Текстурпак (Texturepack)

Platform: hackerlab | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-25 | Status: Solved Techniques: ascii_to_text, png_trailer_extraction, zip_carving

Summary

Task: PNG file with suspiciously large size (135 MB). Solution: Extract hidden ZIP from PNG trailer (after IEND marker), find ASCII codes in Minecraft resource pack splashes.txt, decode to flag.

Текстурпак — HackerLab

Description

Разработчик этого задания похоже любит не только играть, но и создавать

Given file minecraft.zip containing a huge PNG file (135 MB).

Analysis

1. Suspicious PNG Size

A 135 MB PNG file is abnormally large for a regular image. This signals hidden data.

2. Searching for Data After IEND

PNG files end with the IEND marker. Everything after it is hidden data:

 python read-only • copy allowed Copy
with open('minecraft.png', 'rb') as f:
    data = f.read()
    
# Find PNG end (IEND chunk)
iend_marker = b'\x49\x45\x4e\x44\xae\x42\x60\x82'  # IEND + CRC
iend_pos = data.find(iend_marker)
print(f"IEND at: {iend_pos}")
print(f"File size: {len(data)}")
print(f"Hidden data: {len(data) - iend_pos - 8} bytes")
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Extract hidden data
hidden = data[iend_pos + 8:]
with open('hidden.zip', 'wb') as f:
    f.write(hidden)

3. Analyzing the Hidden ZIP

The extracted ZIP (~127 MB) contains several Minecraft resource packs:

• EFT
• resource
• resourcepack 1.7.10
• rs
• vaporwave

4. Searching for Flag in Resource Packs

In file resource/assets/minecraft/texts/splashes.txt found ASCII codes:

67 79 68 69 66 89 123 109 49 110 51 99 114 97 102 116 95 116 51 120 116 117 114 51 115 95 110 51 119 95 108 101 118 51 108 125

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Texturepack - HackerLab Misc
PNG trailer extraction + ASCII decoding
"""

# Step 1: Extract ZIP from PNG
with open('minecraft.png', 'rb') as f:
    data = f.read()

iend_marker = b'\x49\x45\x4e\x44\xae\x42\x60\x82'
iend_pos = data.find(iend_marker)
hidden = data[iend_pos + 8:]

with open('hidden.zip', 'wb') as f:
    f.write(hidden)

print(f"[+] Extracted hidden ZIP: {len(hidden)} bytes")

# Step 2: Unpack and find splashes.txt
import zipfile
import os

with zipfile.ZipFile('hidden.zip', 'r') as z:
    for name in z.namelist():
        if 'splashes.txt' in name:
            print(f"[+] Found: {name}")
            content = z.read(name).decode('utf-8')
            print(f"[+] Content: {content[:100]}...")
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 3: Decode ASCII
ascii_codes = "67 79 68 69 66 89 123 109 49 110 51 99 114 97 102 116 95 116 51 120 116 117 114 51 115 95 110 51 119 95 108 101 118 51 108 125"
flag = ''.join(chr(int(c)) for c in ascii_codes.split())
print(f"[+] Flag: {flag}")

Alternative: binwalk

 bash read-only • copy allowed Copy
# Automatic extraction of embedded files
binwalk -e minecraft.png

# Search for splashes.txt
find _minecraft.png.extracted -name "splashes.txt" -exec cat {} \;

# Decode ASCII
echo "67 79 68 69 66 89 123 109 49 110 51 99 114 97 102 116 95 116 51 120 116 117 114 51 115 95 110 51 119 95 108 101 118 51 108 125" | \
  python3 -c "import sys; print(''.join(chr(int(c)) for c in sys.stdin.read().split()))"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Theory

PNG Structure

PNG file consists of chunks:

• 89 50 4E 47 0D 0A 1A 0A — PNG signature
• IHDR — header
• IDAT — image data
• IEND — end of file (49 45 4E 44 AE 42 60 82)

Everything after IEND is ignored by viewers but can contain hidden data.

Minecraft Resource Packs

• Format: ZIP archive
• Structure: assets/minecraft/texts/splashes.txt — random phrases on the main screen
• Ideal place for hiding data in CTF ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍