Чужой (Alien)

Platform: bug-makers | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2025-10-04 | Status: Solved Techniques: base64_reassembly, per_entry_zip_comment_steganography, zip_central_directory_comment_extraction

Summary

Task: 5.8 MB DOCX (OOXML/ZIP) pseudo-scientific paper about the Alien franchise, flag hidden somewhere inside. Solution: the flag was split across per-entry ZIP central-directory comments; concatenating each entry's comment and base64-decoding yields the flag — invisible to Office and image/text stego tools.

Чужой (Alien) — bug-makers

Description

Мой друг написал научную статью про экспансию Чужих (ксеноморфов) и, для доказательства авторских прав, спрятал в ней флаг.

English summary: A friend wrote a scientific article about the expansion of the Aliens (xenomorphs) and, as proof of authorship/copyright, hid the flag inside it. The artifact is a 5.8 MB AlienExpansion.docx — a Russian-language pseudo-scientific paper about the "Alien" franchise, containing 5 embedded PNG images. Goal: recover the flag in format BugCTF{fl4g_7ex7}. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

A DOCX file is just a ZIP archive of OOXML parts. The flag was not in the document text, the images, or any XML metadata. It was hidden in the per-entry ZIP comments — the comment field that the ZIP central directory can attach to each individual file entry.

Two clues pointed at the ZIP container itself rather than the document content:

1. The archive-level ZIP comment read: I'm like an alien waiting for the time.
2. Running unzip -l AlienExpansion.docx printed stray base64 fragments interleaved between the filenames — unzip displays each entry's comment inline next to its name. These short alphanumeric chunks looked out of place among normal OOXML part names. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The title "Чужой" (Alien) plus the archive comment foreshadowed the technique: the flag is "injected in the archive like an alien" — sitting in the container metadata, not in any payload an Office reader or stego tool would ever inspect.

Solution

Read the archive comment for the hint, then walk infolist() in archive order, collect every non-empty per-entry comment, concatenate them, and base64-decode.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import zipfile, base64

z = zipfile.ZipFile('AlienExpansion.docx')
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Archive-level comment is the hint:
print(z.comment)  # b"I'm like an alien waiting for the time"

# Each file entry carries a fragment of the flag in its ZIP comment.
blob = ''.join(i.comment.decode() for i in z.infolist() if i.comment)
print(blob)
# QnVnQ1RGeyFUaGkkX2ZsQGdfMXNfaW5qM2N0ZWRfaW5fN2hlXzRyY2gxdmVfbCFrZV9hbl9hMWllbiF9

flag = base64.b64decode(blob + '==')
print(flag.decode())
# BugCTF{REDACTED}

Per-entry comments, in archive order, each holding one base64 chunk:

Concatenated → base64 → the flag, which self-describes the technique.

Failed approaches (skip these next time)

The 5 embedded PNGs and the document body were all red herrings:

• Image LSB stego on all 5 PNGs: RGB and per-channel (R/G/B/A), row and column order, MSB- and LSB-first.
• zsteg over all bit planes (b1–b4), all channel orders, xy/yx — only noise and false positives.
• stegano lsb.reveal → "Impossible to detect message".
• invisible-watermark (imwatermark) dwtDct and dwtDctSvd at all byte lengths — no printable output. (Image 3 carried a Qt-generated sRGB ICC profile, another red herring.)
• exiftool metadata, pngcheck — no extra/ancillary text chunks, no trailing data after IEND.
• Document body text, XML comments in any part, vanish/hidden runs, white/tiny font — all clean. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍