Tags: misc steganography 

Rating:

A picture of a flag was given in the problem:

![flag](https://cdn.discordapp.com/attachments/808487148332122144/971168636595228762/touched.png)

Notice the line at the bottom right, at the link we can use the service to hide data in the same way. We don't have the source code of the service, but we can figure out how the black box works through our examples.

If you try to use images that are too small, the server sends back 500, so it's better to test on a 512x512 black square. The encrypted result did not differ visually in any way (except for the watermark), but differed significantly in binary form.

We had no limit on the length of the text, so for clarity you can pack a short string (like 'AAAAAA') and a long string (like the Harry Potter book) into two different pictures.

binwalk and exiftool don't help us, so the data is hidden in the picture itself (color palette?).

Let's use https://stegonline.georgeom.net to get new information (for clarity it is better to use the picture of Harry Potter, as there are much more changes).

Note that the LSB Half shows us a noisy picture. Also, RGBA list shows that we have a lot of colors, where the value of any channel differs by +-3 => we can try to extract the data by filtering two bits for each channel.

Knowing what we need to work with, let's take the picture with the obvious 'AAAAAA' data and try to unpack it. We can do this using Extract Data, select 0 and 1 bit in all channels and get something like this:

```
11111111110303030303030303030303030303030303030303030...
```

We understand that 0x11 is the letter A. Let's sew the whole ASCII alphabet into the picture and unpack it in the same way.

All that's left is to unpack the original flag picture and replace the binary characters with sensible text.

```
import binascii

alphabet = '''
a021a124a425a560e061e164e465e530
b031b134b435b570f071f174f475f508
8809890c8c0d8d48c849c94ccc4dcd18
9819991c9c1d9d58d859d95cdc5ddd28
a829a92cac2dad68e869e96cec6ded38
b839b93cbc3dbd78f879f97cfc7d
'''

ascii = '!"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~'
alphabet = binascii.unhexlify(alphabet.replace('\n', ''))

flag = '''
b92ca93c2df9993cb1ad306dcdad3988
1848d8dd886d0cdd896c30b9b12cdd99
1989dd8839acdd88dd0d9c4ddd8930ec
2930fc
'''

flag = binascii.unhexlify(flag.replace('\n', ''))
encrypted = []
for c in flag:
encrypted.append(ascii[alphabet.find(c)])
print(''.join(encrypted))
```

Output:
```
sdctf{St3g0nOgrAPHY_AnD_Cl0s3d_SRC_Are_A_FUN_C0mb0}
```