Немое кино (hello-pixie)

Platform: bug-makers | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-10-04 | Status: Solved Techniques: stream_enumeration, subtitle_extraction, base64_decode

Summary

Task: an MP4 'silent movie' with no audio hides data in tx3g (mov_text) subtitle tracks. Solution: enumerate all container streams with ffprobe, extract the subtitle tracks with ffmpeg, concatenate three base64 fragments placed at the timeline start, and decode to recover the flag.

Немое кино (hello-pixie) — BugCTF (bug-makers)

Description

Немое кино. Пикси пытается что-то сказать, но звука нет :(

English: "Silent movie. Pixie tries to say something, but there is no sound :("

We are given a single artifact, hello-pixie.mp4 (1.4 MB, 1120x832, H.264, ~4 seconds, 96 frames @ 24 fps). The challenge text steers the solver toward audio steganography — but the file has no audio at all. The "no sound" hint actually points to an alternate text channel: subtitles.

Analysis

The title and description ("silent movie", "no sound") are deliberate misdirection toward audio stego. Recon shows the MP4 has no audio stream whatsoever. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

file reports an ISO Media MP4 container. ffprobe confirms a single video stream and no audio:

ffprobe -v error -show_format -show_streams hello-pixie.mp4

Extracting frames shows an anime girl wearing a "BugCTF" cap lying on a bed hugging a ladybug plush — no visible flag in any frame.

The real find comes from enumerating all container streams, not just video/audio:

ffprobe -v error -show_entries stream=index,codec_type,codec_name hello-pixie.mp4

index=0 codec_type=video    codec_name=h264
index=1 codec_type=subtitle codec_name=mov_text
index=2 codec_type=subtitle codec_name=mov_text

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

exiftool corroborates this: Handler Description = SubtitleHandler, Other Format = tx3g, Media Language Code = rus. These are tx3g (mov_text) timed-text subtitle tracks. The character "speaks" through subtitles instead of audio — exactly what "no sound" hinted at.

Solution

Step 1 — Recon: confirm there is no audio

 bash read-only • copy allowed Copy
file hello-pixie.mp4
ffprobe -v error -show_format -show_streams hello-pixie.mp4

Result: one h264 video stream, no audio stream.

Step 2 — Enumerate ALL streams and spot the subtitle tracks

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
ffprobe -v error -show_entries stream=index,codec_type,codec_name hello-pixie.mp4
exiftool hello-pixie.mp4   # shows SubtitleHandler / tx3g / rus

Two mov_text (tx3g) subtitle tracks are present at indexes 1 and 2.

Step 3 — Extract both subtitle tracks

 bash read-only • copy allowed Copy
ffmpeg -v error -i hello-pixie.mp4 -map 0:s:0 sub0.srt -y
ffmpeg -v error -i hello-pixie.mp4 -map 0:s:1 sub1.srt -y

Subtitle track 0 (sub0.srt) contains base64 fragments at the very start of the timeline (timestamps 0.0s, 0.1s, 0.2s), followed by decoy lines: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

1  00:00:00,000 --> 00:00:00,000   QnVnQ1RGe2ZsMWdf
2  00:00:00,100 --> 00:00:00,100   MW5fc3ViN2l0MTNz
3  00:00:00,200 --> 00:00:00,200   X2dvb2RfbmlnaHR9
4  00:00:00,500 --> 00:00:01,500   Hello!
5  00:00:01,500 --> 00:00:03,000   Good night!

Subtitle track 1 (sub1.srt) contains only Russian decoy text: "Привет!" and "Спокойной ночи!". The decoy lines match the silent-film theme but are noise.

Step 4 — Concatenate the three base64 chunks and decode

 bash read-only • copy allowed Copy
echo -n "QnVnQ1RGe2ZsMWdfMW5fc3ViN2l0MTNzX2dvb2RfbmlnaHR9" | base64 -d

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Result:

BugCTF{REDACTED}

The flag spells out the technique itself: REDACTED = "flag in subtitles".

Artifacts

• hello-pixie.mp4 — the challenge media file.
• Hidden base64 string in subtitle track 0: QnVnQ1RGe2ZsMWdfMW5fc3ViN2l0MTNzX2dvb2RfbmlnaHR9. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍