Привет всем / Hello all

Platform: hackerlab | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-06-03 | Status: Solved Techniques: audio_spectrogram_stego, binwalk_signature_scan, ffmpeg_showspectrumpic, file_carving, offset_carving

Summary

Task: a 12 MB JPEG that is only 1080x537 pixels — a polyglot with an appended WebM video and PNG. Solution: carve the embedded Matroska video by offset, extract its PCM audio with ffmpeg, and read the flag rendered as text in the audio spectrogram (showspectrumpic).

Привет всем / Hello all — hackerlab

Description

Привет, я появился! Но не знаю, где флаг... ("Hi, I appeared! But I don't know where the flag is...")

A single image hello_all.jpg is provided inside a downloadable ZIP. The image is 1080×537 pixels yet weighs ≈12 MB — far too large for such a small JPEG. That size anomaly is the entire hook: the file is a polyglot with extra data appended after the JPEG end-of-image marker.

Analysis

Download and unzip the artifact:

 bash read-only • copy allowed Copy
curl -sL "https://hackerlab.pro/game_api/files/download?folder=parts_cb174416-80da-4799-b136-75d6e01882bd_data&name=hello_all&type=zip" -o hello_all.zip
unzip hello_all.zip   # -> hello_all.jpg  (JPEG, 1080x537, ~12 MB)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Recon immediately flags the size anomaly:

 bash read-only • copy allowed Copy
file hello_all.jpg        # JPEG image data, baseline, 1080x537
exiftool hello_all.jpg    # File Size: 12 MB  (red flag for a tiny image)
binwalk hello_all.jpg

binwalk reveals multiple embedded signatures stacked inside the JPEG:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
...           0x1B115         EBML / Matroska header (WebM/MKV video, ~12 MB)
...           0xB86F6E        PNG image, 474 x 647, 8-bit/color RGBA

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The first JPEG EOI marker (FF D9) appears very early (offset ~110867), confirming that everything after it is appended payload — a classic JPEG + Matroska + PNG polyglot.

Solution

1. Carve the embedded files

The PNG (offset ≈12087150 → EOF) is an alien face with a pink bow — a thematic nod to "я появился" / "I appeared". It contains no flag; it is a decoy/theme image. The interesting payload is the Matroska/WebM video between the JPEG EOI and the PNG.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
data = open("hello_all.jpg", "rb").read()
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Offsets from binwalk
mkv_off = 110869       # just after the embedded EBML/Matroska header start
png_off = data.find(b"\x89PNG\r\n\x1a\n", 0xB80000)  # ~12087150

open("video.mkv", "wb").write(data[mkv_off:png_off])
open("embedded.png", "wb").write(data[png_off:])
print("video.mkv :", png_off - mkv_off, "bytes")
print("embedded.png:", len(data) - png_off, "bytes")

2. Probe the video

 bash read-only • copy allowed Copy
ffprobe video.mkv

A 60-second AV1 video (640×360, 29.97 fps) with a PCM s16le stereo 44.1 kHz audio track. A raw PCM audio track is a strong hint for spectrogram stego. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Extract the audio and render a spectrogram

 bash read-only • copy allowed Copy
ffmpeg -i video.mkv -vn -acodec pcm_s16le audio.wav
ffmpeg -i audio.wav -lavfi showspectrumpic=s=1600x800:legend=disabled spectro.png

The flag is drawn as visible text across the audio's frequency spectrum. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍