Hidden in plainsight picoMini by CMU-Africa Solution

Description

1. Step 1Run exiftool to inspect the image metadata

   Observation

   The title says the clue hides in plain sight inside the file. That points at the image's metadata fields rather than its pixel data, so exiftool is the natural first tool.

   Run exiftool on the downloaded image and look at the Comment field. Instead of a flag, you will find a base64-encoded string: c3RlZ2hpZGU6Y0VGNmVuZHZjbVE9. That string is the first clue.

   bash

   exiftool img.jpg

   Copied!

   What didn't work first

   Tried: Opening the image in a hex editor or viewer to search for hidden text manually

   Hex editors show raw bytes and viewers render pixels, but the EXIF Comment sits in a structured binary segment near the start of the JPEG that is easy to miss without a parser. exiftool walks the Image File Directory and labels every field, so the Comment appears named rather than buried in a wall of bytes.

   Tried: Running strings on the image file to find the base64 comment

   strings does show the base64 comment, but alongside dozens of other sequences from the JPEG header, ICC profile, and thumbnail data, so picking out the meaningful one is guesswork. exiftool labels the field as Comment, which leaves no ambiguity about what to decode.

   Learn more

   EXIF (Exchangeable Image File Format) is a standard for embedding structured metadata inside image files. Tags cover camera model, lens settings, GPS coordinates, timestamps, and a free-form Comment field that can hold arbitrary text. exiftool by Phil Harvey reads every known metadata standard (EXIF, XMP, IPTC) across over 200 file formats and prints them as key-value pairs.

   The Comment field is completely free-form, making it a natural hiding spot in forensics challenges. In this case it holds a base64 string rather than the flag itself, which sets up the next layer of the puzzle.

   • exiftool -Comment img.jpg - show only the Comment field
   • exiftool -all= img.jpg - strip all metadata in place
2. Step 2Double-decode the base64 comment to get the steghide passphrase

   Observation

   The exiftool Comment field holds c3RlZ2hpZGU6Y0VGNmVuZHZjbVE9, which is padded base64. Decoding once gives steghide:cEF6endvcmQ=, whose suffix is base64 again, so a second decode recovers the real passphrase.

   Decode the comment string once: you get steghide:cEF6endvcmQ=. The prefix steghide: names the tool to use; the suffix cEF6endvcmQ= is another base64 string. Decode that second string to reveal the passphrase: pAzzword.

   bash

   echo "c3RlZ2hpZGU6Y0VGNmVuZHZjbVE9" | base64 -d

   Copied!

   bash

   echo "cEF6endvcmQ=" | base64 -d

   Copied!

   What didn't work first

   Tried: Using the raw first-decode output steghide:cEF6endvcmQ= as the steghide passphrase directly

   Passing the whole string, colon and second base64 blob included, makes steghide fail, because the passphrase is only the decoded value of that second segment. The colon is a delimiter between tool name and encoded passphrase, not part of the secret.

   Tried: Trying base64 -d on the original comment string and stopping after a single decode

   One decode gives steghide:cEF6endvcmQ=, which looks like an answer but is still partly encoded. Treat cEF6endvcmQ= as the passphrase and steghide rejects it. Decode that suffix a second time to get the real passphrase, pAzzword.

   Learn more

   Base64 encodes arbitrary binary data as printable ASCII characters, making it safe to embed in text fields like EXIF comments. Double encoding (base64 of base64) is a common trick in CTF challenges to add an extra layer of obfuscation. The first decode reveals the tool name and a second encoded blob; the second decode yields the actual passphrase.

   The naming convention tool:encodedPassphrase in the first decoded string is the challenge author giving you everything you need in one place: the tool to use and the secret to unlock it, separated by a colon.

3. Step 3Extract the hidden file with steghide

   Observation

   The first decode names the tool outright, in the form steghide:encodedPassphrase, and the second gives the passphrase pAzzword. That points straight at running steghide extract on the JPEG.

   Run steghide extract with the passphrase pAzzword. Steghide will write a file called flag.txt to the current directory. Read that file to get the flag.

   bash

   steghide extract -sf img.jpg -p pAzzword

   Copied!

   bash

   cat flag.txt

   Copied!

   Expected output

   picoCTF{h1dd3n_1n_1m4g3_...}

   What didn't work first

   Tried: Running steghide extract without the -p flag and entering pAzzword at the interactive prompt but mis-capitalizing it

   Steghide passphrases are case-sensitive. Typing pazzword or Pazzword instead of pAzzword causes a passphrase error and no output file is written. The exact mixed-case string pAzzword must be used, which is why decoding the base64 precisely rather than guessing is essential.

   Tried: Using stegsolve or zsteg instead of steghide to extract the hidden data

   Stegsolve and zsteg target LSB steganography in PNG bit planes and know nothing about steghide's DCT-coefficient embedding in JPEGs, so they report no data or emit garbage. The decoded EXIF comment names steghide explicitly, so extract with steghide, the -sf flag, and the recovered passphrase.

   Learn more

   Steghide is a steganography tool that conceals data by modifying the least-significant bits of a JPEG's DCT coefficients, the frequency-domain numbers that encode the image. The change is mathematically small and visually undetectable to the human eye, but the hidden bytes are perfectly recoverable with the correct passphrase. This is true steganography: the data is hidden inside the image content, not just in metadata.

   The challenge title "hidden in plainsight" points to both layers: the passphrase is hiding in plain sight in the EXIF comment (if you know to look and decode it), while the flag itself is hidden inside the image using steghide.

   • steghide --info img.jpg - check whether steghide data is present without extracting
   • steghide extract -sf img.jpg - extract interactively (prompts for passphrase)
   • steghide extract -sf img.jpg -p pAzzword - extract non-interactively with the passphrase

Flag

The hash suffix in the flag is unique per challenge instance, so your flag will differ from others. The format is picoCTF{h1dd3n_1n_1m4g3_<hash>}.