Careful with Trust

Platform: hackerlab | Category: Steganography | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2026-04-05 | Status: Solved Techniques: acropalypse_exploitation, deflate_stream_recovery, png_chunk_analysis, trailing_data_extraction

Summary

Task: a cropped PNG screenshot contains hidden data after the IEND chunk due to Windows Snipping Tool not truncating the file (aCropalypse / CVE-2023-28303). Solution: extract trailing IDAT chunks, recover the deflate stream at the correct bit offset, and reconstruct the original full-screen image to reveal a bank card with the flag.

Careful with Trust — Hackerlab

Description

Относительно недавно сотруднику, ответственному за поставки, пришлось перевести крупную сумму денег для завершения сделки. Начальство выделило ему для этого собственную карту. До завершения транзакции в какой-то момент у него пропал интернет. Он обратился к сисадмину и отправил ему следующий скриншот (прикреплён к заданию). Через несколько часов все деньги с карты пропали, а сисадмин внезапно уволился и выкладывает сторис с Мальдив. Вам нужно разобраться в этом. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

English summary: An employee needed to transfer money using a company card. When his internet dropped, he took a screenshot of the browser error and sent it to the sysadmin. Shortly after, all money disappeared from the card and the sysadmin quit and fled to the Maldives. We are given the screenshot (task.png) and a hint image (full_screen.png) showing the original full-screen dimensions. The goal is to figure out how the sysadmin obtained the card details from the screenshot.

Analysis

File reconnaissance

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Two files were provided in task.zip:

Running exiftool on task.png immediately revealed a critical warning:

Warning: Trailer data after PNG IEND chunk

The actual PNG data (signature + IHDR + sRGB + gAMA + pHYs + IDAT + IEND) only accounts for 43,028 bytes. That means 1,199,617 bytes of trailing data exist after the IEND chunk — far more data than the visible image itself. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The full_screen.png hint showed the same desktop at 1589×1272 resolution — the original dimensions before the screenshot was cropped down to 1589×707. This gave us the target dimensions for reconstruction.

Identifying the vulnerability — aCropalypse (CVE-2023-28303)

The Windows Snipping Tool (and the older Win+Shift+S screenshot tool) has a critical bug: when a user crops an image and saves it over the original file, the tool opens the file with CreateFile using OPEN_EXISTING but does not truncate it. The new (smaller) PNG data is written from the beginning, but the old data beyond the new IEND chunk remains intact. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

This means:

• The employee took a full-screen screenshot (1589×1272) showing the browser error and the rest of his desktop
• He then cropped it to show only the browser window (1589×707) and saved over the same file
• The original IDAT chunks containing the bottom 565 rows of pixels remained as trailing data
• The sysadmin recognized the aCropalypse vulnerability, recovered the hidden portion, and found the bank card details

Trailing data structure

The trailing data contained:

• Partial first IDAT chunk (boundary was split by the overwrite)
• 18 complete IDAT chunks from the original full-screen image
• A partial final IDAT chunk plus the original IEND ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Confirm aCropalypse vulnerability

 bash read-only • copy allowed Copy
exiftool task.png
# Warning: Trailer data after PNG IEND chunk

python3 -c "
with open('task.png','rb') as f:
    data = f.read()
iend = data.find(b'IEND')
print(f'IEND at offset: {iend}')
print(f'File size: {len(data)}')
print(f'Trailing bytes: {len(data) - iend - 8}')
"
# Trailing bytes: ~1,199,617

Step 2: Recover the image using Acropalypse Multi-Tool

Used the Acropalypse Multi-Tool Python script, which: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

1. Parses the PNG to find the IEND chunk
2. Extracts all trailing data after IEND
3. Locates IDAT chunks in the trailing data and concatenates their bodies
4. Builds a bitstream from the raw deflate data
5. Tries all 8 possible bit offsets to find a valid deflate entry point
6. Uses a 32KB null-byte prefix for backreferences (since the original preceding data is lost)
7. Decompresses the recovered stream and pastes it into a new full-size image

 python read-only • copy allowed Copy
from acropalypse_tool import Acropalypse

a = Acropalypse()
a.reconstruct_image('task.png', 1589, 1272, True)  # width=1589, height=1272, RGBA=True

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Output:

Found 1199617 trailing bytes!
Extracted 1199254 bytes of idat!
building bitstream...
reconstructing bit-shifted bytestreams...
Scanning for viable parses...
Found viable parse at bit offset 385533!
Generating output PNG...
Done!

Step 3: Examine the recovered image

The restored image (restored.png) showed:

• Top portion (rows 0–706): Filled with magenta — this data was overwritten by the cropped image and is unrecoverable
• Bottom portion (rows 707–1271): The hidden desktop content:
  • Left side: A Solitaire card game window
  • Right side: A Mastercard image displaying:
    • Card number: 5311 6429 0692 9742
    • CVV/CVV2: 123
    • Expiry: 12/2026
    • The flag: CODEBY{REDACTED} ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The sysadmin extracted these card details from the "innocent" screenshot and stole the money. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍