5
$\begingroup$

I've tried different layers in photoshop on this, binwalked it, use strings on it, subtract the image with the original and nothing lead to anything, exiftool it, used stegsolve.jar still nothing. Anyways, here is the image with the message hidden:

enter image description here

original:

enter image description here

And maybe I thought you guys could help me out... there should be some kind of flag in it

Improve this question
$\endgroup$
8
  • $\begingroup$ Since you say "flag", I'm going to guess that this is from some kind of CTF. Which one? $\endgroup$
    – user46002
    Commented Jan 5, 2019 at 18:52
  • 2
    $\begingroup$ @Hugh isn't something open to the "internet" is something in my university, is not any sort of assignment is some sort of game made by some students $\endgroup$
    – C. Cristi
    Commented Jan 5, 2019 at 18:54
  • $\begingroup$ Ah, thank you. Would you classify this as an "ongoing competition"? We don't allow questions that ask for help on competitions (that are live). $\endgroup$
    – user46002
    Commented Jan 5, 2019 at 18:59
  • 1
    $\begingroup$ @Hugh No, I wouldn't actually classify it as a competition $\endgroup$
    – C. Cristi
    Commented Jan 5, 2019 at 19:02
  • $\begingroup$ Alright then. It's good for the site :). I'll take a look when I get home. $\endgroup$
    – user46002
    Commented Jan 5, 2019 at 19:07

1 Answer 1

Reset to default
3
$\begingroup$

Assuming the images were not altered (e.g., compressed) when uploaded, this could be a partial:

When you hex-compare the two images, you find differences in 24 bytes as follows:

Original image: 

 C1,96,DD,A3,9D,93,BB,F1,E2,81,8A,83,BF,E8,85,CD,C1,89,82,9F,A9,E8,E2
Image with message:

 32,73,4A,36,73,2F,38,33,43,2F,2F,37,30,58,72,46,49,78,52,31,48,51,3D

Now, if you look closely, you'll find that in the image with the message...

..all the bytes can be represented as ASCII characters.

So, when converted we find:

2sJ6s/83C//70XrFIxR1HQ=

Which could be:

Base64, however, I tried decoding it with no luck!

Improve this answer
$\endgroup$
4
  • $\begingroup$ Can you please elaborate the conversion part? $\endgroup$
    – alwayslearning
    Commented Jan 6, 2019 at 11:54
  • $\begingroup$ @alwayslearning I made a mistake in my answer, that is, I swapped the "data" of the original image with the other one (just fixed it). If that wasn't the issue and you were actually asking about the mechanism of the conversion, ROT13: Vg'f n fvzcyr urk-gb-NFPVV pbairefvba. Vs lbh pbaireg gur frpbaq urk neenl bs olgrf gb NFPVV, lbh trg gung zrffntr. Lbh pna hfr na bayvar pbairegre sbe gung. Urer'f bar, sbe rknzcyr: uggcf://jjj.encvqgnoyrf.pbz/pbaireg/ahzore/nfpvv-urk-ova-qrp-pbairegre.ugzy $\endgroup$
    – 41686d6564
    Commented Jan 6, 2019 at 12:12
  • $\begingroup$ Are the 24 bytes consecutive? Or is it possible that the order is incorrect? $\endgroup$
    – LeppyR64
    Commented Mar 4, 2019 at 16:52
  • $\begingroup$ @LeppyR64 No, they're not consecutive but I couldn't find a pattern that would help to reorder them. I didn't try that hard though so you may have better luck than me. $\endgroup$
    – 41686d6564
    Commented Mar 4, 2019 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.