Description
Every file gets a flag.
The SOC analyst saw one image been sent back and forth between two people. They decided to investigate and found out that there was more than what meets the eye here.
Setup
Download the flag.png file from the artifacts server.
wget https://artifacts.picoctf.net/c/260/flag.png
Solution
- Step 1Analyze the PNG file with binwalkRun binwalk to identify embedded data in the PNG file. The output shows a ZIP archive embedded at offset 0x9B7C containing a secret/flag.png file:binwalk flag.png
DECIMAL HEX DESCRIPTION 0 0x0 PNG image, 512 x 504, 8-bit/color RGBA, non-interlaced 41 0x29 Zlib compressed data, compressed 39739 0x9B3B Zip archive data, at least v1.0 to extract, name: secret/ 39804 0x9B7C Zip archive data, at least v2.0 to extract, compressed size: 2944, uncompressed size: 3095, name: secret/flag.png 42983 0xA7E7 End of Zip archive, footer length: 22 - Step 2Extract the embedded ZIP archiveUnzip the PNG file directly (you could also use binwalk -e flag.png):unzip flag.png
- Step 3Navigate and view the flagChange to the secret directory and open the flag image:cd secreteog flag.pngNote:
eogis a Linux image viewer and can be installed withsudo apt install eog
Flag
picoCTF{Hiddinng_An_i...678a337}
The flag is displayed in the image and can be seen with an image viewer.