St3g0 | PicoCTF/CyLab Forensics

Learn how to solve the St3g0 PicoCTF challenge by extracting hidden data from a PNG image using zsteg, a tool designed to detect steganographic content stored in image bit planes.

Steganography is the practice of hiding information inside another file, such as an image, audio file, or document. In this challenge, the hidden flag is embedded inside a PNG image rather than being visible in its metadata or pixels.

Challenge Statement

Download this image and find the flag.

Download the Image

wget https://artifacts.picoctf.net/c/216/pico.flag.png

Try Common Steganography Tools

First, try stegseek and steghide.

stegseek pico.flag.png /usr/share/wordlists/rockyou.txt

Output:

the file format of the file "pico.flag.png" is not supported.

Next:

steghide info pico.flag.png

─(kali㉿kali)-[~/ctf]
└─$ steghide extract -sf pico.flag.png 
Enter passphrase: 

┌──(kali㉿kali)-[~/ctf]
└─$ stegseek pico.flag.png /usr/share/wordlists/rockyou.txt
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

[!] error: the file format of the file "pico.flag.png" is not supported.

┌──(kali㉿kali)-[~/ctf]
└─$ steghide info pico.flag.png
steghide: the file format of the file "pico.flag.png" is not supported.

Since steghide only supports JPEG, BMP, WAV, and AU files, it cannot analyze PNG images.

Inspect the File

Run binwalk to check for embedded files.

binwalk -e pico.flag.png

┌──(kali㉿kali)-[~/ctf]
└─$ binwalk -e pico.flag.png

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
41            0x29            Zlib compressed data, default compression

WARNING: One or more files failed to extract: either no utility was found or it's unimplemented

No useful hidden files were extracted.

Analyze with zsteg

Since the challenge uses a PNG image, use zsteg, which is specifically designed for PNG steganography.

zsteg pico.flag.png

Output:

b1,rgb,lsb,xy .. text:
picoCTF{7h3r3_15_n0_5p00n_a1062667}$t3g0

zsteg is one of the best tools for finding hidden data inside PNG images by analyzing bit planes and color channels.

The hidden flag is revealed immediately.

Flag

picoCTF{7h3r3_15_n0_5p00n_a1062667}

Conclusion

The St3g0 challenge highlights the importance of selecting the right tool for the file format. While steghide and stegseek were unsuitable for PNG images, zsteg successfully detected the hidden message stored in the image's least significant bits (LSBs), allowing the flag to be recovered quickly.

Thank You!