> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# TryHackMe c4ptur3-th3-fl4g Writeup: Encoding & Steganography
- URL: https://taiwanding.com/en/tryhackme-c4ptur3-th3-fl4g-writeup/
- Published: 2025-09-30T16:22:49.000Z
- Updated: 2026-07-15T02:49:52.000Z
- Author: Kevin Chen
- Tags: #en, #en-ctf

## Room Info

- **Platform**: TryHackMe
- **Room name**: c4ptur3-th3-fl4g
- **Difficulty**: Easy
- **Focus**: Decoding, steganography
- **Link**: [https://tryhackme.com/room/c4ptur3th3fl4g](https://tryhackme.com/room/c4ptur3th3fl4g?ref=taiwanding.com)
- Notes:
  - This room covers the most common steganography and encoding techniques you'll run into in CTFs — a great warm-up exercise!
  - 1.10 reference: [https://www.aldeid.com/wiki/TryHackMe-c4ptur3-th3-fl4g](https://www.aldeid.com/wiki/TryHackMe-c4ptur3-th3-fl4g?ref=taiwanding.com)

## Task 1: Translate, shift and decode

This task bundles a bunch of encoding/decoding challenges — for each one you have to figure out which encoding is in play and decode it.

### Handy tools:

[ASCII to Hex - Free text conversion toolsConvert ASCII to hex and other formats, and vice versa.![](https://taiwanding.com/content/images/icon/apple-touch-icon-180x180.png)ASCII to Hex](https://www.asciitohex.com/?ref=taiwanding.com)

[Morse Code TranslatorThe translator can translate between Morse code and Latin, Hebrew, Arabic and Cyrillic alphabets. It can play, flash or vibrate the Morse code. You can also save the sound and share a link to use it to send messages to your friends. The speed, Farnsworth speed and frequency of the sound are all fully adjustable.![](https://taiwanding.com/content/images/icon/apple-touch-icon-1.png)MorseCode.World![](https://taiwanding.com/content/images/thumbnail/logo315px.png)](https://morsecode.world/international/translator.html?ref=taiwanding.com)

[ROT Cipher - Rotation - Online Rot Decoder, Solver, TranslatorTool to decrypt/encrypt by ROT. The code ROT for Rotation (which most common variant is Caesar Cipher) is the easiest shift-based encryption cipher.![](https://taiwanding.com/content/images/icon/favicon-4.ico)Online Rot Decoder, Solver, TranslatordCode![](https://taiwanding.com/content/images/thumbnail/dcode-1.png)](https://www.dcode.fr/rot-cipher?ref=taiwanding.com)

### 1.1 Leetspeak

```
Challenge: c4n y0u c4p7u23 7h3 f149?
Solution: swap the numbers back to letters (4→a, 0→o, 7→t, 2→r, 3→e, 1→l, 9→g)
Answer: Redacted

```

### 1.2 Binary

```
Challenge: 01101100 01100101 01110100 01110011...
Solution: binary to ASCII
Answer: Redacted

```

### 1.3 Base32

```
Challenge: MJQXGZJTGIQGS4ZAON2XAZLSEBRW63LNN5XCA2LOEBBVIRRHOM======
Solution: Base32 decode
Answer: Redacted

```

### 1.4 Base64

```
Challenge: RWFjaCBCYXNlNjQgZGlnaXQgcmVwcmVzZW50cyBleGFjdGx5IDYgYml0cyBvZiBkYXRhLg==
Solution: Base64 decode
Answer: Redacted

```

### 1.5 Hexadecimal

```
Challenge: 68 65 78 61 64 65 63 69 6d 61 6c 20 6f 72 20 62 61 73 65 31 36 3f
Solution: hex to ASCII
Answer: Redacted

```

### 1.6 ROT13

```
Challenge: Ebgngr zr 13 cynprf!
Solution: ROT13 Caesar cipher
Answer: Redacted

```

### 1.7 ROT47

```
Challenge: *@F DA:? >6 C:89E C@F?5 323J C:89E C@F?5 Wcf E:>6DX
Solution: ROT47 shift cipher
Answer: Redacted

```

### 1.8 Morse Code

```
Challenge: - . .-.. . -.-. --- -- -- ..- -. .. -.-. .- - .. --- -. . -. -.-. --- -.. .. -. --.
Solution: decode the Morse code
Answer: Redacted

```

### 1.9 BCD (Binary-Coded Decimal)

```
Challenge: 85 110 112 97 99 107 32 116 104 105 115 32 66 67 68
Solution: decimal to ASCII
Answer: Redacted

```

### 1.10 Multi-layer encoding

```bash
Challenge: LS0tLS0gLi0tLS0g... (a very long Base64 string)
Solution steps:
1. Base64 decode
   Run the whole `LS0tLS0gLi0tLS0g...` blob through base64 -d and you get a wall of `-----` and `.----` (Morse for the digits 0 and 1).

2. Morse digits → bits
   Text-replace `-----` with `0` and `.----` with `1`, then strip out the whitespace and newlines; keep the original grouping of 8 bits each.
   e.g.: `sed "s/-----/0/g" | sed "s/.----/1/g"` … → you get a binary sequence like
   `01100110 01100101 00100000 ...`.

3. Binary → ASCII characters
   Split on whitespace, convert each 8 bits to decimal and then to a character (a one-line Python comprehension does it):
   `''.join(chr(int(b, 2)) for b in bits.split())`
   This gives you a weird-looking string:
   `fe \`_` ``e bh ``d ba `_h hf ... ``c ce ce ce`

4. Realize this weird string is yet another layer of substitution: try the ROT family → ROT47 lands
   For re-encoded "printable ASCII", ROT13/ROT47 are the first things to try.
   Here ROT47 decodes straight into a string of decimal numbers:
   `76 101 116 39 115 32 109 97 107 101 32 116 104 105 115 32 97 32 98 105 116 32 116 114 105 99 107 105 101 114 46 46 46`

5. Decimal ASCII codes → text
   Convert those decimals back to characters and you get the final answer:
   `Let's make this a bit trickier...`

Answer: Redacted
```

## Task 2: Spectrograms

### Challenge

Analyze a .wav audio file and find the hidden message in its spectrogram.

### Solution

1. Open the .wav file in **Audacity**
2. Switch to the spectrogram view:
  - Click the dropdown next to the track name
  - Select "Spectrogram"

### Tools

- Audacity (main one)
- [Spectrum Analyzer](https://academo.org/demos/spectrum-analyzer/?ref=taiwanding.com)

## Task 3: Steganography

### Challenge

Decode the hidden message inside an image.

```bash
stegseek stegosteg_1559008553457.jpg /usr/share/wordlists/rockyou.txt
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

[i] Found passphrase: ""
[i] Original filename: "steganopayload2248.txt".
[i] Extracting to "stegosteg_1559008553457.jpg.out".

cat stegosteg_1559008553457.jpg.out
Redacted
```

## Task 4: Security through obscurity

### 4.1 Part one: find the filename

**Challenge**: Download and get 'inside' the file. What is the first filename & extension?

**Solution**:

```bash
# 1. Scan with binwalk
$ binwalk meme_1559010886025.jpg

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             JPEG image data, JFIF standard 1.01
74407         0x122A7         RAR archive data, version 5.x
74478         0x122EE         PNG image, 147 x 37, 8-bit/color RGBA

# 2. Extract the hidden files
$ binwalk -e meme_1559010886025.jpg

# 3. List the contents of the RAR
$ unrar l _meme_1559010886025.jpg.extracted/122A7.rar

```

**Answer**: Redacted

### 4.2 Part two: find the hidden text

**Challenge**: Get inside the archive and inspect the file carefully. Find the hidden text.

**Solution**:

```bash
# 1. Extract the RAR archive
$ unrar x 122A7.rar

# 2. Analyze the PNG with zsteg
$ zsteg hackerchat.png

[?] 22 bytes of extra data after image end (IEND), offset = 0x15a4
extradata:0         .. text: "\"AHH_YOU_FOUND_ME!\" \r\n"
meta Software       .. text: "gnome-screenshot"
meta Creation Time  .. text: "Wed 15 May 2019 09:09:10 PM CDT"

```

**Answer**: Redacted

## Wrap-up and key takeaways

### Key techniques

1. **Encoding recognition**: get familiar with the fingerprints of each encoding format
  - Base64: `=` padding at the end
  - Base32: only uppercase letters and the digits 2-7
  - Hex: pairs of 0-9 and a-f
  - Binary: only 0s and 1s
2. **Audio analysis**: the spectrogram is the go-to approach for CTF audio challenges
3. **File analysis**:
  - `binwalk` \- scan for embedded files
  - `strings` \- quick text hunting
  - `exiftool` \- inspect metadata
4. **Image steganography**:
  - PNG: use `zsteg`
  - JPEG: use `steghide, stegseek`