← Back to CRACKON CTF

DARK SERIES

Extract a hidden WAV file from a JPEG, perform spectrogram audio analysis, and decrypt a ZIP file to get the flag.

Tools Used

PythonSpectrogram Analysisbinwalkunzip

Overview

This forensics challenge provides a JPEG image with hidden trailing data. We must extract the hidden data, perform spectral analysis on the audio file, and use the revealed key to unlock an encrypted ZIP file containing the flag.

Reconnaissance

We are given two files: void_capture.jpg and locked_archive.zip.

Analyzing the JPEG file size and headers shows the End-Of-Image marker (FF D9) is placed early, leaving over 3 MB of trailing raw bytes.

Exploitation Strategy

We carved the trailing data starting after the JPEG EOI footer. The extracted bytes have RIFF and WAVEfmt magic bytes, indicating a WAV file.

Plotting the spectrogram of the WAV audio file using Python (matplotlib and scipy) reveals text embedded in the high frequencies:

9e40ee8c0d775e2573134661eff824662760871b626a9349088cc0dc8f8e36e5

We used this hex string as the password to extract locked_archive.zip, yielding dark_image.jpg. Running strings on the final image reveals the flag.

Solution Code

import scipy.io.wavfile as wav
import matplotlib.pyplot as plt

# 1. Carve hidden WAV audio file
content = open('void_capture.jpg', 'rb').read()
with open('hidden.wav', 'wb') as out:
    out.write(content[9773:])

# 2. View spectrogram to read password
# 3. Unzip locked archive using the password
# 4. Check strings of dark_image.jpg for flag
# Flag: CrackOn{dark_signal_restored}

Flag

CrackOn{dark_signal_restored}