🕵️ Challenge Description
simple Forensics / Steganography challenge.
Players receive an image and must discover a hidden passphrase within its metadata to extract a concealed file (flag.txt) inside the image.
We are given an image file can_u_see.jpg.
Our goal is to analyze the EXIF metadata, decode the hidden Base64 string, and then use steghide with the decoded passphrase to recover the hidden flag file.
🧰 Tools Used
- exiftool — To view and analyze EXIF metadata.
- base64 — To decode the hidden Base64-encoded string.
- steghide — To extract hidden files from image or audio containers.
🧾 Summary of Steps
1️⃣ Inspect the Image Metadata
Use exiftool to inspect the EXIF metadata of the image:
exiftool can_u_see.jpgIn the output, we notice a suspicious Base64 string:
UserComment: cm91Z2k=This clearly looks like Base64-encoded text — our hidden clue.
2️⃣ Decode the Base64 String
echo 'cm91Z2k=' | base64 -dOutput:
rougi3️⃣ Extract the Hidden File with Steghide
Now that we have the passphrase, we can use steghide to extract the hidden file from the image:
steghide extract -sf can_u_see.jpg -p rougiIf successful, steghide confirms:
wrote extracted file "flag.txt"cat flag.txtOutput:
nexus{chouaib_is_hereeeeeee}✅ Result
You successfully extracted the hidden flag from the image by:
- Reading the EXIF metadata
- Decoding the Base64 string
- Using the passphrase with steghide
🎉 Flag: nexus{chouaib_is_hereeeeeee}