RowdyHacks XII: Hidden in Plain Sight

Challenge

Forensics · 200 points. A single photo, vacation.jpg, is provided.

Layer 1: the EXIF hint

The ImageDescription EXIF field is Base64. Decoding it says the image has extra data after the JPEG end-of-image marker (FF D9), beginning with PK, the ZIP signature. So the JPEG is a polyglot with an archive appended to its tail.

Layer 2: the appended ZIP

Scanning for the ZIP signature after the final FF D9 and carving from there yields an archive:

# locate PK after the JPEG end marker, carve to EOF, then unzip
unzip -oq embedded.zip -d extracted

It contains photo2.jpg and a readme.txt that supplies the passphrase p1xel_hunt3r for the next layer.

Layer 3: the steghide payload

photo2.jpg carries a steghide payload unlocked by that passphrase:

steghide extract -sf extracted/photo2.jpg -p p1xel_hunt3r -xf payload.txt -f
cat payload.txt   # -> FLAG: flag{flexible_array_member}

Every clue needed for the next layer lived inside the previous one; no platform hint was used.

Takeaway

Data after a file's end marker is invisible to viewers and trivially carved, and layering stego (an EXIF hint, an appended ZIP, a Steghide payload) is how staged payloads hide in plain sight, malware second stages included. The defensive counters are concrete: re-encode or canonicalize media on ingest, strip trailing bytes, and inspect EXIF rather than trusting a valid header to mean a clean file.

Flag

flag{flexible_array_member}