Где Снегурочка капибар?

Platform: hl_hacker | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-26 | Status: Solved Techniques: Extracting hidden ZIP from PNG trailer, Geolocation from coordinates

Summary

Task: Find hidden data in a PNG image containing a capybara. Solution: Extract ZIP archive from PNG trailer data using binwalk/dd, revealing coordinates and the flag.

Где Снегурочка капибар? — hl_hacker

Description

The task provided an archive capybara.zip (available at http://193.84.2.15:16300/capybara.zip), containing an image Haha_here_s_your_friend.png. The goal was to find the Snow Maiden capybara and obtain the flag.

Analysis

When analyzing the image Haha_here_s_your_friend.png with exiftool, suspicious activity was detected:

 bash read-only • copy allowed Copy
exiftool Haha_here_s_your_friend.png

The output contained a warning: Warning: [minor] Trailer data after PNG IEND chunk ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This is a clear sign that additional data has been appended to the end of the PNG file (steganography using the "trailer" method).

Solution

1. Finding and Extracting Hidden Data

Using binwalk to determine the type and offset of hidden data:

 bash read-only • copy allowed Copy
binwalk Haha_here_s_your_friend.png

Binwalk showed the presence of a ZIP archive at the end of the file.

For extraction, you can use dd (knowing the offset) or a simple Python script. Manually it looks like this:

 bash read-only • copy allowed Copy
# Find the ZIP offset (start of PK..)
grep -aobP "\x50\x4b\x03\x04" Haha_here_s_your_friend.png
# Or use dd if the offset is known (e.g., 123456)
dd if=Haha_here_s_your_friend.png bs=1 skip=123456 of=hidden.zip

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Alternative extraction method using Python:

 python read-only • copy allowed Copy
with open("Haha_here_s_your_friend.png", "rb") as f:
    data = f.read()
    zip_start = data.find(b"\x50\x4b\x03\x04")
    if zip_start != -1:
        with open("hidden.zip", "wb") as out:
            out.write(data[zip_start:])

2. Examining the Contents

Inside the extracted ZIP archive was a file sos_message.txt.

 bash read-only • copy allowed Copy
unzip hidden.zip
cat sos_message.txt

File contents:

Помогите! Меня похитили! 
Мои координаты: 51.515211, 46.054190
Флаг: CODEBY{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. OSINT Verification (Optional)

The coordinates 51.515211, 46.054190 lead to the Saratov Bridge over the Volga River. Visual confirmation on the original photo (if it was panoramic or contained recognizable elements) matches this location. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍