turtle

76 Points / 247 Solves
Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆

Background

Nothing to see here but a happy turtle.

Find the flag

In this challenge, we can download a file:

┌[siunam♥earth]-(~/ctf/RITSEC-CTF-2023/Steganography/turtle)-[2023.04.02|19:35:30(HKT)]
└> file turtle.gif       
turtle.gif: GIF image data, version 89a, 224 x 126

It’s a GIF image file!

We can use exiftool to view it’s metadata:

┌[siunam♥earth]-(~/ctf/RITSEC-CTF-2023/Steganography/turtle)-[2023.04.02|19:35:44(HKT)]
└> exiftool turtle.gif
ExifTool Version Number         : 12.57
File Name                       : turtle.gif
[...]

However, nothing weird in the metadata.

Then, I tried using steghide, binwalk, foremost to extract hidden file inside it, but no dice.

Hmm… Since it’s a GIF file, let’s view it’s image frame by frame.

According to HackTricks, we can use a tool called Stegsolve to view image’s frames:

┌[siunam♥earth]-(~/ctf/RITSEC-CTF-2023/Steganography/turtle)-[2023.04.02|19:37:45(HKT)]
└> /opt/Stegsolve.jar

Next, go to “Analyse” -> “Frame Browser”:

We can now view the GIF frame by frame!

After looking at those frame, I found that the 40th frame has the flag!

Flag: RS{G00D_3Y3_&_H4PPY_TUR713}

Conclusion

What we’ve learned:

Viewing Animated GIF Frame By Frame