Little red riding Tux

Once upon a time, in a land not too far away, and not as distant as you might think in time, as well, there was a little penguin 🐧. And, that penguin went to /etc/secret in Deutschland wearing his little red riding hood, there he met the bad black horned creature and his (maybe bad) friends.

Bad black horned creature and his friends told the little penguin that they were actually good, M$ was the evil one.

(Maybe) good black horned creature and his friends taught little penguin to treasure what he had, especially his smileys.

Good black horned creature and his friends helped little penguin realize that XOR is reversible, and RSA is not the solution to all problems.

Little penguin made a lot of friends, one of them was very talented at hiding stuff inside other stuff, which people call the art of steganography. Little penguin had fun solving those steganography challs, his observation and analysis skills greatly improved. He even created a tool which helps with steganalysis.

Many years have passed, little penguin had grown up to become big penguin. Although busy catching fish and taking care of his kids, big penguin still spent some of his free time catching the flags to relive the great moments of the good old days.

One day big penguin found a strange bottle drifting from the land of the Blue Hens to his island. Actually, many other penguins saw that bottle and tried to read its contents, but all they found was gibberish.

To the big penguin, however, the bottle was like a message from the good old days. He easily figured out the important part and recovered the hidden message.

3DS CTF 2016

3DS CTF was an interesting CTF, which unlike normal CTFs, went on for a whole week. I had plenty of time to enjoy the challenges. Below are write-ups for some of them.

Stego 100: Excaliflag

The file is a png image with nothing hidden in the binary data. Quick analysis with Steganabara shows that there's not much distortion with the RGB values, this means the flag is either hidden in the LSB values, or an advanced method is used. For only 100 points, of course the former is true.

Playing with the blue bits in Steganabara's Bit Mask Filter and you'll get the flag:

Stego 300: 0liver "Imaged"

By looking at the magic bytes in the binary data, it's easy to see that there is a png image appended at the end of the jpg image. Looking at the png image, it's clear that the flag is hidden in the R and G values of the first few lines. Extract the R and G values and you'll get an ELF file that prints out the flag.

Stego 300: We also have memes!

The flag is hidden in the image using an algorithm in which p and offset are unknown. However, they are small enough to be brute-forced. The flag format is 3DS{}, so this is more like a known plain-text attack with the image as the ciphertext.

(to be continued)

Update: not continued because it's been a long time and I don't remember the continuation. Also, I'm busy (and lazy :P)

ASIS CTF Quals 2014

A great CTF with a lot of interesting steganos has ended. Too bad the event took place on workdays, so our team didn't have much time for it (probably many other teams shared the same problem). We ended up at #10, which wasn't too bad :P Below you can find write-ups for a few challs I solved.

Trivia 50: Image

The file was actually an amazing image of the once popular NES game Battle City, and as a fan of Nintendo I had the emulator ready to play it :P Just complete the first stage and you'll get the flag: 8BIT_RULEZ (although it is a bit different from what is written and caused a lot of confusions for everyone :P)

Web 75: Hidden flag

A web challenge with barely any description, however the title suggests that the flag should be hidden somewhere. It didn't take us much time to notice the HTTP header named x-flag with the value ASIS_b6b?244608c2?c2e869cb56?67b64?b1. Now obviously the task was to find the full hash. My first thought was using a dictionary attack to find a string that generates a hash with the same pattern, but because of work I didn't really have any time to try it :P

At one point, some members in our team noticed that when a wrong solution was submitted, the response was almost instant. This suggested that there should be a javascript check somewhere. From here it didn't take much time for us to find the sha256 hash and recover the full flag: ASIS_b6be244608c27c2e869cb56167b649b1

Stego 100: Spy Paper

The image was quite big and it was quite easy for me to overlook every detail :P Fortunately redoc found anomalies in the blue channels and these dots reminded me of punched tape, which was very close to the final solution. We were able to quickly figure out the parity bits and decrypt the second part, however we could not find anything meaningful from the first part:

After a lot of time spending on it, we came to realize that this could be printer steganography, and the first part could be date and time. With that we were able to fully decrypt the flag: 9/6/19 13:22:44 E4sy_0n3.

Crypto 150: Random Image

This isn't a hard chall, the code seems to randomly create a new image based on the flag but in fact there is quite a big correlation between the "random" result and the original one. Specifically, if the value of the pixel is less than 250, the resulting pixel is the result of some operation on the coordinates xored with a random value which is the same for all pixels. We do not know the random value however we know the result of the operation on the coordinates and by xoring the encrypted image with this value all pixels with values less than 250 should stand out. Here is the final result of the decryption:

Stego 175: White noise

This is an easy prey for my powerful Steganabara, and that was the reason why our team quickly became the first solver. A quick histogram analysis shows that the values in the green and blue channels are evenly distributed, and the reason behind this is that they were made to be used as coordinates to rearrange the pixels.

However, the red channel only has 1 value: 128, so it is pointless if you rearrange the whole image, you'll get just a red square. This got me stumped for a little while, until I realized that the order of arrangement could be important too. With this I only used the first 30 lines of the image for rearrangement, and got the flag:

RuCTF Quals 2014

Another great CTF with many challenges in all categories just ended. Our team was #7. Nana. Not too bad, but it was so annoying that without a network specialist we could not solve admin 200 task "Troubleshooting" which 97 other teams solved with ease.

Below are some write-ups. Hopefully they can give new players an introduction to steganalysis.

stegano 100: Cat's eye

This is an easy GIF stegano, but it took me quite a while analysing the image until I noticed it contained 8 similar frames which wasn't easy to notice in GIMP by default (note to myself: next time check the frames first). It is common sense to combine them and find the differences. The positions of the different pixels are as marked below:

It isn't very straightforward, but the flag is hidden here in binary representation. Using black pixels as 0s and green pixels as 1s give you the flag: RUCTF_e4dd9f5cee307b322c3a27abe66e3df9

stegano 300: Nyan-task

This is a very famous image. By finding and comparing it with the original image it can be concluded that there is no information hidden visually. Analysis with Caesum's StegSolve brought me to the conclusion that the only place to hide the flag is inside the palette. It is also suspicious to see only 14 colors used for the image while the palette contains 256 colors with a lot of repetition.

After extracting the palette I found out that this is actually a DataMatrix barcode (thanks stypr). The rest is easy. The hidden text is u.to/P4JUBg, which is a link to the flag: RUCTF_ca8250c2b4b50581afc9ffd1f403f3f2

crypto 200: Mary Queen

The task is to decipher a message written in Chinese characters. The title suggests that this is similar to the cipher used by Mary Queen of Scots, which is a cryptosystem in which simple substitution is used. This cipher is so weak that many tools have been created to solve it automatically, SCBSolvr is one of them. The decrypted text is chapter I of Alice's Adventures in Wonderlands by Lewis Carroll. The name of the book is also the flag.

PHDays CTF Quals 2014

The qualification round just ended today. Our team finished at rank #9. Chinese new year is coming soon so I only managed to catch up with the guys for just a little more than one hour. During that short period of time our team impressed even ourselves by solving 3 challenges and jumped back to top 10. I was involved in 1 of the challs: a ucucuga challenge titled "mp3 me".

The challenge is basically an mp3 stegano. After examining the file we came to a conclusion that there was no where else to hide the flag other than in the id3 part of the file.

Now this is the part where losers are separated from winners. The RGB tags and the presentation of values in triplets make most people try to find a way to get an image, but they are actually just red herrings. The real clue here is the occurrence of NULL. It suggests the end of a message. After trying some conversion, I found out that "78-9c" (hex values of 120-156) was the signature of zlib compressed data, and with that dloser was able to quickly recover the precious flag.

<dloser> >>> zlib.decompress('789ccb8ccf482c498d2f4d06c2f444002a9f05b7'.decode('hex'))
<dloser> 'i_hate_ucucuga'

Solving challenges is fun, and it's even more thrilling when there is a time limit. Oh, it is also good to be able to let everyone know how you solved them, not just limited to the solvers as on normal challenge sites.

Steganabara on Ohloh

I came over Ohloh today while looking at the subversion website for the new update. It looks like a pretty cool social network for open source developers and lovers.

At Ohloh you can promote your software projects and vote on projects you like. So I went on ahead and created a project page for Steganabara: http://www.ohloh.net/projects/steganabara.

If you enjoy this great steganalysis tool you should create an account there, add Steganabara to your stack, write reviews, and vote for it :)

There hasn't been any major update to Steganabara for quite a while. So if you have any idea for improvement, feel free to contact me.

Steganabara project page

Hey guys,

Finally I defeated my laziness and created a project page for Steganabara. It is located here.

There you can find a brief view of the key features, watch and download the latest versions.

Time to finish those evil bara's challenges now. And if you have any idea for improving the tool, feel free to contact me :)

Something for September

Just realized there hasn't been any post for almost a month, although I have been quite active.

On the new pyramid, aka rankk, I have finally secured the first place. Obtained it quite a long time ago, but the place was always taken back by valsa whenever I woke up in the morning. It was not until he had solved the final challenge - 9/1 - that I had a free race. Was there a curse placed upon the Geb title that he has not been able to surpass? If so, I really should take it with care ;)

On TBS, finally I have grabbed 2 more challenges to reach 300. What's even cooler is that one of them is "The Long Forgotten Game" - a really evil chall. With that challenge done now I only have 3 more BaRa's steganos unsolved - Same record as Phas and Inferno - Of course I'll surpass them soon.

A few months ago flamecruiser claimed that he would get TLFG before me. Now I really have taught him who's the new master. quangntenemy is back and kicking! :D