4
$\begingroup$

I've tried different layers in photoshop on this, binwalked it, use strings on it, subtract the image with the original and nothing lead to anything, exiftool it, used stegsolve.jar still nothing. Anyways, here is the image with the message hidden:

enter image description here

original:

enter image description here

And maybe I thought you guys could help me out... there should be some kind of flag in it

$\endgroup$
  • $\begingroup$ Since you say "flag", I'm going to guess that this is from some kind of CTF. Which one? $\endgroup$ – Hugh Jan 5 at 18:52
  • 2
    $\begingroup$ @Hugh isn't something open to the "internet" is something in my university, is not any sort of assignment is some sort of game made by some students $\endgroup$ – C. Cristi Jan 5 at 18:54
  • $\begingroup$ Ah, thank you. Would you classify this as an "ongoing competition"? We don't allow questions that ask for help on competitions (that are live). $\endgroup$ – Hugh Jan 5 at 18:59
  • 1
    $\begingroup$ @Hugh No, I wouldn't actually classify it as a competition $\endgroup$ – C. Cristi Jan 5 at 19:02
  • $\begingroup$ Alright then. It's good for the site :). I'll take a look when I get home. $\endgroup$ – Hugh Jan 5 at 19:07
3
$\begingroup$

Assuming the images were not altered (e.g., compressed) when uploaded, this could be a partial:

When you hex-compare the two images, you find differences in 24 bytes as follows:

Original image:

 C1,96,DD,A3,9D,93,BB,F1,E2,81,8A,83,BF,E8,85,CD,C1,89,82,9F,A9,E8,E2
Image with message:

 32,73,4A,36,73,2F,38,33,43,2F,2F,37,30,58,72,46,49,78,52,31,48,51,3D

Now, if you look closely, you'll find that in the image with the message...

..all the bytes can be represented as ASCII characters.

So, when converted we find:

2sJ6s/83C//70XrFIxR1HQ=

Which could be:

Base64, however, I tried decoding it with no luck!

$\endgroup$
  • $\begingroup$ Can you please elaborate the conversion part? $\endgroup$ – alwayslearning Jan 6 at 11:54
  • $\begingroup$ @alwayslearning I made a mistake in my answer, that is, I swapped the "data" of the original image with the other one (just fixed it). If that wasn't the issue and you were actually asking about the mechanism of the conversion, ROT13: Vg'f n fvzcyr urk-gb-NFPVV pbairefvba. Vs lbh pbaireg gur frpbaq urk neenl bs olgrf gb NFPVV, lbh trg gung zrffntr. Lbh pna hfr na bayvar pbairegre sbe gung. Urer'f bar, sbe rknzcyr: uggcf://jjj.encvqgnoyrf.pbz/pbaireg/ahzore/nfpvv-urk-ova-qrp-pbairegre.ugzy $\endgroup$ – Ahmed Abdelhameed Jan 6 at 12:12
  • $\begingroup$ Are the 24 bytes consecutive? Or is it possible that the order is incorrect? $\endgroup$ – LeppyR64 Mar 4 at 16:52
  • $\begingroup$ @LeppyR64 No, they're not consecutive but I couldn't find a pattern that would help to reorder them. I didn't try that hard though so you may have better luck than me. $\endgroup$ – Ahmed Abdelhameed Mar 4 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.