Rating: 4.5
![](https://gitlab.com/newyork167/ctf/-/raw/main/2022/SDCTF/Forensics/Susan%20Album%20Party/info.png)
We are given a stub of a binary blob. Running `file` we get:
```
original/stub: JPEG image data, progressive, precision 8, 240x320, components 3
```
So it's a jpeg! Let's give it a better filename and see what's inside.
![](https://gitlab.com/newyork167/ctf/-/raw/main/2022/SDCTF/Forensics/Susan%20Album%20Party/stub.jpeg)
So, we see the first part of the flag! Initially I ran through `stegsolve`, `foremost`, and `binwalk` and didn't really get anything out of any of them. So, looking again at the first part of the flag I decided to see how many instances of `\xff\xd8` are in the stub file.
```
xxd -p stub.jpeg | tr " " "\n" | grep -c "ffd8"
4
```
So we can see there are at most 4 jpeg files embedded in this one. So I whipped up python script to extract them out and dump them to their own jpeg files.
```python
import binascii
def write_jpg(i, image):
try:
with open(f'{i}.jpg', 'wb+') as jpeg_file:
jpeg_file.write(binascii.unhexlify(image))
except Exception as ex:
print(f"Could not write {i}: {ex}")
my_file = "stub.jpeg"
with open(my_file, 'rb') as file_t:
blob_data = binascii.hexlify(file_t.read())
images = [b'ffd8' + x for x in blob_data.split(b'ffd8')][1:]
for i, image in enumerate(images):
if len(image) % 2 != 0:
image += b'0'
write_jpg(i, image)
```
The final files are:
![](https://gitlab.com/newyork167/ctf/-/raw/main/2022/SDCTF/Forensics/Susan%20Album%20Party/0.jpg)
![](https://gitlab.com/newyork167/ctf/-/raw/main/2022/SDCTF/Forensics/Susan%20Album%20Party/1.jpg)
![](https://gitlab.com/newyork167/ctf/-/raw/main/2022/SDCTF/Forensics/Susan%20Album%20Party/2.jpg)
and I'm guessing just a jibberish file for `3.jpg`.
`Flag: sdctf{FFD8_th3n_S0ME_s7uff_FFD9}`