Rating:
# turtle
- 76 Points / 247 Solves
## Background
Nothing to see here but a happy turtle.
## Find the flag
**In this challenge, we can download a file:**
```shell
┌[siunam♥earth]-(~/ctf/RITSEC-CTF-2023/Steganography/turtle)-[2023.04.02|19:35:30(HKT)]
└> file turtle.gif
turtle.gif: GIF image data, version 89a, 224 x 126
```
It's a GIF image file!
**We can use `exiftool` to view it's metadata:**
```shell
┌[siunam♥earth]-(~/ctf/RITSEC-CTF-2023/Steganography/turtle)-[2023.04.02|19:35:44(HKT)]
└> exiftool turtle.gif
ExifTool Version Number : 12.57
File Name : turtle.gif
[...]
```
However, nothing weird in the metadata.
Then, I tried using `steghide`, `binwalk`, `foremost` to extract hidden file inside it, but no dice.
Hmm... Since it's a GIF file, let's view it's image ***frame by frame***.
**According to [HackTricks](https://book.hacktricks.xyz/crypto-and-stego/stego-tricks#stegsolve), we can use a tool called [Stegsolve](https://github.com/eugenekolo/sec-tools/tree/master/stego/stegsolve/stegsolve) to view image's frames:**
```shell
┌[siunam♥earth]-(~/ctf/RITSEC-CTF-2023/Steganography/turtle)-[2023.04.02|19:37:45(HKT)]
└> /opt/Stegsolve.jar
```
**Next, go to "Analyse" -> "Frame Browser":**
We can now view the GIF frame by frame!
**After looking at those frame, I found that the 40th frame has the flag!**
- **Flag: `RS{G00D_3Y3_&_H4PPY_TUR713}`**
## Conclusion
What we've learned:
1. Viewing Animated GIF Frame By Frame
