Sneaky_Sneaker

Incognito 6.0 CTF

Info	Details
Category	Forensics / Stego
Points	100

Challenge Overview

The challenge start with downloading a .jpg image with a funny cat next to the Nike shoes. The description "Sneaky" could be a hint that the real meaning of the file is hidden in the metadata or something else.

To investigate further, I used binwalk to extract potentially hidden files.

h4ck3r_h1n7.wav

Digging Into the Audio

Once play the .wav file, we hear a hacker-like voice saying:

"The bee lies in the bits nobody hears."

That seemed to be an obviously hint for LSB Steganography to me.

Extracting Hidden Data

Extracting LSB (Least Significant Bits) from it with the following Python3 script was the right solution to get the final flag.

import wave

def extract_lsb(wav_file):
    with wave.open(wav_file, mode='rb') as wav:
        frames = wav.readframes(wav.getnframes())

    bits = []
    for byte in frames:
        bits.append(byte & 1)

    chars = []
    for b in range(0, len(bits), 8):
        byte = bits[b:b+8]
        if len(byte) == 8:
            value = 0
            for bit in byte:
                value = (value << 1) | bit
            chars.append(value)

    extracted = bytes(chars)
    return extracted

if __name__ == "__main__":
    wav_file = "h4ck3r_h1n7.wav"
    output = extract_lsb(wav_file)

    try:
        text = output.decode('utf-8')
        print("[+] Extracted Text:")
        print(text)
    except UnicodeDecodeError:
        print("[+] Extracted Raw Bytes (not UTF-8):")
        print(output)

result

Final Flag

ictf{wh15p3r5_0f_4_gh05t}

made by k0d