Suspicious Remix

Platform: Broncoctf2026 | Category: Steganography | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-07-12 | Status: Solved Techniques: sox_spectrogram, spectrogram_text_steganography, ultrasonic_band_text

Summary

Task: a stereo WAV containing a garbled AI-remix of a well-known song, with a hidden message drawn into the ultrasonic 14-24 kHz spectrogram band. Solution: render a clean high-contrast SoX spectrogram of that band, read the block-letter text 'THE FLAG IS THE RELEASE YEAR OF THE SONG THE LYRICS ARE FROM' (Never Gonna Give You Up -> 1987).

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: broncoctf2026 | ID: 20260712_broncoctf2026_suspicious_remix
• Tags: steganography, rickroll, audio, wav, spectrogram, ultrasonic, spectrogram_text, frequency_domain_text
• Indicators: dense structured 14-24 kHz ultrasonic band in a stereo WAV, audio is a garbled/AI remix of a recognizable song, block-letter shapes visible in a high-contrast spectrogram top band, prompt hint 'have a listen' + 'modified specifically for me
• Source: 20260712_broncoctf2026_suspicious_remix.md

Foothold

Vulnerability / Misconfiguration

1. Sox_spectrogram
2. Spectrogram_text_steganography
3. Ultrasonic_band_text

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• sox_spectrogram
• spectrogram_text_steganography
• ultrasonic_band_text
• Tags: steganography, rickroll, audio, wav, spectrogram, ultrasonic, spectrogram_text, frequency_domain_text

Original Writeup

<details><summary>Click to expand original content</summary>

Description

So there's this guy SG who just sent me a copy of their new remix. Knowing what they are like with their remixes, I don't trust it, in more ways than one. Whatever remix, I always feel like they modified the audio specifically for me somehow. Maybe you should have a listen. Wrap the secret you find in bronco{}.

Given file: sg_remix.wav — RIFF WAVE, Microsoft PCM, 16-bit, stereo, 48000 Hz, ~82 s, ~15.7 MB. The audible track is a garbled / AI-remixed version of Rick Astley's "Never Gonna Give You Up". Goal: find the hidden secret and wrap it in bronco{}.

Analysis

The prompt drops two strong hints: "have a listen" (audio-domain inspection) and "in more ways than one" / "modified the audio specifically for me" (there are two layers — the audible rickroll AND a second hidden layer).

A high-contrast spectrogram of the L+R mix reveals a dense, structured band of energy in the ultrasonic 14–24 kHz range, present only from about t = 13.75 s to t = 38.7 s. This is clearly artificial — normal 48 kHz music does not carry deliberate, block-shaped structure that high.

The key realization: those shapes are not a data-over-sound modulation — they are block letters literally drawn into the frequency/time plane. Rendering a clean, high dynamic-range spectrogram of the exact band and simply reading it left-to-right spells out a plain English sentence:

THE FLAG IS THE RELEASE YEAR OF THE SONG THE LYRICS ARE FROM

The garbled lyrics in the remix are Rick Astley — "Never Gonna Give You Up", released in 1987. Therefore the flag is bronco{REDACTED}.

Solution

Render the ultrasonic band as a clean, high-contrast spectrogram with SoX and read it directly. remix 1,2 mixes L+R to mono; -z 80 gives 80 dB of dynamic range so the faint ultrasonic glyphs stand out against black. Read in ~4-second windows across 13–40 s and view the top 14–24 kHz band.

# One window at a time (start = 13,17,21,25,29,33,36 ...)
for start in 13 17 21 25 29 33 36; do
  sox sg_remix.wav -n remix 1,2 trim $start 4 rate 48k \
      spectrogram -z 80 -o clean_${start}.png
done

# Or one full-width high-contrast spectrogram of the whole message span:
sox sg_remix.wav -n remix 1,2 trim 13 26 rate 48k \
    spectrogram -z 80 -x 2000 -o fulltext.png

Reading the block letters across the windows:

Concatenated:

THE FLAG IS THE RELEASE YEAR OF THE SONG THE LYRICS ARE FROM

The song is "Never Gonna Give You Up" (Rick Astley, 1987), so:

flag = bronco{REDACTED}

(Audacity / Sonic Visualiser spectrogram views work equally well — the point is a clean, high-contrast render of the 14–24 kHz band.)

Rabbit holes / what did NOT work

The single biggest lesson: the ultrasonic glyphs LOOK like an FSK / multi-tone data-over-sound signal (ggwave / quiet.js / OFDM), but they are plain readable TEXT. The comb / barcode appearance under low-contrast or inverted spectrograms made the block letters resemble a coded modulation, which led to a large wasted effort building and patching ggwave decoders. Always render a clean high-contrast spectrogram of the exact band and just LOOK before assuming a coded scheme.

Discarded approaches (so future readers skip them):

• Sample-level, channel, and raw-byte LSB extraction (all bit planes, all alignments) — nothing.
• Stereo L−R difference / phase cancellation and L+R sum — only isolated the song.
• Whole-track reversal and high-pass filtering — only recovered song fragments (via Whisper).
• audiowmark and WavMark AI watermark decoders — no watermark present.
• DeepSound DSC2 container check — not present.
• ggwave / quiet.js data-over-sound decoding (custom freqStart sweeps, forced-marker patched decoders, Reed–Solomon brute force, manual per-frame demod) — DEAD END; the signal is not a data modulation at all.
• First flag guess bronco{never_gonna_give_you_up} — WRONG (rejected). The answer is the release year, 1987.

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR