Home >

Huntress CTF > Easy Challenges

Back <> Next

This trick is nothing new, you know what to do: iSteg. Look for the tail that’s older than time, this Spike, you shouldn’t climb.

Here we are given an image to download ‘dinosaurs1.png’. The tool we need for this is right in the challenge hint’ isteg’. We initially tried using Aperi’Solve to solve this. We uploaded the image, and extracted the zsteg files, and retrieved the flag…

lbft1

…Just kidding…the flag{f162b6973561877eaa124814ce1c721a} here was a phony, however the result also provided some potential passwords. We decided to try re-extracting the files using the password ‘johnhammondiscool’, and this time we were able to retrieve the flag… lbft2

…Just kidding again..the flag:

flag{eW91IGFjdHVhbGx5IHRob3VnaHQsIG5nbCBpdCdzIGZ1bm55IGxvbA==}

decoded to: ‘you actually thought, ngl it’s funny lol’

we also got a few links: this, and this, and this one was really interesting….

Also present was another base64 encoded message:

eW91IGZlbGwgZm9yIGl0IGFnYWluLCB4RCAKCi4KLgouCi4KLgouCi4KLgouCi4KLgouCi4KLgouCi4KLgouCi4KLgouCi4KLgouCi4KLgouCi4KCm5haGggSSBjYW4ndCBiZSBtZXNzaW5nIHdpdGggeW91CgpIZXJlIHRha2UgeW91ciBmbGFne2FIUjBjSE02THk5M2QzY3VlVzkxZEhWaVpTNWpiMjB2ZDJGMFkyZy9kajB6TkVsbk0xZzFPVjl4UVE9PX0=

decoded to:

you fell for it again, xD 

.
.
.
.

nahh I can't be messing with you

Here take your flag{aHR0cHM6Ly93d3cueW91dHViZS5jb20vd2F0Y2g/dj0zNElnM1g1OV9xQQ==}

And finally we were able to…get trolled again. Nice.

By this point it became apparent that this online tool was not going to work, and we did, indeed, need to use the iSteg tool. After some searching, we were able to find a version of the tool hosted on GitHub. we downloaded the GUI release, and ran the iSteg-v2.1_GUI.jar program which allowed us to finally retrieve the real flag! (no password required)

lbftflag

This was an entertaining challenge, and I included all of the fake flags because I found them fun, as well as frustrating. Well played, proslasher, well played.

Back <> Next