Hidden Meaning

Task description

They say a picture is worth more than a thousand words. It seems this picture could prove it. Find the solution hidden inside this picture.

The original was in Croatian; this is my translation.

What steganography is

Steganography is the practice of hiding a message so that nobody notices there is a message at all. Cryptography scrambles a message so it can’t be read; steganography hides that it exists. In CTFs it usually means a flag tucked inside an image or a sound file that looks completely normal.

The picture

The task gives slika.jpg (Croatian for “picture”), an ordinary-looking image of glowing code and diagram boxes. If you look carefully, there’s a faint seam about 60% of the way down, where the colours shift slightly. That’s a clue, but you don’t need it to solve the task.

Every file is just bytes

A JPEG, a song or a Word document is stored the same way as a text file: a long list of numbers (bytes). The extension at the end of the name, like .jpg or .txt, only tells your computer which program to open it with. Image viewers read those bytes as compressed pixels. A text editor reads the same bytes as letters.

That’s why our first idea was to treat the file as something else. Renaming it to .zip or .rar (a common trick, since an archive can be glued onto the end of an image) did nothing. Renaming it to .txt and opening it in a text editor worked. Most of the file shows up as gibberish, because compressed image data isn’t text, but any real text inside stays readable.

Finding the flag

With the file open in a text editor, Ctrl+F for CTF2021[ finds exactly one match. The flag sits on a line of its own, about 61% of the way into the file, in the middle of the compressed image data. That lines up with the seam in the picture, so the inserted text most likely disturbed the image data from that point down.

You don’t have to rename anything. Most code editors open any file as text, and on Linux or macOS the strings command lists every run of readable characters in a file:

strings slika.jpg | grep 'CTF2021\['

strings pulls out the readable pieces, and grep keeps only the lines containing the flag prefix. It prints a single line, the flag.