Challenge Overview
A JPEG image with a hidden payload embedded using steghide. The extraction password was encoded in Base64 and stored in the JPEG's comment metadata field — discoverable with the strings command or exiftool.
Extraction
Step 1 — Inspect strings in the binary
strings img.jpg | grep -i "steg\|base64\|password\|hint"
# Output:
comment: "c3RlZ2hpZGU6Y0VGNmVuZHZjbVE9"Step 2 — Decode the comment (double Base64)
echo "c3RlZ2hpZGU6Y0VGNmVuZHZjbVE9" | base64 -d
# steghide:cEF6endvcmQ=
echo "cEF6endvcmQ=" | base64 -d
# pAzzwordStep 3 — Extract the hidden file
steghide extract -sf img.jpg -p "pAzzword"
# wrote extracted data to "flag.txt"
cat flag.txtForensics Toolkit
| Tool | Purpose |
|---|---|
strings | Extract printable strings from binary files — quick first pass on any forensics file |
file | Identify file type from magic bytes |
exiftool | Read/write metadata from images, PDFs, audio files |
steghide | Embed/extract data hidden in JPEG and BMP files |
binwalk | Scan for embedded files and firmware signatures |
zsteg | Detect LSB steganography in PNG and BMP files |
Key Insight: JPEG metadata fields are a common CTF hiding spot. Always run
strings and exiftool as a first pass on any image file before reaching for steganography tools. When you see a Base64-looking string in metadata, decode it — and then decode it again, because double-encoding is common.