Overview
This forensics challenge provides a JPEG image with hidden trailing data. We must extract the hidden data, perform spectral analysis on the audio file, and use the revealed key to unlock an encrypted ZIP file containing the flag.
Reconnaissance
We are given two files: void_capture.jpg and locked_archive.zip.
Analyzing the JPEG file size and headers shows the End-Of-Image marker (FF D9) is placed early, leaving over 3 MB of trailing raw bytes.
Exploitation Strategy
We carved the trailing data starting after the JPEG EOI footer. The extracted bytes have RIFF and WAVEfmt magic bytes, indicating a WAV file.
Plotting the spectrogram of the WAV audio file using Python (matplotlib and scipy) reveals text embedded in the high frequencies:
9e40ee8c0d775e2573134661eff824662760871b626a9349088cc0dc8f8e36e5We used this hex string as the password to extract locked_archive.zip, yielding dark_image.jpg. Running strings on the final image reveals the flag.
Solution Code
import scipy.io.wavfile as wav
import matplotlib.pyplot as plt
# 1. Carve hidden WAV audio file
content = open('void_capture.jpg', 'rb').read()
with open('hidden.wav', 'wb') as out:
out.write(content[9773:])
# 2. View spectrogram to read password
# 3. Unzip locked archive using the password
# 4. Check strings of dark_image.jpg for flag
# Flag: CrackOn{dark_signal_restored}Flag
CrackOn{dark_signal_restored}