← Back to Writeups
CUSTOMEasySteganography

Нейросеть

XESXOR9/10/20264 min read
#steganography#custom#easy#bacon_cipher_decoding#uppercase_lowercase_binary_ext#5bit_group_decoding

Нейросеть

Platform: hackerlab | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-04-09 | Status: Solved Techniques: bacon_cipher_decoding, uppercase_lowercase_binary_extraction, 5bit_group_decoding

Summary

Task: a PNG screenshot of an AI chatbot conversation where one paragraph has deliberately mixed capitalization hiding a Bacon cipher message. Solution: extract uppercase/lowercase as binary (B/A), decode 5-bit Bacon cipher groups (26-letter alphabet) to recover REDACTED.

Нейросеть — Hackerlab

Description

Я попросил у искусственного интеллекта немного информации о текстовой стеганографии, но он мне выдал таск...И как это понимать? Формат флага: CODEBY{FLAG}

English summary: A PNG screenshot shows a conversation with TheB.AI chatbot where the user asks about text steganography. The AI responds with several paragraphs, but the 3rd paragraph has deliberately mixed capitalization — a steganographic encoding hidden in plain sight. The goal is to decode the hidden message. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

The image shows a dark-themed chat interface with TheB.AI. Most paragraphs have normal capitalization, but one paragraph stands out with random-looking uppercase/lowercase patterns:

"In TexT steGaNograpHY, the SECRet MEsSage Is tYPiCallY emBdded bY making suBtlE MOdiFIcATioNs to the text itself, such as altering the spacing between words, changing the font size or style of certain characters, or even replacing certain words with synonyms. The key is to make these modifications in a way that is not easily noticeable to the casual reader." ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key observations:

  1. Only the first sentence of this paragraph contains the steganographic encoding — the rest has normal capitalization
  2. The encoding uses two states (uppercase/lowercase) — this is characteristic of the Bacon cipher (Baconian cipher)
  3. Extracting only alphabetic characters from the stego sentence yields exactly 80 characters = 16 groups of 5 bits — perfect for Bacon cipher
  4. The challenge title "Нейросеть" (Neural Network) and the AI chat context are red herrings — the actual technique is a classical cipher from the 1600s ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

OCR difficulty: The sans-serif font in the dark-themed chat makes uppercase I and lowercase l nearly indistinguishable. Careful manual reading was required:

  • "tYPiCallY" — double lowercase l, not lI
  • "suBtlE" — lowercase l, not uppercase I
  • "MOdiFIcATioNs" — lowercase i and o at certain positions

Solution

Step 1 — Extract the stego sentence

Only the first sentence of the anomalous paragraph contains the encoding:

In TexT steGaNograpHY the SECRet MEsSage Is tYPiCallY emBdded bY making suBtlE MOdiFIcATioNs

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2 — Map uppercase/lowercase to binary

Extract alphabetic characters and map: uppercase → 1 (B), lowercase → 0 (A):

I n T e x T s t e G a N o g r a p H Y t h e S E C R e t M E s S a g e I s t Y P i C a l l Y e m B d d e d b Y m a k i n g s u B t l E M O d i F I c A T i o N s
1 0 1 0 0 1 0 0 0 1 0 1 0 0 0 0 0 1 1 0 0 0 1 1 1 1 0 0 1 1 0 1 0 0 0 1 0 0 1 1 0 1 0 0 0 1 0 0 1 0 0 0 0 0 1 0 0 0 0 1 0 0 0 1 0 1 1 1 0 0 1 1 0 1 0 0 1 0 0 1 0

80 alphabetic characters → 16 groups of 5 bits.

Step 3 — Decode Bacon cipher (26-letter alphabet, variant 2)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Using the standard 26-letter Bacon cipher (A=00000, B=00001, ..., Z=11001):

[00:05] 10100 = 20 → U
[05:10] 10001 = 17 → R
[10:15] 01000 =  8 → I
[15:20] 00110 =  6 → G
[20:25] 00111 =  7 → H
[25:30] 10011 = 19 → T
[30:35] 01000 =  8 → I
[35:40] 10011 = 19 → T
[40:45] 01000 =  8 → I
[45:50] 10010 = 18 → S
[50:55] 00001 =  1 → B
[55:60] 00000 =  0 → A
[60:65] 00010 =  2 → C
[65:70] 01110 = 14 → O
[70:75] 01101 = 13 → N
[75:80] 10010 = 18 → S

Decoded: REDACTED → "U RIGHT IT IS BACONS" — a self-referential message confirming the cipher type! ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 4 — Solve script

python
#!/usr/bin/env python3
# Bacon cipher decoder for Hackerlab "Нейросеть" challenge

text = "In TexT steGaNograpHY the SECRet MEsSage Is tYPiCallY emBdded bY making suBtlE MOdiFIcATioNs"

# Extract only alphabetic characters
alpha = [c for c in text if c.isalpha()]
print(f"Alphabetic characters: {len(alpha)}")  # 80

# Map uppercase→1, lowercase→0
bits = ''.join('1' if c.isupper() else '0' for c in alpha)
print(f"Binary: {bits}")
print(f"Groups of 5: {[bits[i:i+5] for i in range(0, len(bits), 5)]}")
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Decode Bacon cipher (26-letter alphabet: A=0, B=1, ..., Z=25)
alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
decoded = ''
for i in range(0, len(bits) - 4, 5):
    group = bits[i:i+5]
    value = int(group, 2)
    if value < 26:
        decoded += alphabet[value]
        print(f"  [{i:02d}:{i+5:02d}] {group} = {value:2d} → {alphabet[value]}")

print(f"\nDecoded: {decoded}")
print(f"Flag: CODEBY{{{decoded}}}")
# Output: CODEBY{REDACTED}

Alternative: Use dcode.fr Bacon Cipher Decoder with settings: A=A, B=B, 26-letter alphabet. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍