An Italian Penguin

Platform: metactf | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-10 | Status: Solved Techniques: false_positive_elimination, hint_interpretation, passphrase_derivation, steghide_payload_extraction

Summary

Task: a JPEG penguin image appeared to be a stego challenge, but normal metadata checks and outguess-style probing were misleading. Solution: interpret the Linux-themed hint as the GNU/Linux copypasta meme, use GNU/Linux as the passphrase, and extract the embedded payload with stegseek.

An Italian Penguin — metactf

Description

Original organizer description was not preserved locally.

Available hint: Hint 1: Search up Linux (To make a duplicate + Spaghetti is a type of what?)

English summary: the task provides a JPEG image named Penguin_Steg.jpg. The goal is to identify the correct stego path, derive the passphrase from the hint, extract the hidden payload, and recover the flag.

Analysis

The image was first treated as a standard JPEG stego target. Basic recon and extraction attempts did not immediately help:

• EXIF, strings, and appended-data checks were clean.
• stegdetect reported outguess(old)(***), but this turned out to be a false positive.
• Clean reference images from the same penguin image family produced the same misleading outguess hit.
• Multiple OutGuess candidate keys only produced garbage and wasted time.

The useful pivot came from identifying the picture itself. Penguin_Steg.jpg matches the well-known ccpenguin image associated with the history of Tux and Linux mascot lore. That made the hint much more meaningful:

• duplicate → copy
• spaghetti is a type of → pasta
• Linux + copy + pasta → Linux copypasta

The most recognizable Linux copypasta is the GNU/Linux meme, so the correct passphrase is:

 text read-only • copy allowed Copy
GNU/Linux

Once that interpretation was tried, extraction succeeded immediately.

Solution

1. Inspect Penguin_Steg.jpg as a normal JPEG stego challenge.
2. Discard metadata/appended-data paths because they are clean.
3. Treat the stegdetect OutGuess result with caution and compare against clean reference images.
4. Recognize the image as the classic ccpenguin / Tux-history penguin image.
5. Parse the hint as copy + pasta and connect it to the Linux GNU/Linux copypasta meme.
6. Use GNU/Linux as the passphrase with stegseek.
7. Verify the extracted payload with file and strings to recover the flag.

Successful extraction:

 bash read-only • copy allowed Copy
docker run --rm -v "$PWD":/data rickdejager/stegseek --extract -sf /data/Penguin_Steg.jpg -p "GNU/Linux" -xf /data/gnu_linux_steg.bin -f -q
file gnu_linux_steg.bin
strings gnu_linux_steg.bin

Verification output contained the ASCII flag:

 text read-only • copy allowed Copy
DawgCTF{REDACTED}

 python read-only • copy allowed Copy
#!/usr/bin/env python3

from pathlib import Path
import subprocess


def main() -> None:
    image = Path("Penguin_Steg.jpg").resolve()
    output = Path("gnu_linux_steg.bin").resolve()

    subprocess.run(
        [
            "docker",
            "run",
            "--rm",
            "-v",
            f"{image.parent}:/data",
            "rickdejager/stegseek",
            "--extract",
            "-sf",
            f"/data/{image.name}",
            "-p",
            "GNU/Linux",
            "-xf",
            f"/data/{output.name}",
            "-f",
            "-q",
        ],
        check=True,
    )

    data = output.read_bytes()
    print("Extracted bytes:", len(data))
    print(data.decode("ascii", errors="ignore"))


if __name__ == "__main__":
    main()