CTFtime.org / S.H.E.L.L. CTF / Hidden inside 2 / Writeup

Tags: steganography png lsb

Rating:

[All WriteUps for this CTF here](https://github.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21): https://github.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21
![S.H.E.L.L.CTF](https://raw.githubusercontent.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21/main/banner.png)

# Hidden Inside 2

We were provided [this image](https://github.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21/blob/main/Forensics/Hidden%20Inside%202/HIDDEN_INSIDE_2.jpeg?raw=true).

It says .jpeg but running `file` on it tells us it's a PNG. So I upload it to https://stegonline.georgeom.net/upload to test different thing on it.

While browsing the bit planes I've noticed a thin line on the green layer 0:
![green_0](https://github.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21/blob/main/Forensics/Hidden%20Inside%202/green_0.png?raw=true)

So I switched to extract data and selected that layer:
![extract_data](https://github.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21/blob/main/Forensics/Hidden%20Inside%202/extract_data.png?raw=true)

The result had a PNG magic number so I downloaded it:
![extracted_data](https://github.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21/blob/main/Forensics/Hidden%20Inside%202/extracted_data.png?raw=true)

Original writeup (https://github.com/ipv6-feet-under/WriteUps-S.H.E.L.L.CTF21/tree/main/Forensics/Hidden%20Inside%202).