# Sneaky\_Sneaker

| Info     | Details           |
| -------- | ----------------- |
| Category | Forensics / Stego |
| Points   | 100               |

## Challenge Overview

![](https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2F6qsjGfkkXHKrp7xXhNkn%2FScreenshot_1.png?alt=media\&token=c2b43f3a-22a2-4e56-9635-0b561d8f9968)

> The challenge start with downloading a .jpg image with a funny cat next to the Nike shoes. The description "Sneaky" could be a hint that the real meaning of the file is hidden in the metadata or something else.

To investigate further, I used `binwalk` to extract potentially hidden files.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FfSDs8p8Hl14djLks6R82%2Fextracting.png?alt=media&#x26;token=126cfcb3-c41f-49a6-a976-d0fc93f57ce7" alt=""><figcaption><p>h4ck3r_h1n7.wav</p></figcaption></figure>

### Digging Into the Audio

Once play the `.wav` file, we hear a hacker-like voice saying:

> "The bee lies in the bits nobody hears."

That seemed to be an obviously hint for LSB Steganography to me.

### Extracting Hidden Data

Extracting `LSB (Least Significant Bits)` from it with the following `Python3` script was the right solution to get the final flag.

```python
import wave

def extract_lsb(wav_file):
    with wave.open(wav_file, mode='rb') as wav:
        frames = wav.readframes(wav.getnframes())

    bits = []
    for byte in frames:
        bits.append(byte & 1)

    chars = []
    for b in range(0, len(bits), 8):
        byte = bits[b:b+8]
        if len(byte) == 8:
            value = 0
            for bit in byte:
                value = (value << 1) | bit
            chars.append(value)

    extracted = bytes(chars)
    return extracted

if __name__ == "__main__":
    wav_file = "h4ck3r_h1n7.wav"
    output = extract_lsb(wav_file)

    try:
        text = output.decode('utf-8')
        print("[+] Extracted Text:")
        print(text)
    except UnicodeDecodeError:
        print("[+] Extracted Raw Bytes (not UTF-8):")
        print(output)
```

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2F4aKTS0lPG5KniNVGIuwv%2Fscript%20result.png?alt=media&#x26;token=78aef429-ad0e-4eac-8f13-03f7335070cb" alt=""><figcaption><p>result</p></figcaption></figure>

## Final Flag

`ictf{wh15p3r5_0f_4_gh05t}`&#x20;

*made by k0d*
