BreizhCTF 2023 - Tartes aux myrtilles

Challenge details

Event	Challenge	Category	Points	Solves
BreizhCTF 2023	Tartes aux myrtilles	Steganography	???	???

Author: Zeecka

TL;DR

The files tarte1.png and tarte2.png are two seemingly identical images. Some pixels, however, appear to have a 1-bit difference. By redrawing the map of differences (by subtracting the images), we then obtain the flag.

Methodology

To begin with, we retrieve the files tarte1.png and tarte2.png. The two files are identical but have a different signature:

$ md5sum *

63b0f0e2b768845ca461961431a0a23d  tarte1.png
2ce88afda7cb0e125884694f5f5a56e5  tarte2.png

In order to check whether the difference between the files lies in the pixels that make them up, or in the structure, we are going to compare the pixels of the two images. To do so, we use the python module PIL.

#!/usr/bin/env python3
# -*- coding:utf-8 -*-
from PIL import Image

tarte_1 = Image.open("tarte1.png")
tarte_2 = Image.open("tarte2.png")

d1 = list(tarte_1.getdata())
d2 = list(tarte_2.getdata())

assert (d1 == d2)

Traceback (most recent call last):
  File "script.py", line 11, in <module>
    assert (d1 == d2)
AssertionError

It turns out that the pixels of the two images are different despite the visual similarities. Since the two images have the same size, we are going to subtract the two images to trace the pixel differences. For this, we can use a python script, software such as Gimp or Photoshop, or else the tool stegsolve.

We opt for this last solution by opening the file tarte1.png with Stegsolve. The comparison with another image is performed using the Analyse > Image Combiner menu (then select the file tarte2.png).

The operations offered by the Stegsolve combiner are numerous (Xor, Or, And, Add, Mul, Interlace, …); navigating between the different operations then lets us land on the subtraction:

We can then make out the flag.

Flag

BZHCTF{je_vais_varies_les_fruits_vous_inquietez_pas}

Author: Zeecka