44
$\begingroup$

http://imgur.com/r6n5cBe

In the image above apparently has a hidden link?? I don't know how to do this (even if it may seem simple for some) however I don't believe it's anything malicious. It's a part of a puzzle, but even I don't get where it will ultimately lead.

$\endgroup$

migrated from security.stackexchange.com Feb 27 '15 at 8:50

This question came from our site for information security professionals.

  • 1
    $\begingroup$ pastebin.com/szEs3Hhq $\endgroup$ – user5949 Feb 26 '15 at 3:53
  • 2
    $\begingroup$ Check out this page on wikipedia to learn about steganography: en.wikipedia.org/wiki/Steganography $\endgroup$ – Eric G Feb 26 '15 at 3:56
  • $\begingroup$ Some sites on SE have the ability to post an answer, but is hidden until clicked. Does that feature exist on Sec.SE? May be good for Red/Blue teams scenarios / documentation $\endgroup$ – makerofthings7 Feb 26 '15 at 4:54
  • 1
    $\begingroup$ I've managed to follow the puzzle up until the clue is TITLEOFJPG. Can you direct us to where you found the image? A reverse Google Image search turns up nothing. $\endgroup$ – Cole Johnson Feb 26 '15 at 5:35
  • 1
    $\begingroup$ @GabrielSantos How did you find that URL? $\endgroup$ – Cole Johnson Feb 26 '15 at 5:36
46
$\begingroup$

We begin by using steghide to reveal the payload:

http://pastebin.com/szEs3Hhq

The link brings us to a paste where we get

you've done well. Go deeper, and the rewards can be found. Difficulty will increase as you solve each test.
May you find your meaning.

486578206973206561737920656e6f7567682e204e65656420746f20676f206465657065723f0d0a0d0a4441426d696e46236d696e47444741

Let the hunt begin.

The 0d0a in there looks very suspicious (\r\n in C-like languages). Could it be a hex encoded ASCII string? Decoding gets us:

Hex is easy enough. Need to go deeper?

DABminF#minGDGA

A chord progression? For D Major, that is I V vi iii IV I IV V. A Google search doesn't turn up anything. Maybe just search the chord names? (EDIT: It's Pachelbel's "Canon in D")

That turns up a Reddit /r/N001109 post and a Youtube video of the numbers 0 0 1 1 2 1 (rajb245 suggested the beeps heard could be Morse Code). So I try /r/N001121 and its only post. Dead end. Back to the original /r/N001109 post. There's a single comment:

150 164 164 160 163 072 057 057 167 167 167 056 162 145 144 144 151 164 056 143 157 155 057 162 057 116 060 061 061 060 070 057 015 012 015 012 123 110 101 114 114 040 127 105 077 040

Looks like octal. It decodes to (there's a space after the question mark):

https://www.reddit.com/r/N01108/

SHALL WE? 

Following that takes us to /r/N01108 (obviously) with its only post:

060 061 060 061 060 061 061 061 040 060 061 060 060 061 060 060 060 040 060 061 060 060 060 061 060 061 040 060 061 060 060 061 061 061 060 040 060 060 061 060 060 060 060 060 040 060 061 060 060 060 061 060 060 040 060 061 060 060 061 061 061 061 040 060 061 060 060 060 061 060 061 040 060 061 060 061 060 060 061 061 040 060 060 061 060 060 060 060 060 040 060 061 060 061 060 061 060 060 040 060 061 060 060 061 060 060 060 040 060 061 060 060 060 061 060 061 040 060 060 061 060 060 060 060 060 040 060 061 060 061 060 060 061 060 040 060 061 060 060 060 060 060 061 040 060 061 060 060 060 060 061 060 040 060 061 060 060 060 060 061 060 040 060 061 060 060 061 060 060 061 040 060 061 060 061 060 061 060 060 040 060 060 061 060 060 060 060 060 040 060 061 060 060 061 060 060 060 040 060 061 060 060 061 061 061 061 040 060 061 060 060 061 061 060 060 040 060 061 060 060 060 061 060 061 040 060 060 061 060 060 060 060 060 040 060 061 060 060 060 061 060 061 040 060 061 060 060 061 061 061 060 040 060 061 060 060 060 061 060 060 040 060 060 061 061 061 061 061 061 040 060 060 060 060 061 060 061 060 040 060 061 060 060 061 061 060 060 040 060 061 060 060 060 060 061 061 040 060 061 060 060 060 060 060 061 040 060 061 060 061 060 060 061 060 040 060 061 060 061 060 060 061 060 040 060 061 060 060 061 061 061 061 040 060 061 060 060 061 061 060 060 040 060 061 060 060 061 061 060 060 040 060 060 061 060 060 060 060 060 040 060 061 060 060 060 061 061 061 040 060 061 060 061 060 061 060 061 040 060 061 060 061 060 061 060 060 040 060 061 060 060 060 061 060 061 040 060 061 060 060 061 061 061 060 040 060 061 060 060 060 060 061 060 040 060 061 060 060 060 061 060 061 040 060 061 060 061 060 060 061 060 040 060 061 060 060 060 061 061 061 040 060 060 061 060 060 060 060 060 040 060 061 060 061 060 060 060 060 040 060 060 061 061 060 060 061 060 040 060 060 061 061 060 061 060 061 040 060 061 060 060 061 061 060 060 040 060 060 061 061 060 060 061 061 040 060 060 061 061 060 061 060 061 040 060 060 061 060 061 061 061 061 040 060 060 061 061 060 060 061 061 040 060 060 061 061 060 061 061 060 040 060 060 060 060 061 060 061 060 040 060 060 061 061 060 060 060 061 040 060 061 060 060 061 061 060 061 040 060 061 060 060 061 061 061 061 040 060 061 060 060 061 061 061 060 040 060 061 060 061 060 061 060 060 040 060 061 060 060 061 060 060 060 040

Another octal encoded string (with another random space at the end)!

01010111 01001000 01000101 01001110 00100000 01000100 01001111 01000101 01010011 00100000 01010100 01001000 01000101 00100000 01010010 01000001 01000010 01000010 01001001 01010100 00100000 01001000 01001111 01001100 01000101 00100000 01000101 01001110 01000100 00111111 00001010 01001100 01000011 01000001 01010010 01010010 01001111 01001100 01001100 00100000 01000111 01010101 01010100 01000101 01001110 01000010 01000101 01010010 01000111 00100000 01010000 00110010 00110101 01001100 00110011 00110101 00101111 00110011 00110110 00001010 00110001 01001101 01001111 01001110 01010100 01001000 

Huh. Octal encoded binary encoded ASCII?

WHEN DOES THE RABBIT HOLE END?
LCARROLL GUTENBERG P25L35/36
1MONTH

A reference to the Gutenberg project and Alice in Wonderland (the post is titled "alice")? The PDF's 25th page, lines 35 and 36 read:

'If everybody minded their own business,' the Duchess said in a hoarse growl, 'the world
would go round a deal faster than it does.'

That's a dead end for what I will assume to be a month. Back to the post, let's look at the comment:

newsyyyodhfssnviqwlbjnyqibxaeytcuy.kumetgn.bij

Maybe its reply?

31 32 34 20 31 31 31 20 31 32 34 20 31 31 34 20 31 30 35 20 31 31 37 20 31 30 36 20 31 31 32 20 31 32 30 20 31 30 37

Looks like hex. Decoding gets us:

124 111 124 114 105 117 106 112 120 107

An octal string. Decoding gets us:

TITLEOFJPG

Could the jumbled string of letters be a string encrypted with the title of the original image? Now we're stuck because we don't know the original name. I tried a reverse Google Image search, but that turned up nothing.

$\endgroup$
  • 2
    $\begingroup$ I at first didn't recognize it, but after playing it on my guitar, it sounds like that chord progression is Pachelbel's Canon. Wikipedia's "Analysis" section confirms this. Not sure how that fits in here yet. $\endgroup$ – Cole Johnson Feb 26 '15 at 5:30
  • $\begingroup$ TITLEOFJPG: check the exif data on the original image? $\endgroup$ – Jeff Ferland Feb 26 '15 at 5:46
  • $\begingroup$ @JeffFerland I found a slightly different copy at i.imgur.com/LMpMPUD.jpg, but both that and the original turn up nothing. AFAICT, the one not hosted on Stack Imgur is only different in that it has a JFIF EXIF tag. Image data is identical. $\endgroup$ – Cole Johnson Feb 26 '15 at 5:51
  • $\begingroup$ This is brilliant !! Gabriel got his answer from what I believe to be a series of "grey dots" that can be found in the source image . Converting the image to a ppm then performing a hex dump gives a pattern that I didn't have time to study at work $\endgroup$ – Damian Nikodem Feb 26 '15 at 7:50
  • 4
    $\begingroup$ are you benjamin gates? $\endgroup$ – user3453281 Feb 27 '15 at 18:19
5
$\begingroup$

Taking a similar path like Cole Johnson but with a different result.

Starting with the first comment: pastebin.com/szEs3Hhq by Gabriel Santos. This is the biggest doubt. I do not see a hint that the URL is embedded in that image.

Of course I find:

you've done well. Go deeper, and the rewards can be found. Difficulty will increase as you solve each test.
May you find your meaning.

486578206973206561737920656e6f7567682e204e65656420746f20676f206465657065723f0d0a0d0a4441426d696e46236d696e47444741

Let the hunt begin.

Decoding the hex gives:

irb(main):002:0> str = "486578206973206561737920656e6f7567682e204e65656420746f20676f206465657065723f0d0a0d0a4441426d696e46236d696e47444741"
=> "486578206973206561737920656e6f7567682e204e65656420746f20676f206465657065723f0d0a0d0a4441426d696e46236d696e47444741"
irb(main):005:0> str.to_byte_string  
=> "Hex is easy enough. Need to go deeper?\r\n\r\nDABminF#minGDGA"

Googling DABminF#minGDGA has a YouTube video as first hit https://www.youtube.com/watch?v=R_z2MKvyals The narrator says N0112. The video looks like this. Note the 434 in the upper left corner enter image description here

Finding this post https://www.reddit.com/r/N001121. Which now has a second comment.

66 61 40 66 66 40 66 60 40 64 60 40 66 61 40 66 64 40 66 61 40 64 60 40 66 61 40 66 66 40 66 63 40 64 60 40 66 61 40 66 66 40 66 64 40 64 60 40 66 61 40 66 64 40 66 65 40 64 60 40 66 61 40 66 64 40 66 62 40 64 60 40 66 61 40 66 65 40 66 61 40 64 60 40 66 61 40 66 65 40 66 66 40 64 60 40 66 64 40 66 60 40 64 60 40 66 61 40 66 65 40 66 63 40 64 60 40 66 66 40 66 62 40 64 60 40 66 66 40 66 65 40 64 60 40 66 61 40 66 63 40 66 61 40 64 60 40 66 61 40 66 65 40 66 61 40 64 60 40 66 61 40 66 61 40 66 60 40 64 60 40 66 61 40 66 64 40 66 66 40 64 60 40 66 61 40 66 62 40 66 62

Authenticity is questionable; could be created by a freeloader. Nevertheless, I continue.

irb(main):007:0> str2 = '66 61 40 66 66 40 66 60 40 64 60 40 66 61 40 66 64 40 66 61 40 64 60 40 66 61 40 66 66 40 66 63 40 64 60 40 66 61 40 66 66 40 66 64 40 64 60 40 66 61 40 66 64 40 66 65 40 64 60 40 66 61 40 66 64 40 66 62 40 64 60 40 66 61 40 66 65 40 66 61 40 64 60 40 66 61 40 66 65 40 66 66 40 64 60 40 66 64 40 66 60 40 64 60 40 66 61 40 66 65 40 66 63 40 64 60 40 66 66 40 66 62 40 64 60 40 66 66 40 66 65 40 64 60 40 66 61 40 66 63 40 66 61 40 64 60 40 66 61 40 66 65 40 66 61 40 64 60 40 66 61 40 66 61 40 66 60 40 64 60 40 66 61 40 66 64 40 66 66 40 64 60 40 66 61 40 66 62 40 66 62'
#Some iterations of adding more and more transformations. 
#Converting from  octed and decimal in several iterations
#Finally this turns up:
irb(main):025:0> str2.split(" ").collect do |x| x.oct end.collect do |x| x.chr end.join("").split(" ").collect do |x| x.oct end.collect do |x| x.chr end.join("").split(" ").collect do |x| x.oct end.collect do |x| x.chr end.join ""
=> "pastebin k25YiHfR"

This pastebin URL shows this (http pastebin dot com/ k25YiHfR):

YjI1bElHUmhlU0J0WVhKcGJ5QjNiMnRsSUhWd0lHRnVaQ0JrWldOcFpHVmtJSFJ2SUhSaGEyVWdZU0J6YUdsMElHSmxZMkYxYzJVZ2FHVjVJR2hsSjNNZ2JXRnlhVzh1SUhOdklHMWhjbWx2SUhkbGJuUWdkWEFnZEc4Z2VXOXphR2tnWVc1a0lITmhhV1FnSW5sdmMyaHBJR2tnZDJGdWRDQjViM1VnZEc4Z1ltVWdiWGtnYzJocGRIUmxjaUlnWVc1a0lITnBibU5sSUhsdmMyaHBJSGRoY3lCdFlYSnBieWR6SUdKcGRHTm9JR2hsSUc5d1pXNWxaQ0JvYVhNZ2JXOTFkR2d1SUcxaGNtbHZJSEIxYkd4bFpDQmtiM2R1SUdocGN5QnpkR0ZwYm1Wa0lHSnlhV1ZtY3lCaGJtUWdZbVZuWVc0Z2RHOGdjMmhwZENCcGJpQjViM05vYVNkeklHMXZkWFJvTGlCNWIzTm9hU0IzWVhNZ1ptOXlZbWxrWkdWdUlIUnZJR1Y0Y0hKbGMzTWdZVzU1SUdWdGIzUnBiMjV6SUdKMWRDQmhkQ0IwYUdseklHMXZiV1Z1ZENCb1pTQjNZWE1nWm1WbGJHbHVaeUIyWlhKNUlHRnliM1Z6WldRdUNtMWhjbWx2SjNNZ1ptRmpaU0IwZFhKdVpXUWdjbVZrSUdGeklHaGxJR2R5ZFc1MFpXUWdZVzVrSUhOMGNtRnBibVZrSUhSdklIQjFjMmdnYUdseklHeHZaeUJ2WmlCemFHbDBJRzkxZENCdlppQm9hWE1nWVhOekxpQm9aU0JtWVhKMFpXUWdZVzVrSUd4cGRIUnNaU0J6YUdsMElIQmhjblJwWTJ4bGN5Qm1iR1YzSUdsdWRHOGdlVzl6YUdrbmN5QmxlV1Z6TGlCNWIzTm9hU2R6SUdWNVpYTWdkR1ZoY21Wa0lIVndMQ0J1YjNRZ1puSnZiU0IwYUdVZ2NHRnBiaUJ2WmlCMGFHVWdjMmhwZENCd1lYSjBhV05zWlhNZ2JtOXlJR1p5YjIwZ2RHaGxJSEJoYVc1MExYQmxaV3hwYm1jZ2MzUmxibU5vSUdOdmJXbHVaeUJtY205dElHMWhjbWx2SjNNZ2RXNTNZWE5vWldRZ1lYTnpMQ0JpZFhRZ1puSnZiU0IwYUdVZ2MyaGxaWElnWldOemRHRnplU0J2WmlCaVpXbHVaeUJ0WVhKcGJ5ZHpJSE5vYVhSMFpYSXVJRzFoY21sdklHNXZkR2xqWldRZ2RHaHBjeUJoYm1RZ1ltVm5ZVzRnZEc4Z1ozSjFiblFnYUdGeVpHVnlMQ0IwWldGemFXNW5JSFJvWlNCb2IzSnVlU0JpWldGemRDNEtiV0Z5YVc4Z2JtOTBhV05sWkNCMGFHRjBJSGx2YzJocElIZGhjeUJtYVdSa2JHbHVaeUJoY205MWJtUWdkMmwwYUNCb2FYTWdaR2x1YnkxM2FXVnVaWElzSUhkb2FXTm9JR2hoWkNCaVpXTnZiV1VnY1hWcGRHVWdaWEpsWTNRdUlDSnpkRzl3SUhSb1lYUWdkR2hwY3lCcGJuTjBZVzUwSWlCamIyMXRZVzVrWldRZ2JXRnlhVzhzSUc1dmRHbGphVzVuSUdocGN5QnZkMjRnTWkxcGJtTm9aWElnZDJGeklHZHliM2RwYm1jZ2FHRnlaQ0JoY3lCM1pXeHNMaUI1YjNOb2FTQjNhR2x1WldRZ1lXNWtJSEpsYkhWamRHRnVkR3g1SUd4dmQyVnlaV1FnYUdseklHaGhibVJ6TGlCM2FYUm9JR0VnWm1sdVlXd2daM0oxYm5RZ1lXNWtJR0VnYzIxbGJHeDVJR1poY25Rc0lHMWhjbWx2SjNNZ2JHOW5JRzltSUhOb2FYUWdabWx1WVd4c2VTQmtjbTl3Y0dWa0lHWnliMjBnYUdseklHRnpjeUJwYm5SdklIbHZjMmhwSjNNZ2JXOTFkR2d1Q20xaGNtbHZJSFIxY201bFpDQmhjbTkxYm1RZ1lXNWtJSGRoZEdOb1pXUWdZWE1nZVc5emFHa2dZMmhsZDJWa0lIUm9aU0J6YUdsMElHeHZaeTRnSW1WaGRDQnBkQ0JpYVhSamFDNGdaV0YwSUdsMElHRnNiQ0lnYzJGcFpDQnRZWEpwYnk0Z2VXOXphR2tnY0hKbGRHVnVaR1ZrSUdobElHaGhkR1ZrSUdSdmFXNW5JSFJvYVhNZ2MyOGdiWFZqYUNCaWRYUWdhR2x6SUhSb2NtOWlZbWx1WnlCM2FXVnVaWElnWVc1a0lHMXZZVzV6SUc5bUlHcHZlU0IwYjJ4a0lHMWhjbWx2SUc5MGFHVnlkMmx6WlM0Z0luTjNZV3hzYjNjZ2FYUWlJRzl5WkdWeVpXUWdiV0Z5YVc4Z1luVjBJSGx2YzJocElHUnBaRzRuZENCM1lXNTBJSFJ2SUhOM1lXeHNiM2NnYVhRZ2VXVjBMaUJvWlNCM1lXNTBaV1FnZEc4Z2MyRjJiM0lnZEdobElITm9hWFF1SUNKVFYwRk1URTlYSUVsVUlGSkpSMGhVSUU1UFZ5SWdjMk55WldGdFpXUWdiV0Z5YVc4Z1lYTWdhR1VnWW1WbllXNGdkMkZ1WnkxemJHRndjR2x1WnlCNWIzTm9hU0JoWTNKdmMzTWdkR2hsSUdaaFkyVXVDbTFoY21sdkxDQm9ZVzVrY3lCdmJpQm9hWE1nYUdsd2N5d2dkR2h5ZFhOMElHaHBjeUJ3Wld4MmFYTWdabkp2YlNCemFXUmxJSFJ2SUhOcFpHVWdZV055YjNOeklIbHZjMmhwSjNNZ1ptRmpaU3dnY0hWdWFYTm9hVzVuSUhSb1pTQnVZWFZuYUhSNUlHUnBibTl6WVhWeUxpQWlXVTlWSUVSUElGZElRVlFnVFVGU1NVOGdWRVZNVEZNZ1dVOVZJaUJvWlNCelkzSmxZVzFsWkM0Z1lXWjBaWElnWVdKdmRYUWdabTkxY25SNUlIZGhibWN0YzJ4aGNITWdhR2x6SUhkcFpXNWxjaUJ6ZEdGeWRHVmtJSFJ2SUdKbFkyOXRaU0J6YjNKbElITnZJR2hsSUhOMGIzQndaV1F1SUdKNUlHNXZkeUIwYUdVZ2MyaHBkQ0JzYjJjZ2FHRmtJR2R2Ym1VZ1pHOTNiaUI1YjNOb2FTZHpJSFJvY205aGRDNGdJbVZuWjNWc1lYUmxJaUJvWlNCdmNtUmxjbVZrTGlCNWIzTm9hU0J6ZEhKaGFXNWxaQ0JoYm1RZ2NISnZaSFZqWldRZ1lXNGdaV2RuTGlCcGJuTnBaR1VnZEdocGN5QmxaMmNnWTI5dWRHRnBibVZrSUhkb1lYUWdkMkZ6SUhCeVpYWnBiM1Z6YkhrZ2FHbHpJSE5vYVhRZ2JHOW5MaUJ0WVhKcGJ5QjNZV3hyWldRZ2IzWmxjaUIwYnlCb2FYTWdjMmhsYkdZZ1lXNWtJSEJzWVdObFpDQnBkQ0IzYVhSb0lIUm9aU0J2ZEdobGNuTXVJR2hsSUdoaFpDQm9kVzVrY21Wa2N5QndiM056YVdKc2VTQjBhRzkxYzJGdVpITWdiMllnZEdobGMyVWdjMmhwZEMxbFoyZHpMaUJvWlNCd2JHRnVibVZrSUhSdklIVnpaU0IwYUdWelpTQmhaMkZwYm5OMElHSnZkM05sY2lCMGFHVWdibVY0ZENCMGFXMWxJR2hsSUd0cFpHNWhjSEJsWkNCd1pXRmphQzQ9

Decoding this twice:

irb(main):027:0> str3 = 'YjI1b.....'
irb(main):034:0> Base64.decode64(Base64.decode64(str3))
=> "<some explicit text about Mario and Yoshi; decode it yourselves>"

Conclusion: The entry point is questionable and if the riddle path was not already corrupted by some freeloader is also possible.

$\endgroup$
  • $\begingroup$ Damn, that Mario and Yoshi story is disgusting. Definitely corruption of the path or trolling on the part of someone (OP? guy who posted the pastebin?) $\endgroup$ – rajb245 Apr 6 '15 at 17:57
  • $\begingroup$ I can confirm that the pastebin is accurate: its encoded using steghide with no password. $\endgroup$ – rajb245 Apr 6 '15 at 18:25
  • 1
    $\begingroup$ How do you see the 434 in the upper left corner (it's just black to me)? Did you change your gamma or something? $\endgroup$ – Cole Johnson Apr 6 '15 at 18:26
  • $\begingroup$ @ColeJohnson It's very faint. Go right up to your screen and you've got a better chance of seeing it. $\endgroup$ – user9377 Jul 1 '15 at 6:07
  • 1
    $\begingroup$ @Kslkgh It must have something to do with gamma for me because I can see it easily on my phone but not my computer $\endgroup$ – Cole Johnson Jul 2 '15 at 16:56
2
$\begingroup$

Some additional "analysis" of the image (potentially useless). All based on the image downloaded here (as a BMP file)

  • Image size 800 x 600 is not suspicious
  • All RGB values are grey-values (No difference in red/green/blue)

    Considering grey-level values in further analysis only.

  • 4843 non-black (non-zero) pixels in total. The image below is a binary-map of those pixels.

Non-zero-pixels-mask

$\endgroup$
  • $\begingroup$ Those random white specs are what I believe contained the pastebin URL (steghide) $\endgroup$ – Cole Johnson Feb 27 '15 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy