1. Steganography Siddarth Senthilkumar
GreyHat CTF Meeting 3
Steganography
Siddarth Senthilkumar

2. What is Steganography?
Wikipedia: “the practice of concealing a file, message, image, or video within another file, message, image, or video. ”
Not just digital – physical stego exists as well.
Think invisible ink, hiding messages in portraits, etc.

3. Why is it useful? Encrypted data sticks out like a sore thumb.
Pretty obvious something is hidden ->
Crypto – We have a third party that can look at our information, know we are hiding something, but can’t decipher it.
Stego – We have a third party that we don’t want to know about our communication at all!
qANQR1DBwU4D/TlT68XXuiUQCADfj2o4b4aFYBcWumA7hR1Wvz9rbv2BR6WbEUsy
ZBIEFtjyqCd96qF38sp9IQiJIKlNaZfx2GLRWikPZwchUXxB+AA5+lqsG/ELBvRa
c9XefaYpbbAZ6z6LkOQ+eE0XASe7aEEPfdxvZZT37dVyiyxuBBRYNLN8Bphdr2zv
z/9Ak4/OLnLiJRk05/2UNE5Z0a+3lcvITMmfGajvRhkXqocavPOKiin3hv7+Vx88
uLLem2/fQHZhGcQvkqZVqXx8SmNw5gzuvwjV1WHj9muDGBY0MkjiZIRI7azWnoU9
3KCnmpR60VO4rDRAS5uGl9fioSvze+q8XqxubaNsgdKkoD+tB/4u4c4tznLfw1L2
YBS+dzFDw5desMFSo7JkecAS4NB9jAu9K+f7PTAsesCBNETDd49BTOFFTWWavAfE
gLYcPrcn4s3EriUgvL3OzPR4P1chNu6sa3ZJkTBbriDoA3VpnqG3hxqfNyOlqAka
mJJuQ53Ob9ThaFH8YcE/VqUFdw+bQtrAJ6NpjIxi/x0FfOInhC/bBw7pDLXBFNaX
HdlLQRPQdrmnWskKznOSarxq4GjpRTQo4hpCRJJ5aU7tZO9HPTZXFG6iRIT0wa47
AR5nvkEKoIAjW5HaDKiJriuWLdtN4OXecWvxFsjR32ebz76U8aLpAK87GZEyTzBx
dV+lH0hwyT/y1cZQ/E5USePP4oKWF4uqquPee1OPeFMBo4CvuGyhZXD/18Ft/53Y
WIebvdiCqsOoabK3jEfdGExce63zDI0=
=MpR

4. Sample Problems
Go ahead and download the sample problems I’ve got on my GitHub
Problem 1 – pretty easy
Problem 2 – more difficult, just don’t overthink too much.
Problem 3 – From last time – Brachiosarus – Look up “File headers”

5. Problem 1 - GIF SOLUTION:
Notice that frame seems to jump near the end of the animation.
This suggests that the bytes of the animation may have been manipulated near the end of the file.
Indeed, opening the GIF in a hex editor and looking near the end of the file reveals the magic text:
flagisgandalfthebest

6. Problem 2 - Coney SOLUTION: Again, let’s open it up in a Hex editor.
Everything looks like random garbage until we come up to this:
U2FsdGVkX1/seMYknjQGW971EboRgFcx+jfczzdSrWMjt1xwRrPnQBbEsz+Mt7dA4xxs OVB88e8VGl70
Looks like a cipher of some kind! But which one?
Problem title is “Coney”, a type of rabbit. Is there anything like a “rabbit cipher”?
There is! We look it up and find this website:
Enter the encrypted text. But we need a key. What’s a good key to guess? How about “rabbit”?
Solution: who_knew_there_is_a_rabbit_cipher

7. Problem 3 - Brachi Open it in a hex editor.
Notice there is a “PK” somewhere near the end of the file.
PK is the file header of zip files.
This indicates that this file might actually not be an image, it’s a zip!
Find the first instance of PK, and copy everything from that point on to the end.
Open a new file in the hex editor, paste in the hex you copied, and save it as a zip file.
Unzip the file to view its contents.
There are many files in the zip file, but one is interesting: whatAFineKeyThisIs.
In it, there is some suspicious text that looks like it’s been enciphered. Run it through quiucp to get: the lucky number is seventeen
Let’s try going to the file number 17 in the zip file.
Ctrl+F “answer”, and you’ll find the flag.
ANSWER4Y0UREFF0RTSISC1PH3RSANDKRYPT0