RowdyHacks XII: teto territory

Challenge

Miscellaneous · 250 points. A player ZIP contains territory.png.

Layered structure

The PNG's logical image ends well before the file does. The appended bytes start with a RIFF/WAV header, and that WAV's declared size in turn points to a final encrypted ZIP at the tail. So the single image is three files stacked: PNG, then WAV, then ZIP.

Decoding the audio

The WAV has two channels that are nearly identical. Subtracting right from left isolates thirteen short dual-frequency tones, and the spectrogram of the full track even spells the hint TWO VOICES FIND DIFFERENCE, confirming the stereo-difference approach.

The tones are standard telephone-keypad (DTMF) frequency pairs. They decode to 8386837748679, which is the keypad spelling of TETOTERRITORY. That numeric string is the ZIP password:

7z t -p8386837748679 territory.zip     # -> Everything is Ok
7z x -so -p8386837748679 territory.zip territory.txt

The WAV metadata's archive password: baguette is a decoy. It fails the integrity check.

Takeaway

Covert channels stack: trailing data after the PNG, a stereo-difference signal, and DTMF tones, each invisible to a glance at the image. The same reasoning that hides a flag hides exfiltration, so the defense is to canonicalize or re-encode media on ingest and treat any bytes past a file's logical end as suspect.

Flag

rowdy{t3t0_p3ar}