Metacat

Platform: taipanbyte | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-02-14 | Status: Solved Techniques: exif_extraction, metadata_analysis

Summary

Task: Image file with hidden data. Solution: Extract flag parts from EXIF metadata fields (Artist, XP Author, XP Comment) using exiftool.

Metacat — taipanbyte

Description

Haha cat on a watermelon https://chart.taipanbyte.ru/api/uploads/6ebeb453-5315-4d89-b907-17a47f351173/watermelon_cat.jpg?token=...

Analysis

The task provides an image watermelon_cat.jpg. The first step when analyzing image files is to check the metadata.

Solution

1. Download the image.
2. Use exiftool to view all file metadata:

 bash read-only • copy allowed Copy
exiftool watermelon_cat.jpg

In the output, we find parts of the flag in several fields:

• Artist: TB{h1dd3n_
• XP Author: TB{h1dd3n_
• XP Comment: 1n_ex1f} ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The XP Comment field is often encoded in UTF-16LE, so when viewing through strings it may appear as 1.n._.e.x.1.f.}..

1. Combine the flag parts: TB{h1dd3n_ + 1n_ex1f} = TB{REDACTED}. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍