flags are stepic picoCTF 2025 Solution

Description

1. Step 1

   Spot the rogue flag

   Observation

   I noticed the gallery lists country-flag images where every filename follows a standard three-letter country code pattern, which suggested that grepping the raw page source for image references would quickly surface any outlier slug that doesn't belong to a real country.

   Grep the page source for every flags/<name>.png reference. The output is mostly country codes - usa.png, fra.png, jpn.png, etc. - and one outlier upz.png. Upanzi is a fictional CyLab Africa nation, so its image is the embedded clue. Download it and run a stego decoder.

   bash

   grep -oE 'flags/[a-zA-Z]+\.png' index.html | sort -u

   Copied!

   bash

   # Output mostly country codes; upz.png stands out.

   Copied!

   bash

   wget http://standard-pizzas.picoctf.net:56409/flags/upz.png

   Copied!

   bash

   file upz.png

   Copied!

   bash

   # Should report: PNG image data, NNNxNNN, 8-bit/color RGBA, non-interlaced

   Copied!

   Expected output

   upz.png: PNG image data, 800 x 533, 8-bit/color RGBA, non-interlaced

   What didn't work first

   Tried: Manually scrolling through the rendered gallery page looking for a visually different flag image.

   The rogue image upz.png is styled and sized identically to every other flag in the gallery, so it is not visually distinguishable. Grepping the raw HTML source for the image filenames exposes the non-country-code slug upz instantly, which visual inspection of the rendered page cannot do.

   Tried: Running strings upz.png to look for the flag directly in the binary.

   LSB steganography distributes the payload across the least significant bits of individual pixel channels, not as a contiguous ASCII string in the file. The strings command only finds sequences of printable characters 4+ bytes long that are stored consecutively in the binary, so it will miss the LSB-encoded payload entirely. A dedicated LSB decoder like stepic or zsteg is required to reconstruct the bit stream.

   Learn more

   OSINT (Open Source Intelligence) and visual reconnaissance are important first steps in CTF challenges. When presented with a list of items, security researchers learn to look for anomalies - entries that don't belong, slightly misspelled names, unusual ordering, or references to fictional entities. "Upanzi" is a fictional African nation referenced in cybersecurity educational contexts, making it immediately suspicious in a list of real countries.

   Viewing page source is a fundamental web security technique. HTML comments, hidden form fields, unusual script tags, metadata, and data attributes often contain information that is not visible in the rendered page. Developers sometimes leave debug information, internal API endpoints, or - as in this challenge - clues to hidden functionality directly in the source code.

   The gallery structure is a common steganography delivery mechanism: embed a secret-carrying image among many innocuous images so that a casual observer sees only a normal image gallery. Finding the odd one out requires enumeration, which is why tools like curl combined with text search (grep) are useful for quickly scanning all entries programmatically rather than reading them visually.

2. Step 2

   Install Stepic

   Observation

   I noticed the challenge title 'flags-are-stepic' is a pun on the Python LSB steganography library stepic, which suggested that this specific library was used to embed the payload and that installing it would give me the matching decoder.

   Stepic is the Python LSB stego library the challenge name riffs on. Create a virtualenv and pip install stepic (Pillow comes in as a dependency, so you don't need to install it separately). If install fails, fall back to zsteg upz.png.

   python

   python3 -m venv venv && source venv/bin/activate

   Copied!

   bash

   pip install stepic   # pulls in Pillow automatically

   Copied!

   What didn't work first

   Tried: Running pip install stepic globally without a virtualenv and then calling stepic as a shell command.

   Stepic installs as a Python library, not a standalone shell binary. Without the virtualenv activated, the stepic command may not be on PATH. The correct invocation is python3 -m stepic or stepic only after activating the virtualenv where it was installed.

   Learn more

   LSB steganography (Least Significant Bit) hides data by replacing the lowest-order bit of each color channel in every pixel with bits from the secret message. The change is visually imperceptible because flipping the LSB changes a pixel's color value by only 1 out of 255. A red pixel at value 200 (11001000) becomes 201 (11001001) - completely indistinguishable to the human eye.

   Stepic is a Python library that encodes and decodes messages hidden in PNG images using LSB steganography. The -d flag (decode) reads the LSB of each channel pixel by pixel, reconstructs the binary stream, and interprets it as text. Note: Stepic encodes into the alpha channel when present, so an RGBA PNG can carry payload bits that an RGB-only decoder will miss entirely. zsteg's bit-plane brute force handles both. It is a straightforward implementation that does not use passwords or additional encoding, making it easy to use but also easy to detect with forensic tools.

   Other popular LSB stego tools include zsteg (Ruby, scans multiple bit planes and color channel combinations), StegSolve (Java GUI tool that visualizes individual bit planes), and steghide (supports password-protected embedding in JPEG and BMP files). When a challenge does not specify which tool was used, zsteg is often the best first choice because it automatically tries many configurations.

3. Step 3

   Decode the PNG

   Observation

   I noticed that upz.png was confirmed as a valid 8-bit/color RGBA PNG by the file command, and that the challenge name pointed directly to stepic as the encoder, which suggested running stepic in decode mode to extract the LSB-embedded payload from the RGBA pixel data.

   Run Stepic in decode mode against upz.png. It walks each pixel's low bits and prints the embedded ASCII flag. If the default zsteg fallback finds nothing, brute-force bit depths with zsteg -b. For paranoia, stegoVeritas upz.png --all runs statistical tests to confirm LSB embedding before you keep digging.

   bash

   stepic -d -i upz.png

   Copied!

   bash

   # Fallback if Stepic isn't installed:

   Copied!

   bash

   zsteg upz.png

   Copied!

   bash

   # zsteg tries multiple bit planes and encodings; if default misses, brute-force:

   Copied!

   bash

   zsteg upz.png -b 1,2,3,4

   Copied!

   What didn't work first

   Tried: Using steghide to decode the PNG with steghide extract -sf upz.png.

   Steghide only supports JPEG and BMP carrier formats, not PNG. Running it against upz.png produces an error about an unsupported file format. The challenge uses Stepic, which encodes LSB payloads specifically into PNG pixel channels. Use stepic or zsteg instead.

   Tried: Running stepic -e -i upz.png (encode flag) instead of stepic -d -i upz.png (decode flag).

   The -e flag encodes a new message into the image and requires a message argument, so it will prompt for input or error out. The correct flag is -d for decode, which reads the existing LSB payload out of the image. Mixing up encode and decode is common when first learning a tool's CLI.

   Learn more

   The PNG format is particularly well-suited for steganography because it uses lossless compression. JPEG images use lossy compression, which discards fine-grained pixel differences during encoding - destroying LSB-embedded data in the process. PNG preserves every pixel value exactly, so LSB payloads survive saving and sharing. This is why most LSB steganography challenges use PNG or BMP files.

   Detecting LSB steganography statistically is possible through histogram analysis: LSB embedding creates subtle patterns in the distribution of pixel values that deviate from natural images. Tools like StegoVeritas and academic tools like StegExpose perform these statistical tests to detect the presence of hidden data without knowing the message content. In practice, simple single-bit LSB embedding is easily detected; more sophisticated algorithms like F5 and JPEG steganography with perceptual modeling are harder to detect.

   This challenge is a great introduction to the broader field of digital watermarking and information hiding, which has legitimate applications in copyright protection, covert communications research, and digital forensics (detecting when images have been modified or contain hidden content).

Flag

Any other LSB steganography decoder (zsteg, StegSolve, etc.) works too; the payload is short plaintext.