Challenge Overview
A file named logs.txt containing what appeared to be a single block of encoded text rather than log entries. The string began with iVBORw0KGgo — the Base64 encoding of the PNG magic bytes \x89PNG\r\n\x1a\n. This is a recognizable pattern that immediately identifies the file type without decoding.
Exploitation Chain
Step 1 — Decode the Base64 to recover the PNG
base64 -d logs.txt > decoded_output
file decoded_output
# decoded_output: PNG image data, 896 x 1152, 8-bit/color RGB, non-interlacedStep 2 — Check PNG chunk metadata
import struct
with open('decoded_output', 'rb') as f:
data = f.read()
pos = 8
while pos < len(data):
length = struct.unpack('>I', data[pos:pos+4])[0]
chunk_type = data[pos+4:pos+8].decode('ascii', errors='replace')
print(f'Chunk: {chunk_type}, Length: {length}')
pos += 12 + lengthOnly standard IHDR, IDAT, IEND chunks — no hidden metadata. The data must be visible in the image itself.
Step 3 — OCR the image
python3 -c "
import pytesseract
from PIL import Image
print(pytesseract.image_to_string(Image.open('decoded_output')))
"
# Output included: 7069636F4354467B...7DStep 4 — Decode the hex string
python3 -c "print(bytes.fromhex('7069636F4354467B...7D').decode())"
# picoCTF{forensics_analysis_is_amazing_be860279}The Full Chain
logs.txt (Base64)
→ base64 -d → PNG image (896×1152)
→ Tesseract OCR → hex string
→ bytes.fromhex() → flag
Key Insight: Memorize
iVBORw0KGgo as Base64 PNG — it appears constantly in CTF forensics. After decoding, always run file before assuming content type. When PNG chunk metadata is clean, the hidden data is likely visible in the pixels themselves — OCR is a valid and often overlooked forensics technique.