← Back to Writeups
CUSTOMMediumSteganography
Bookmark

Глубокий звук (Deep Sound)

XESXOR9/2/20263 min read
#steganography#custom#medium#deepsound_extraction#multi_layer_steganography#outguess_extraction#wordplay_hint_interpretation#windows

Глубокий звук (Deep Sound)

Platform: duckerz | Category: Steganography | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2026-03-17 | Status: Solved Techniques: deepsound_extraction, multi_layer_steganography, outguess_extraction, wordplay_hint_interpretation

Summary

Task: WAV file with Rick Astley song containing hidden data. Solution: Two-layer steganography - DeepSound extraction from WAV reveals JPEG, then OutGuess extraction from JPEG (hinted by "can't guess" wordplay) reveals the flag.

Глубокий звук (Deep Sound) — Duckerz CTF

Description

"Я люблю старые песни, поэтому мой друг обработал мою любимую композицию сделав более интересное звучание. Мне кажется он оставил какое-то послание..."

File: Never-Gonna-Give-You-Up.wav (37 MB, 16-bit stereo 44100Hz WAV, Rick Astley - Never Gonna Give You Up)

Analysis

Step 1: Identifying DeepSound Steganography

  • Task name "Глубокий звук" translates to "Deep Sound" — a direct hint at the DeepSound tool
  • Download URL /DeepSound/ also confirms this
  • DeepSound is a Windows GUI application for hiding files inside WAV/FLAC audio using LSB steganography
  • WAV file contains DSC2 header (DeepSound 2.x format) with mode=4 (normal quality), encrypted=0 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: DeepSound Container Structure

DSC2 (4 bytes) — DeepSound 2.x signature
mode (1 byte) — quality (4 = normal)
encrypted (1 byte) — encryption flag (0 = none)
DSSF entries — embedded files

DSSF entry structure:

DSSF (4 bytes) — file signature
filename (20 bytes) — filename
size (4 bytes BE) — data size
padding (4 bytes)
file data — file contents

Step 3: Extracting the Hidden File

Used DeepSound 2.1 (installed on Windows VDS via MSI from https://github.com/Jpinsoft/DeepSound/releases) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Also successfully extracted manually via Python by decoding LSB data:

 python 
# Each decoded byte = (raw[i] & 0x0F) << 4 | (raw[i+2] & 0x0F)
# every 4 bytes from audio data starting at offset 46

Extracted file: duck.jpg (31930 bytes, 500x375 JPEG image of a wooden decoy duck)

Step 4: Analyzing the Hint in duck.jpg

The extracted image shows a wooden decoy duck with text:

  • "WOOPS just decoys this way."
  • "Looks like you can't guess how to get the message out."

Key insight: "can't guess" is a wordplay pointing to OutGuess — a steganography tool that hides data in DCT coefficients of JPEG images. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Extracting from DeepSound

 bash 
# Option 1: Use DeepSound GUI on Windows
# Option 2: Manual extraction via Python (LSB decoding)

Extracting the Flag with OutGuess

 bash 
docker run --rm -v $(pwd)/tasks/duckerz/deep_sound:/data ubuntu:22.04 bash -c \
  "apt-get update -qq && apt-get install -y -qq outguess && outguess -r /data/duck.jpg /data/output.txt"

Output:

Steg retrieve: seed: 217, len: 34

Extracted content: DUCKERZ{REDACTED}

Red Herrings / False Trails

  • Second encrypted DSSF block in the DeepSound container was an intentional decoy — much time spent trying to crack the password (rockyou.txt, brute force, reversing DeepSound encryption algorithm: SHA256(UTF16LE(password)) → AES-CBC → SHA1 verification)
  • The duck.jpg image itself says "just decoys this way", confirming the encrypted block is a false trail
  • WAV spectrogram analysis showed nothing
  • LSB analysis of duck.jpg pixels revealed no hidden data
  • Steghide extraction from duck.jpg didn't work (different tool, not OutGuess) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍