20
$\begingroup$

So I've been trying to solve this Riddle called "Phage is Spreading.."

To complete stage one is an achievement.
To complete the test is talent.
Talent will be rewarded.

Good luck.

-Phage

Images given:

enter image description here

enter image description here

What I tried was decrypt the second Image using a QR-Code decoder.

This is what I got:

01011000 01010100 01011001 01000101 01100111 00111000 01011010 01010110 00110100 01100100 01110100 01110111 01110110 01111001 01101001 01100101 01010000 01001011 00101111 01111010 01110001 01011001 00110111 01000001 01010000 01000101 00110100 01111001 01100011 01010110 01000100 01110001 01100101 01001000 01001000 01101101 01110110 01101001 01101101 01100001 01010110 00110100 01101011 00111101

Welcome to the Phage Test. Key is the Key to Success.

Good luck.

-Phage

I took the binary values and it gives me the following hash:

XTYEg8ZV4dtwvyiePK/zqY7APE4ycVDqeHHmvimaV4k=

If you take the base64 string and use 128-bit AES decryption with the code Key then you get the following ASCII string:

a6086de16e0c4476af46d773cd0342be

Now I'm not sure what I should do with this string. I believe the AES decrypted result is consistent with MD5 length, but I'm not sure.

Maybe the clue hides within the first image given. But how should I use steganography to decrypt the code?

Improve this question
$\endgroup$
8
  • 3
    $\begingroup$ The name comes from the picture which is of a bacteriophage (virus that infects bacteria). $\endgroup$
    – aidanh010
    Oct 28 '16 at 2:11
  • $\begingroup$ Yup, but I am not sure what I could get from this information... $\endgroup$
    – Coto TheArcher
    Oct 28 '16 at 9:12
  • 1
    $\begingroup$ Are you sure the first image as provided is a jpeg? I did a visual attack on the pixels and nothing suspicious stood out (not that I was expecting it for this format). Maybe we're supposed to use a popular jpeg steganography algorithm? My initial guesses would be Jsteg, StegHide, Outguess and F5, all very old. I know some of them also require a password in order to retrieve the data. However, I don't have to time to try them right now. I've also checked the final bytes of the image and they are indeed FF D9, which is the end-of-file marker for jpeg, so I doubt there is any data past that. $\endgroup$
    – Reti43
    Oct 28 '16 at 13:21
  • 1
    $\begingroup$ Haha just as a simple heyy, I wonder moment; I tried to convert from hexadecimal to plain text and got ¦mán Dv¯F×sÍB¾. I knew it was a long shot, but that's an awesome looking string. $\endgroup$
    – Taco タコス
    Aug 23 '18 at 17:20
  • 2
    $\begingroup$ it seems like final hex string is an aes key that decrypts first image using AES-ECB mode. After that original image probably have some text embedded inside which will give the result. $\endgroup$
    – shyos
    Nov 18 '19 at 15:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.