| categories:writeups series:Flare-On Challenges 2015
Flare-On Challenges 2015 - #8 gdssagh
Even though there are other writeups for this challenge I would like to post a writeup as it was easily solvable with zsteg, after extracting the image.
First let’s use zsteg with all the method it knows to extract data from images using steganography techniques
$ zsteg -a level8.png
imagedata .. text: "\r\t(%%*,&"
b1,r,msb,xy .. file: Applesoft BASIC program data, first line number 64
b1,rgb,msb,xy .. file: PE32 executable Intel 80386, for MS Windows
b1,bgr,lsb,xy .. file: GLS_BINARY_LSB_FIRST
b2,rgb,msb,xy .. text: "UDDADPAE"
b2,bgr,msb,xy .. text: "|IAEQ@DDD"
b4,r,msb,xy .. text: "Ab@pT&we-b e"
b4,g,msb,xy .. text: "%`$Q\"wTf@"
b4,b,msb,xy .. text: "C$qFqgf#0wpq"
b4,rgb,msb,xy .. text: "BcrpAPpv#"
b4,bgr,msb,xy .. text: "@CrbqP@v s"
b5,bgr,lsb,xy .. file: PGP\011Secret Sub-key -
[...]
That “PE32 executable Intel 80386, for MS Windows” looks interesting. Let’s give it a try!
$ zsteg level8.png -E b1,rgb,msb,xy > output.exe
$ strings output.exe | grep flare
Im_in_ur_p1cs@flare-on.com
Bingo! :D