Ninja-Nerds

Platform: CUSTOM | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: bit_stream_reconstruction, single_channel_lsb_extraction

Summary

Walkthrough of the CUSTOM Steganography Ninja-Nerds. Task: a normal-looking PNG image contained no suspicious metadata, extra chunks, or useful strings, suggesting pixel-level hiding instead of container abuse. Solution: extract the least significant bi

Description

Organizer description was not preserved in the local task files.

The challenge provided a single PNG image, challenge.png. Basic file and metadata checks were clean, so the goal was to determine whether the payload was hidden inside image pixel data rather than in appended data or unusual PNG chunks.

Analysis

Initial recon showed a normal PNG:

 bash read-only • copy allowed Copy
file challenge.png
# PNG image data, 640 x 360, 8-bit/color RGB, non-interlaced

exiftool challenge.png
# normal metadata only

pngcheck challenge.png
# valid PNG, no suspicious chunks

strings challenge.png
# nothing useful

That ruled out the easiest container-level tricks. Since the file structure looked clean, the remaining likely hiding places were the RGB pixel channels and their bit planes.

Reviewing similar stego writeups for PNG bit-plane analysis suggested checking channels independently instead of treating the image as one flat byte stream. That mattered here because the payload was not spread across all pixels equally: it was stored only in the least significant bit of the blue channel.

The second key detail was byte assembly order. Grouping the extracted bits MSB-first into bytes produced readable text immediately, including the full flag.

Solution

1. Verify the PNG is structurally normal

Use file, exiftool, pngcheck, and strings to confirm there is no obvious metadata leak, appended archive, or suspicious custom PNG chunk.

2. Extract one channel at a time

Treat the image as an RGB array and isolate the blue channel (arr[:, :, 2]). Then keep only its least significant bit with & 1.

3. Rebuild bytes from the bit stream

Flatten the bit plane, take 8 bits at a time, and combine them MSB-first into bytes.

4. Decode and search for the flag

Decode the recovered byte stream with a permissive single-byte codec such as latin-1, then regex-search for the UMASS{...} pattern.

Full working solve script:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import re

import numpy as np
from PIL import Image


def main():
    arr = np.array(Image.open("challenge.png"))
    bits = (arr[:, :, 2] & 1).flatten()

    data = bytearray()
    for i in range(0, len(bits) - 7, 8):
        byte = 0
        for bit in bits[i:i + 8]:
            byte = (byte << 1) | int(bit)
        data.append(byte)

    text = data.decode("latin-1", errors="ignore")
    match = re.search(r"UMASS\{[^}]+\}", text)
    if not match:
        raise SystemExit("flag not found")

    print(match.group(0))


if __name__ == "__main__":
    main()

Running it prints:

 text read-only • copy allowed Copy
UMASS{REDACTED}

Key Takeaways / Lessons

• Mastering bit_stream_reconstruction, single_channel_lsb_extraction was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-11 • CUSTOM • Ninja-Nerds • Difficulty: Easy