BreizhCTF 2023 - Squint

Challenge details

Event	Challenge	Category	Points	Solves
BreizhCTF 2023	Squint	Steganography	???	???

Better to squint than to be blind.

Author: Zeecka

TL;DR

The provided file is a PNG file, and more specifically image/apng, containing 2 frames. The second frame has a null delay, so it can only be viewed through an APNG file editing tool such as apng-maker. The extracted second frame seems meaningless at first glance, but a reverse image search on the original image (first frame), along with the challenge title and description, points us toward autostereograms. Using a solver like the one in Stegsolve then makes it easier to read the flag.

Methodology

To start, we download the file and verify that it has not been altered by computing its signature.

$ md5sum squint.png

2c8a5ec04ddf7d0c2bd66112e7bf54f0

The file command lets us check whether the retrieved file type matches its extension.

$ file squint.png

squint.png: PNG image data, 800 x 1143, 8-bit grayscale, non-interlaced

The file is therefore a PNG image. The exiftool tool lets us retrieve the file’s metadata.

$ exiftool squint.png

ExifTool Version Number         : 12.42
File Name                       : squint.png
Directory                       : .
File Size                       : 796 kB
File Modification Date/Time     : 2022:11:13 18:05:47+01:00
File Access Date/Time           : 2022:11:13 18:06:02+01:00
File Inode Change Date/Time     : 2022:11:13 18:05:55+01:00
File Permissions                : -rw-r--r--
File Type                       : APNG
File Type Extension             : png
MIME Type                       : image/apng
Image Width                     : 800
Image Height                    : 1143
Bit Depth                       : 8
Color Type                      : Grayscale
Compression                     : Deflate/Inflate
Filter                          : Adaptive
Interlace                       : Noninterlaced
Animation Frames                : 2
Animation Plays                 : inf
Image Size                      : 800x1143
Megapixels                      : 0.914

No comment is present; however, we learn here that the file type is APNG with a MIME Type image/apng.

An internet search on the APNG file format lets us learn more about it. It is an image format that can contain several frames of variable duration, just like the GIF format.

In order to inspect the different frames, we will use an online APNG disassembler.

Extracting the hidden frame (by reversing the order and duration of the frames, for example) lets us recover the file.

The file is seemingly unreadable as is. A reverse image search of the first image (using Google Lens or Yandex, for example) lets us find the Wikipedia page of Béla Julesz.

This scientist is known for his work on stereograms, and particularly autostereograms. The extracted image matches the patterns used for autostereograms available online.

Using an autostereogram solver like the one in StegSolve then lets us recover our precious Flag.

Flag

BZHCTF{Motostereogram?}

Author: Zeecka