HideToSee picoCTF 2023 Solution

Description

1. Step 1Extract the payload
   Run steghide extract -sf atbash.jpg -p ''. The -p '' flag passes an empty passphrase non-interactively (handy in scripts and CI), and steghide writes encrypted.txt to the current directory.
   Learn more

   Steghide hides data inside JPEG and BMP images by slightly modifying the DCT (Discrete Cosine Transform) coefficients of a JPEG or the pixel values of a BMP. The changes are statistically designed to be imperceptible to the human eye and to pass chi-square steganalysis. Data is optionally encrypted with a passphrase before embedding; when no passphrase is set (as in this challenge), steghide still performs the embedding but uses an empty key, so supplying no password at extraction time succeeds.

   The -sf flag means "stego file" - the file that carries the hidden payload. Steghide embeds a small header inside the image that records the original filename and size of the payload, which is why it knows to write encrypted.txt on extraction. This header is itself hidden using the same statistical technique, so it does not appear in a hex dump.

   Common steghide detection methods include: looking for the tool's characteristic frequency distribution shifts, running stegdetect, or simply always attempting extraction with blank/common passwords on any JPEG encountered in a forensics challenge.

2. Step 2Decode with Atbash
   Drop the ciphertext into CyberChef, apply the Atbash recipe, and copy the resulting picoCTF flag.
   Learn more

   Atbash is one of the oldest known ciphers, originally used to encode Hebrew scripture. The mapping reflects every letter to its mirror position: E(x) = 25 - x in zero-based indexing (A=0...Z=25). Because 25 - (25 - x) = x, the cipher is its own inverse - apply once to encrypt, again to decrypt.

   Mapping:  A  B  C  D  E  ... M N ... X  Y  Z
             |  |  |  |  |      | |     |  |  |
             Z  Y  X  W  V  ... N M ... C  B  A
   
   Worked example on 'kbXL':
     k(10) -> 25 - 10 = 15 -> 'p'
     b(1)  -> 25 - 1  = 24 -> 'y'   (case preserved)
     X(23) -> 25 - 23 = 2  -> 'C'
     L(11) -> 25 - 11 = 14 -> 'O'
   Result: 'pyCO' ... continue across the rest of the ciphertext to land on 'picoCTF{...}'.
   
   Self-inverse property (round trip):
     kbXL  --atbash-->  pyCO  --atbash-->  kbXL
   Two applications return the original, which is why one Atbash recipe in
   CyberChef both encrypts and decrypts; you never need a separate "decrypt"
   button.

   Atbash has zero key space (only one possible mapping), so it offers no real security. CTF challenges use it to test familiarity with classical ciphers. The challenge name hidetosee combines both techniques: hide (steghide) reveals something you need to see (decode).

Related guides

Flag

The challenge name is the hint; Atbash is the only transformation required.