С наивной подписью на память

Platform: hackerlab | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-09 | Status: Solved Techniques: appended_archive_detection, archive_carving, password_hint_correlation, rar_signature_search

Summary

Task: a ZIP archive full of nostalgic images suggests stego in individual files, while a visible 1337 clue hints at another layer. Solution: ignore the rabbit hole, find an appended RAR inside the outer ZIP, carve it from the RAR signature offset, open it with password 1337, and read q.txt.

С наивной подписью на память — Hackerlab

Description

Всем привет, уважаемые читатели!

Сегодня я бы хотел разобрать один зимний таск с нашего ивента под названием "КиберКолизей 2".

Странно, райтап был точно у меня в буфере, но практически ничего не скопировалось. Похоже что у меня на этом пока что всё. Пойду поищу его, но если найдёте его быстрее, то было бы супер.

Пока что можете почитать какие-нибудь другие райтапы с площадки "Игры Кодебай" на нашем форуме.

С Уважением!

English summary: The task provides a large ZIP archive with many images and a nostalgic story, pushing you toward image steganography. The real solution is to use the visible 1337 clue, inspect the outer ZIP itself, carve an appended password-protected RAR, and read the hidden text file inside. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

The main rabbit hole is the image set. Some files have suspicious names, timestamps, and minor hints, and extra_11.png reveals that the archive password is 1337. That helps, but applying the hint to individual images does not solve the task.

The key pivot is to stop treating the images as the final target and inspect memory_1337.zip as a container. A signature search shows a RAR header appended near the end of the ZIP at offset 43109444, which matches what binwalk reports. Carving from that offset produces a valid embedded.rar. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Listing the carved archive with password 1337 shows q.txt. Extraction with 7z hit an unsupported method, so reading the file through Python's rarfile library was the simplest way to recover the contents.

Solution

Step 1 — Ignore the image-analysis rabbit hole

Useful hints exist in the media set, but the important result is only that one clue points to the password 1337.

Step 2 — Find the appended RAR inside the outer ZIP

Search for the RAR5 signature in memory_1337.zip:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pathlib import Path
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

data = Path("memory_1337.zip").read_bytes()
sig = b"Rar!\x1a\x07\x01\x00"
offset = data.find(sig)
print(offset)

Output:

 text read-only • copy allowed Copy
43109444

You can confirm the same idea with binwalk memory_1337.zip.

Step 3 — Carve the embedded archive

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pathlib import Path

src = Path("memory_1337.zip")
dst = Path("embedded.rar")
offset = 43109444

data = src.read_bytes()
dst.write_bytes(data[offset:])
print(f"wrote {dst} from offset {offset}")

Step 4 — Open the inner RAR with the hinted password

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Listing works with 7z:

 bash read-only • copy allowed Copy
7z l -p1337 embedded.rar

Step 5 — Read q.txt

7z hit an unsupported extraction method, so use Python instead:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import rarfile

with rarfile.RarFile("embedded.rar") as rf:
    data = rf.read("q.txt", pwd="1337").decode()
    print(data)

Output:

 text read-only • copy allowed Copy
CODEBY{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍