🔴👂ing

Platform: bluehensctf | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-21 | Status: Solved Techniques: embedded_base64_decoding, magic_header_inspection, strings_recon

Summary

Task: Supposed JPEG steganography challenge with a broken image file and a misleading prompt about using every stego skill. Solution: Check raw file structure, notice the malformed JPEG header and embedded base64 string, then decode it directly to recover the flag.

🔴👂ing — BlueHens CTF 2026

Description

Use all the skills you know about stegonagraphy...

The challenge provides a single file, bluehen.jpg, and strongly suggests that the flag is hidden with some deeper steganography trick. In reality, the title and prompt are a red herring: the useful data is exposed directly inside a malformed JPEG-like file.

Recon

I created a workspace under tasks/BlueHens CTF 2026/🔴👂ing and downloaded bluehen.jpg.

Initial checks immediately showed that this was not a normal image: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
file bluehen.jpg
# data

exiftool bluehen.jpg
# File format error

That ruled out the usual quick metadata path. Running strings was more useful:

 bash read-only • copy allowed Copy
strings bluehen.jpg

The output contained both JFIF and this suspicious base64-looking string:

 text read-only • copy allowed Copy
VURDVEZ7eTB1X2wxazNfcjNkX2gzNHIxbjY/fQ==

To confirm the file structure, I looked at the first bytes:

 bash read-only • copy allowed Copy
xxd -l 128 bluehen.jpg

The file starts with malformed bytes like e0 00 10 4a 46 49 46 ... instead of a standard JPEG header such as ff d8 ff e0. The same hex view also showed the base64 string sitting inside what looks like a JPEG comment segment. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

This challenge is intentionally themed as steganography, but the important clue is that the file is broken in a very obvious way. JFIF is present, which tries to make the file look like a JPEG, yet both file and exiftool reject it as a valid image.

That mismatch suggests the challenge is not about extracting subtle pixel-level data. Instead, it points toward manual inspection of the raw bytes. Once strings reveals a clean base64 blob in the file body, the most likely explanation is that the flag was embedded directly as text and the corrupted JPEG framing is only there to distract the solver. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

1. Run basic triage on the provided file.
2. Notice that the image is malformed and not parseable as a real JPEG.
3. Search the raw contents with strings.
4. Extract the visible base64 string.
5. Decode it with Python.

 bash read-only • copy allowed Copy
python3 -c 'import base64; print(base64.b64decode("VURDVEZ7eTB1X2wxazNfcjNkX2gzNHIxbjY/fQ==").decode())'

Output:

 text read-only • copy allowed Copy
UDCTF{REDACTED}

Full minimal reproduction script:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import base64

blob = "VURDVEZ7eTB1X2wxazNfcjNkX2gzNHIxbjY/fQ=="
print(base64.b64decode(blob).decode())

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways

• A challenge labeled as steganography does not always require advanced stego tooling.
• If a file claims to be an image but fails basic format validation, inspect the raw bytes before trying deeper extraction techniques.
• Readable encoded blobs inside a malformed container are often the real payload, and the surrounding format is just misdirection. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍