# treasure-hunt

## Steganography - Treasure Hunt CTF

| Info     | Details                   |
| -------- | ------------------------- |
| Category | Forensics - Steganography |
| Points   | Easy                      |

## Challenge Overview

> This challenge is about analyzing a photo (**Steganography**).

Commands such as **binwalk**, **exiftool** could be helpful but the one which we needed was **zsteg**.

> **Note:** zsteg is a command-line tool for detecting hidden data in PNG and BMP files. It analyzes image bit planes (like LSB) to uncover embedded messages, text, or files.

***

## Steps

### 1. Detect Hidden Data

Using `zsteg -a` on the PNG:

```
zsteg -a flag.png
```

Revealed us in the very first line this info:

```
b1,rgb,lsb,xy       .. text: "{\"bottle\":\"Ahoy! I be hopin' ye fancy a good ol' treasure hunt!\", \"course\": \"RB1\"}r"
```

> Something is embedded in the **LSB (Least Significant Bits)**.\
> In this case the script searched for the LSB in **RGB channels**.

Right at the end of the line we see:

```
"course": "RB1"},
```

Which is a crucial information because this made me think about **Red, Blue, 1**.

***

### 2. Extract Channels

I used a powerful online tool to analyze the bits from this .png:\
&#x20;<https://georgeom.net/StegOnline/image>

> First, I extracted the **Red and Blue channel bits** from bit plane 1, then downloaded all data as a **.bin** file.\
> (Do not forget to put the right order of the bit plane - In this case, it is **RBG** because Red and Blue come first.)

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FsBbWM0lN0cAgkbSnM6Kq%2Frb1.png?alt=media&#x26;token=64463d79-eeec-4345-a62b-517ba38fc319" alt="" width="563"><figcaption><p>Red, Blue, 1</p></figcaption></figure>

***

### 3. Analyze Extracted Data

When we analyze the extracted data, we find another message.

```
strings extracted_data | grep -i "course"
```

Output:

```
{"bottle":"Arrr, the great Capn Red Beard be sailin' the Seven Seas in search o the almighty flag!", "course": "R2"}
```

> And do the same pattern again and again, until we get this:

```
"treasure": "UEsDBDMAAQBjAAO9WFoAAAAAWgAAAEUAAAAIAAsAZmxhZy50eHQBmQcAAgBBRQMIAFhOyFF8J1TyG2doQcYvrgzortHSCGMNxMshPDobNzagEPb3jVJi8820aRecsizN1F01EToNfBXNYLUo7v4irZDLka8iLR9HfkY0xgT+GE/9MxamvgIZHDogalBLAQI/ADMAAQBjAAO9WFoAAAAAWgAAAEUAAAAIAC8AAAAAAAAAIAAAAAAAAABmbGFnLnR4dAoAIAAAAAAAAQAYAEVPEqsEh9sBAAAAAAAAAAAAAAAAAAAAAAGZBwACAEFFAwgAUEsFBgAAAAABAAEAZQAAAIsAAAAAAA=="
```

***

### 4. Decode Base64

> It is clearly a **base64 encoded** line, so when we go to **Cyberchef** to decode it, it appears to be a **.zip file**.\
> (Used *Save output to file* option in Cyberchef)

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FcpBjRHnEFHY5CICDt2Xj%2F.zip%20file.png?alt=media&#x26;token=492be8c6-2934-4aed-b0d3-d61755f8cf20" alt=""><figcaption><p>.zip file in b64</p></figcaption></figure>

It has a password so we should crack it in order to see the content of **flag.txt**.\
I used **John the Ripper** tool for this one.

```
zip2john download.zip > hash.txt
john hash.txt (You can either use rockyou wordlist or not)
```

And the password that we're looking for is:

> **banana**

***

### 5. Extract Final File

```
7z x download.zip -pbanana
```

> There we see **flag.txt**.

***

## Final Flag

```
CTF{1f8915fa52fbf862ba636d69f39427dd8aeb4a9e7b28afc5a36fd70d6db580ac}
```

made by k0d
