Tabs&Spaces

CATEGORY - STEGANOGRAPHY

Introduction

This challenge provides a ZIP file containing multiple files. Our goal is to analyze them and extract a hidden flag, which appears to involve whitespace-based steganography.

Steps

Step 1: Extracting and Inspecting the ZIP File

The challenge provides a ZIP archive. After extracting it, we see the following files inside:

A Python script is present, which appears to be for checking file integrity and isn't immediately useful.

Step 2: Identifying an Anomalous File

Navigating into the files/ directory, I checked the contents of all files. One file stood out due to its different color and unusual file extension.

To make it easier to work with, I renamed the file to remove the extra . in its name.

Step 3: Initial Steganography Checks

Since the file was a JPG image, I performed basic steganography checks:

• Exiftool → No interesting metadata found.

• Steghide (without passphrase) → Extracted a hidden text file named whitespace_flag.txt.

steghide extract -sf 87.jpg

Step 4: Analyzing whitespace_flag.txt

Opening whitespace_flag.txt in Sublime Text, I noticed that the content wasn't regular text. Instead, it appeared to contain whitespace-based encoding.

Searching online for whitespace steganography, I found tools like stegsnow. However, stegsnow didn't reveal any meaningful text, suggesting that another encoding method was used.

Upon closer inspection, I saw patterns of tabs (^I) and spaces (␣), which indicated binary encoding, where:

• Tab (^I) = 1

• Space (␣) = 0

Step 5: Converting Whitespace to Binary

To decode the message, I used the following command:

cat whitespace_flag.txt | tr ' ' '0' | tr '\t' '1' | tr -d '\n'

This converted the hidden text into a binary string:

0100000101000011010001010100001101010100010001100111101101101110001100000101111100110011011110000111000000110001001100000011000100110111010111110110111000110000010111110110011100110100001100010110111001111101

Step 6: Converting Binary to Text

For the final step, I converted the binary data to readable text using Perl:

echo "0100000101000011010001010100001101010100010001100111101101101110001100000101111100110011011110000111000000110001001100000011000100110111010111110110111000110000010111110110011100110100001100010110111001111101" | perl -lpe '$_=pack"B*",$_'

FLAG

ACECTF{n0_3xp1017_n0_g41n}