TryHackMe c4ptur3-th3-fl4g Writeup: Encoding & Steganography

Room Info

• Platform: TryHackMe
• Room name: c4ptur3-th3-fl4g
• Difficulty: Easy
• Focus: Decoding, steganography
• Link: https://tryhackme.com/room/c4ptur3th3fl4g
• Notes:
  • This room covers the most common steganography and encoding techniques you'll run into in CTFs — a great warm-up exercise!
  • 1.10 reference: https://www.aldeid.com/wiki/TryHackMe-c4ptur3-th3-fl4g

Task 1: Translate, shift and decode

This task bundles a bunch of encoding/decoding challenges — for each one you have to figure out which encoding is in play and decode it.

Handy tools:

ASCII to Hex - Free text conversion tools

Convert ASCII to hex and other formats, and vice versa.

ASCII to Hex

Morse Code Translator

The translator can translate between Morse code and Latin, Hebrew, Arabic and Cyrillic alphabets. It can play, flash or vibrate the Morse code. You can also save the sound and share a link to use it to send messages to your friends. The speed, Farnsworth speed and frequency of the sound are all fully adjustable.

MorseCode.World

ROT Cipher - Rotation - Online Rot Decoder, Solver, Translator

Tool to decrypt/encrypt by ROT. The code ROT for Rotation (which most common variant is Caesar Cipher) is the easiest shift-based encryption cipher.

Online Rot Decoder, Solver, TranslatordCode

1.1 Leetspeak

Challenge: c4n y0u c4p7u23 7h3 f149?
Solution: swap the numbers back to letters (4→a, 0→o, 7→t, 2→r, 3→e, 1→l, 9→g)
Answer: Redacted

1.2 Binary

Challenge: 01101100 01100101 01110100 01110011...
Solution: binary to ASCII
Answer: Redacted

1.3 Base32

Challenge: MJQXGZJTGIQGS4ZAON2XAZLSEBRW63LNN5XCA2LOEBBVIRRHOM======
Solution: Base32 decode
Answer: Redacted

1.4 Base64

Challenge: RWFjaCBCYXNlNjQgZGlnaXQgcmVwcmVzZW50cyBleGFjdGx5IDYgYml0cyBvZiBkYXRhLg==
Solution: Base64 decode
Answer: Redacted

1.5 Hexadecimal

Challenge: 68 65 78 61 64 65 63 69 6d 61 6c 20 6f 72 20 62 61 73 65 31 36 3f
Solution: hex to ASCII
Answer: Redacted

1.6 ROT13

Challenge: Ebgngr zr 13 cynprf!
Solution: ROT13 Caesar cipher
Answer: Redacted

1.7 ROT47

Challenge: *@F DA:? >6 C:89E C@F?5 323J C:89E C@F?5 Wcf E:>6DX
Solution: ROT47 shift cipher
Answer: Redacted

1.8 Morse Code

Challenge: - . .-.. . -.-. --- -- -- ..- -. .. -.-. .- - .. --- -. . -. -.-. --- -.. .. -. --.
Solution: decode the Morse code
Answer: Redacted

1.9 BCD (Binary-Coded Decimal)

Challenge: 85 110 112 97 99 107 32 116 104 105 115 32 66 67 68
Solution: decimal to ASCII
Answer: Redacted

1.10 Multi-layer encoding

Challenge: LS0tLS0gLi0tLS0g... (a very long Base64 string)
Solution steps:
1. Base64 decode
   Run the whole `LS0tLS0gLi0tLS0g...` blob through base64 -d and you get a wall of `-----` and `.----` (Morse for the digits 0 and 1).

2. Morse digits → bits
   Text-replace `-----` with `0` and `.----` with `1`, then strip out the whitespace and newlines; keep the original grouping of 8 bits each.
   e.g.: `sed "s/-----/0/g" | sed "s/.----/1/g"` … → you get a binary sequence like
   `01100110 01100101 00100000 ...`.

3. Binary → ASCII characters
   Split on whitespace, convert each 8 bits to decimal and then to a character (a one-line Python comprehension does it):
   `''.join(chr(int(b, 2)) for b in bits.split())`
   This gives you a weird-looking string:
   `fe \`_` ``e bh ``d ba `_h hf ... ``c ce ce ce`

4. Realize this weird string is yet another layer of substitution: try the ROT family → ROT47 lands
   For re-encoded "printable ASCII", ROT13/ROT47 are the first things to try.
   Here ROT47 decodes straight into a string of decimal numbers:
   `76 101 116 39 115 32 109 97 107 101 32 116 104 105 115 32 97 32 98 105 116 32 116 114 105 99 107 105 101 114 46 46 46`

5. Decimal ASCII codes → text
   Convert those decimals back to characters and you get the final answer:
   `Let's make this a bit trickier...`

Answer: Redacted

Task 2: Spectrograms

Challenge

Analyze a .wav audio file and find the hidden message in its spectrogram.

Solution

1. Open the .wav file in Audacity
2. Switch to the spectrogram view:
   • Click the dropdown next to the track name
   • Select "Spectrogram"

Tools

• Audacity (main one)
• Spectrum Analyzer

Task 3: Steganography

Challenge

Decode the hidden message inside an image.

stegseek stegosteg_1559008553457.jpg /usr/share/wordlists/rockyou.txt
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

[i] Found passphrase: ""
[i] Original filename: "steganopayload2248.txt".
[i] Extracting to "stegosteg_1559008553457.jpg.out".

cat stegosteg_1559008553457.jpg.out
Redacted

Task 4: Security through obscurity

4.1 Part one: find the filename

Challenge: Download and get 'inside' the file. What is the first filename & extension?

Solution:

# 1. Scan with binwalk
$ binwalk meme_1559010886025.jpg

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             JPEG image data, JFIF standard 1.01
74407         0x122A7         RAR archive data, version 5.x
74478         0x122EE         PNG image, 147 x 37, 8-bit/color RGBA

# 2. Extract the hidden files
$ binwalk -e meme_1559010886025.jpg

# 3. List the contents of the RAR
$ unrar l _meme_1559010886025.jpg.extracted/122A7.rar

Answer: Redacted

4.2 Part two: find the hidden text

Challenge: Get inside the archive and inspect the file carefully. Find the hidden text.

Solution:

# 1. Extract the RAR archive
$ unrar x 122A7.rar

# 2. Analyze the PNG with zsteg
$ zsteg hackerchat.png

[?] 22 bytes of extra data after image end (IEND), offset = 0x15a4
extradata:0         .. text: "\"AHH_YOU_FOUND_ME!\" \r\n"
meta Software       .. text: "gnome-screenshot"
meta Creation Time  .. text: "Wed 15 May 2019 09:09:10 PM CDT"

Answer: Redacted

Wrap-up and key takeaways

Key techniques

1. Encoding recognition: get familiar with the fingerprints of each encoding format
   • Base64: = padding at the end
   • Base32: only uppercase letters and the digits 2-7
   • Hex: pairs of 0-9 and a-f
   • Binary: only 0s and 1s
2. Audio analysis: the spectrogram is the go-to approach for CTF audio challenges
3. File analysis:
   • binwalk - scan for embedded files
   • strings - quick text hunting
   • exiftool - inspect metadata
4. Image steganography:
   • PNG: use zsteg
   • JPEG: use steghide, stegseek