1. Aperisolve, stegonline did not yield any results except for a password.

2. Password did not work with the original image in steghide.

3. opened image in hexeditor, saw extra data after file trailer ffd9

4. copied that data into another file

5. Opened that file as an archive and extracted it

6. A thousand images available.

7. Brute forced all of them with the password. Got the flag.

import subprocess
impath = r"C:/Users/%USER%/Desktop/RitSec CTF/cid/CID HQ/"
data = []
dataImages = []
for i in range(369, 370):
try:
print(subprocess.check_output(["steghide", "extract", "-sf", impath + f"{i}.jpg", "-p",
daya darwaza tod do"]))
dataImages.append(i)
data.append(subprocess.check_output(["steghide", "extract", "-sf", impath +
f"{i}.jpg", "-p", "daya darwaza tod do"]))
except subprocess.CalledProcessError as e:
print("Failed image number ", i)
print("\n\n")
print(data)
print("\n\n")
print(dataImages)

Original writeup (https://github.com/CBC-MIT/CTF-Writeups/blob/main/VishwaCTF2k23/CID/README.md).