fordata_txt (TXT)

Platform: spbctf | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: tab_space_binary_encoding, whitespace_steganography

Summary

Task: Find hidden info in an RTF file with Lorem ipsum text. Solution: Whitespace steganography - decode trailing tabs and spaces as binary (TAB=1, SPACE=0) to reveal the flag.

fordata_txt (TXT) - Forensics Kids 2.0

Description

"Найдите скрытую инфу" (Find hidden info)

Given an RTF file TXT.rtf (2635 bytes) with Lorem ipsum text.

Analysis

1. Opened the RTF file and saw standard Lorem ipsum text
2. At the end of the document, after the last paragraph, found a suspicious sequence of spaces and tabs before the closing brace }
3. Line 13 contains 231 characters of tabs (0x09) and spaces (0x20)

Solution

Whitespace steganography - a classic technique for hiding data in invisible characters. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Decoding algorithm:

• TAB (0x09) = bit 1
• SPACE (0x20) = bit 0

Data extraction:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
# Whitespace steganography decoder for RTF

with open('TXT.rtf', 'rb') as f:
    content = f.read()

# Find whitespace sequence before closing brace
# Extract tabs and spaces from the end of the document
whitespace = b''
for i in range(len(content) - 2, -1, -1):  # Skip final }
    if content[i] in (0x09, 0x20):  # TAB or SPACE
        whitespace = bytes([content[i]]) + whitespace
    elif content[i] == ord('.'):  # End of text "tincidunt."
        break
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

print(f"Extracted {len(whitespace)} whitespace characters")

# Convert to binary: TAB=1, SPACE=0
binary = ''
for b in whitespace:
    if b == 0x09:  # TAB
        binary += '1'
    elif b == 0x20:  # SPACE
        binary += '0'

print(f"Binary length: {len(binary)} bits")

# ASCII printable chars start with 0 in MSB, add leading 0
binary = '0' + binary
print(f"After adding leading 0: {len(binary)} bits = {len(binary)//8} bytes")

# Decode as 8-bit ASCII
flag = ''
for i in range(0, len(binary), 8):
    byte = binary[i:i+8]
    if len(byte) == 8:
        flag += chr(int(byte, 2))
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

print(f"Flag: {flag}")

Result:

• 231 whitespace characters
• Added leading 0 bit (ASCII printable characters start with 0)
• 232 bits = 29 bytes
• Decoded: spbctf{REDACTED} ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍