Challenge 2 - Investigate Hidden Image

In this challenge, an image file is provided to recover a hidden flag. The specific steganography technique, encryption parameters, and underlying hiding mechanisms are initially unknown. Rather than guessing, we conduct a structured, step-by-step investigation of the image—from file format verification and metadata analysis to structural inspection and specialized steganographic extraction.

Initial Directory Reconnaissance

First, list the contents of the challenge directory to identify available files and documentation to understand what to investigate further.

The directory contains three key entries:

• BRIEF.md: The challenge description and objective.

• hints/: A directory containing contextual clues if required.

• stego_badger.jpeg: The target image file.

Reading the brief using cat confirms the primary objective:

So, our objective is clear. We need to investigate this JPEG image and find out how the information has been hidden.

But before searching for hidden data, let's first confirm whether this file is actually a JPEG image.

File Type Verification

Why do we need to do this? Because a file extension is only part of its name. Someone can rename a text document with a .jpg extension, but that doesn't turn it into an actual image.

To identify the real file format, we'll use the file command to examine the file's contents and identifying signatures to determine its actual format, rather than simply trusting its extension.

As you can see, the output identifies it as JPEG image data using the JFIF standard, version 1.01. It also reports that the image dimensions are 1024x1024 pixels.

So, we've confirmed that we're dealing with a genuine JPEG image.

Inspecting Image Metadata with ExifTool

Before trying to extract anything, let's examine the metadata associated with this image. 

For this, we'll use ExifTool.

As you can see, ExifTool displays several technical details about the image. Here are some of the important fields.

• The file type is JPEG.
• The image dimensions are 1024x1024 pixels.
• The colour components are 3.
• The JPEG encoding process is listed as Baseline DCT (Baseline Discrete Cosine Transform).
• We can also see the JFIF information and other technical properties of the image.

These details help us understand the file we're investigating. But so far, we haven't found the flag. So, let's continue examining the image and see whether it contains anything beyond the visible picture.

We don't see any suspicious comments or obvious clues in the metadata.

Does that mean there's nothing hidden inside the image?

Not necessarily. Remember, steganography doesn't always rely on metadata. Information can also be hidden within the image data itself, which means a normal metadata inspection might not reveal anything unusual.

So, we need to try another approach. Sometimes, a file may contain another file or a recognisable data structure within it. For example, an image might contain an embedded ZIP archive, a PDF document, or other types of data.

To investigate this possibility, we're going to use a tool called Binwalk.

Embedded File Signature Scanning with Binwalk

Binwalk is a tool that examines binary files and searches for known file signatures. It helps us identify embedded files, archives, and other recognisable data structures.

Let's scan our image.

As you can see, Binwalk finds only one entry. At offset 0, it identifies the JPEG image data. We don't see any other recognisable file signatures, such as a ZIP archive or a PDF document.

Analysis with Stego tools

However, this doesn't prove that the image contains no hidden information. Some steganography techniques don't create additional file signatures that Binwalk can recognise.

So, let's move on to a tool specifically designed for steganography. The next tool we're going to use is called Steghide.

Steghide Analysis

Steghide is a steganography tool that allows us to hide information inside supported file formats, including JPEG images.

First, let's check whether Steghide is running; if it's not installed, it prompts us to install it.

As you can see, the tool isn't available. The terminal also suggests the package we need to install. Type Y and press Enter to download Steghide along with any required dependencies and install them.

Once the installation is complete, let's see how the tool works. Run Steghide without providing any options.

As you can see, it displays the available commands and usage information. For our investigation, we're interested in the info command to examine a file and check whether it contains embedded data. Let's run:

Here, 

• info tells Steghide that we want to inspect the image, and the filename specifies which image we want to examine.

Now, Steghide identifies the file as a JPEG image and asks whether we want to check for embedded information.

Let's type Y and press Enter.

Now, it asks us to enter a passphrase. Here's the problem.

We don't know the passphrase yet, so we cannot retrieve the embedded information through this step.

What should we do now? Well, we have a few options.

We can examine the challenge hints, look for possible password clues, or try a password wordlist to identify the correct passphrase.

For this challenge, we're going to try another tool called Stegseek, which can help us test passwords against Steghide-protected files using a wordlist.

Automated Passphrase Cracking with StegSeek

StegSeek is designed to test password candidates against files created using Steghide. 

Instead of trying passwords manually, we can provide a wordlist containing thousands or even millions of possible passwords. StegSeek will test these passwords against the hidden data. And when it finds a matching passphrase, it can also extract the embedded file.

For this challenge, we're going to use a popular password list called RockYou.

First, let's check whether StegSeek is executable on our Kali Linux system. If it's not installed, then type y to install it.

APT will download StegSeek along with any required dependencies and install it. Once the installation is complete, let's see how the tool works.

For this, we can display its available options using:

As you can see, StegSeek provides several options. For our investigation, we're interested in its password-cracking feature.

Now, we need to provide two things: 

• Our JPEG image
• The RockYou wordlist.

The basic command looks like this:

Here, we're providing the image that contains the hidden data, followed by the wordlist containing possible passwords. StegSeek will now test the passwords one by one against the protected data.

And look at the result! StegSeek has successfully recovered the passphrase. The password is: password123

Great! We've found the password. StegSeek can also save an extracted copy of the hidden data. The default output filename is usually based on the original image filename, with .out added at the end.

But let's verify our findings using Steghide itself. Remember the command we used earlier?

At that time, Steghide asked us for a passphrase, but we didn't know it. 

Verifying Embedded Contents via Steghide

Now, we do. So, let's run the same command again, and when Steghide asks for the passphrase, enter: password123

And there we go! This time, we can see additional information about the image. The tool reports that an embedded file named Flag.txt was found.

This confirms that the image contains a hidden document.

Payload Extraction

Now that we know its original filename and have recovered the passphrase, let's extract the hidden document using Steghide. Run the following command:

Let's understand what each part does.

• The extract command tells Steghide that we want to recover the hidden data.
• The -sf option stands for stego file. It specifies the image containing the embedded information.
• And finally, the -p option supplies the passphrase required for extraction. Here, we're using the password we recovered with StegSeek.

And press Enter.

And there it is! Steghide has successfully extracted the hidden document.

Notice: We haven't specified a separate output filename using the -xf option.

So, Steghide uses the original filename stored in the embedded data, which is Flag.txt. 

Inspect the Flag

Before opening the recovered document, let's first verify its actual file format.

Remember our earlier lesson? A filename and its extension don't always tell us what a file actually contains. So, let's use the file command again:

The file command identifies the recovered document as ASCII text. This means it contains ordinary text represented using the ASCII character set.

Now, let's inspect its contents. For this, we'll use the cat command:

Look at the output. The very first line immediately catches our attention. It starts with the word:

Followed by a value inside curly brackets. But there's something else. Below the flag, we can see a large collection of unusual character sequences.

Most of these lines contain 24 characters, and they don't look like ordinary text. Our document contains a total of 202 lines. But we don't need to display all of them just to recover the flag. Instead, we can use another command called head.

The head command displays the beginning of a file.

• We'll use the -n option with the value one.

This tells the command to display only the first line of the document. And there it is! We've successfully completed Challenge 2! But the next challenge is going to be more interesting.

We'll investigate an image containing multiple hidden data structures and work through several layers of file extraction and analysis. We'll also explore techniques that require us to look beyond ordinary metadata inspection and basic steganography tools.

So, keep your recovered files safe, and I'll see you in the next challenge.