Suspicious Remix 2

Platform: Broncoctf2026 | Category: Steganography | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-07-11 | Status: Solved Techniques: bit_plane_analysis, higher_bit_plane_inspection, semantic_clue_parsing, steghide_extraction

Summary

Task: WAV audio and PNG image provided; hints point to steghide with password hidden in the image. Solution: Extract password from Red channel bit 2 of PNG via bit plane analysis, then use steghide with password '1988' to extract flag from WAV.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: broncoctf2026 | ID: 20260711_broncoctf2026_suspicious_remix_2
• Tags: steganography, steghide, png, bit_plane, non_lsb, password_extraction, rickroll, wav
• Indicators: challenge mentions 'hide-n' hinting at steghide, reference to 'steg command' in command prompt, password hidden in accompanying image, WAV audio file paired with PNG image, standard LSB tools find nothing — check higher bit planes
• Source: 20260711_broncoctf2026_suspicious_remix_2.md

Foothold

Vulnerability / Misconfiguration

1. Bit_plane_analysis
2. Higher_bit_plane_inspection
3. Semantic_clue_parsing
4. Steghide_extraction

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• bit_plane_analysis
• higher_bit_plane_inspection
• semantic_clue_parsing
• steghide_extraction
• Tags: steganography, steghide, png, bit_plane, non_lsb, password_extraction, rickroll, wav

Original Writeup

<details><summary>Click to expand original content</summary>

Description

I just listened to the first one, I'm sorry for making you listen to that.

But now they sent me another one. I guess that they didn't directly embed the message in the audio, but I still think they put something in there somehow.

They told me it's supposedly more hide-n, whatever that means. I keep seeing with a command prompt, typing the steg command...

Also they told me there's a password of this, apparently it's in this image?

They keep doing this to me, this is their 2nd Remix! I'm so sorry for putting you through this. I promise I'll leave you alone after this.

Two files provided:

• sg_remix2.wav — RIFF WAVE audio, PCM, 16-bit, stereo, 48000 Hz, ~2:05 duration, 24 MB
• tolerate_this.png — PNG image, 500x409, RGBA, non-interlaced, 355 KB (shows Rick Astley from "Never Gonna Give You Up" music video)

Analysis

The challenge description contains multiple semantic clues:

• "hide-n" → steghide (the tool name sounds like "hide in")
• "command prompt, typing the steg command" → steghide is a CLI tool
• "password is in this image" → the PNG contains the steghide passphrase
• "2nd Remix" → sequel to a previous challenge

Standard LSB tools (zsteg) found nothing in the PNG. The key insight was that data can be hidden in higher bit planes (not just bit 0/LSB). Systematic extraction of all bit planes across all channels revealed hidden text in Red channel, bit 2.

The hidden message referenced the release year of the song shown in the image (Rick Astley's "Never Gonna Give You Up"). The non-OST album release was 1988 ("Whenever You Need Somebody" album), which served as the steghide password.

Solution

Step 1: Bit Plane Extraction from PNG

Standard LSB tools found nothing, so all bit planes were extracted systematically:

#!/usr/bin/env python3
from PIL import Image
import numpy as np

im = Image.open('tolerate_this.png').convert('RGBA')
arr = np.array(im)

for ci, c in enumerate('RGBA'):
    for bit in range(8):
        p = ((arr[:,:,ci] >> bit) & 1) * 255
        Image.fromarray(p.astype('uint8')).save(f'plane_{c}_{bit}.png')

Red channel, bit 2 (plane_R_2.png) revealed hidden text on a clean white background:

"Password = release year the non-OST song was from"

Step 2: Determine the Password

The PNG shows Rick Astley from "Never Gonna Give You Up". The song was released as a single in 1987, but the non-OST album ("Whenever You Need Somebody") was released in 1988. Testing confirmed 1988 as the correct steghide password.

Step 3: Steghide Extraction from WAV

docker run --rm --platform linux/amd64 -v "$PWD:/data" ubuntu:22.04 bash -c \
  "apt-get update -qq && apt-get install -y -qq steghide && \
   steghide extract -sf /data/sg_remix2.wav -p '1988' -xf /data/extracted.txt -f"

Output: wrote extracted data to "/data/extracted.txt"

The extracted file contained the flag.

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR