m00nwalk2 write up

In this post i will describe how I solve m00nwalk2 challenge from picoCTF

## Tools and command used

•file

• exiftool

• qsstv

• steghide

• audacity

• image viewer (im using feh)

## Description

In this challenge we are given 4 files to start with. The transmission that have a hidden message and 3 clues. All of them are a .wav audio files. This challenge is a require a steganography tools to solve.

## Getting started

After downloading all the files, I examine all 4 files and confirm that its an actual audio files. But all of the audio files sounds like its not intended to be listened.

One of the method used to hide secret in an audio files is through whats called SSTV (slow scan television). Basically slow scan television encodes image data into an audio frequencies. And one of the tools to decode sstv is called qsstv.

So I open qsstv to decode the hidden image. I use this configuration for the sstv

sstv config image

I set the mode to auto to let qsstv automatically pick the right sstv transmission format.

I also change the sound input option so it can take an input from a file (option > Sound > set sound input to “From file”).

## Decoding the audio

When i tried to input the audio file into qsstv, i got an error saying “Invalid Header format”. So i put each .wav files into audacity and export it as .wav file again.

After putting each files into qsstv, the result for each audio files is:

• message.wav

message image

• clue1.wav

clue1 image

• clue2.wav

clue2 image

• clue3.wav

clue3 image

It seems like message.wav show us the flag. But when I tried to input it in picoCTF, it didnt work. The clue1.wav file has a useful information. Theres a text Password hidden_stegosaurus. This is the next clue to get the final flag.

## Getting the flag

When i tried to use steghide to extract anything from the image i got from qsstv.

└─$ steghide extract -sf message.png -p hidden_stegosaurus steghide: the file format of the file "message.png" is not supported.

I got an error. So i tried to extract it using the audio file instead

└─$ steghide extract -sf message.wav -p hidden_stegosaurus wrote extracted data to "steganopayload12154.txt".

By reading the content of steganopayload12154.txt I got the flag which is

> `picoCTF{the_answer_lies_hidden_in_plain_sight}`

**## Lessons learned**

From this challenge i learned that steganography also works on audio files. At first I thought the flag is hidden inside the image generated from inputing `message.wav` into `qsstv`. Turns out the flag is hidden inside the `message.wav` file itself.

URL: [https://play.picoctf.org/practice/challenge/28?category=4&difficulty=3&page=2](https://play.picoctf.org/practice/challenge/28?category=4&difficulty=3&page=2)