Hidden in plainsight

exiftool img.jpg

Below is the result of the command.

…/forensics/hidden-in-plainsights ❯ exiftool img.jpg
ExifTool Version Number         : 13.36
File Name                       : img.jpg
Directory                       : .
File Size                       : 73 kB
File Modification Date/Time     : 2025:10:27 20:54:44+08:00
File Access Date/Time           : 2025:10:27 20:59:18+08:00
File Inode Change Date/Time     : 2025:10:27 20:55:25+08:00
File Permissions                : -rw-r--r--
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
JFIF Version                    : 1.01
Resolution Unit                 : None
X Resolution                    : 1
Y Resolution                    : 1
Comment                         : c3RlZ2hpZGU6Y0VGNmVuZHZjbVE9
Image Width                     : 640
Image Height                    : 640
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
Image Size                      : 640x640
Megapixels                      : 0.410

As you can see in the comment, there’s a weird looking string. I would assume it is a base64 encoded string. So I try to decode the string using below command.

echo "c3RlZ2hpZGU6Y0VGNmVuZHZjbVE9" | base64 --decode

Output = steghide:cEF6endvcmQ=

There’s another clue given there, steghide, that means we need to use steghide tool to solve this challenge, but first let’s decode the base64 string given. I would assume that’s the password to be used with steghide.

echo "cEF6endvcmQ=" | base64 --decode

Output = pAzzword

Now that we know what tool to use and the password, we can move on to the next step.

steghide --extract -sf img.jpg -p pAzzword

Output = wrote extracted data to "flag.txt".

I run ls to list all available files inside my directory, and yes there’s a new file created named flag.txt

Next just run cat command to print the content of the text file

cat flag.txt

Output = picoCTF{h1dd3n_1n_1m4g3_1c55ccd0}

Voila!

# picoCTF: Hidden in Plainsight Writeup

Hidden in plainsight

# Curtin CTF 2024 - Writeup