the file is a real PNG, then open it. Headless boxes can read the flag with strings or OCR (no GUI needed); on a desktop, any image viewer works.
   bash

   cd secret

   Copied!

   bash

   file flag.png

   Copied!

   bash

   strings flag.png | grep -i pico

   Copied!
   On a desktop you can also open it with any viewer (xdg-open flag.png, eog flag.png, or transfer to your local machine via scp). On WSL or a headless server, strings works if the flag is rendered as literal text in the file; otherwise use tesseract flag.png stdout for OCR.
   Learn more

   The extracted secret/flag.png is a separate, independent image file that contains the flag rendered as visible text. This two-layer approach - hiding a file-within-a-file, where the inner file is itself an image - is a straightforward demonstration of steganography by appending (distinct from bit-plane steganography where data is hidden within pixel values).

   On headless servers or WSL environments where GUI tools aren't available, you can still read image-embedded flags using strings secret/flag.png if the text is stored literally, or convert to text with tesseract secret/flag.png stdout (OCR). If the flag is purely visual, transferring the file to a local machine with scp and opening it there is the most reliable approach.

Related guides

Flag

The flag is displayed in the image and can be seen with an image viewer.