Hidden Writings of the Wizard

Platform: hackerlab | Category: Steganography | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-05 | Status: Solved Techniques: base64_decoding, metadata_extraction, rot13_decoding, steghide_extraction, vigenere_transformation

Summary

Task: a chain of JPEG files hides the next step in metadata comments, then finishes with a steghide-protected image containing a Vigenère-obfuscated flag-like string. Solution: decode Base64 and ROT13 from EXIF comments, extract secret.txt from the final JPEG with an empty passphrase, and apply the key KNOWLEDGE to recover the final flag.

Hidden Writings of the Wizard — Hackerlab

Description

Волшебник Даркмур, известный своей магической силой и таинственными ритуалами, прислал тебе загадочное письмо. В нем содержится важная информация о скрытых знаниях и магических тайнах, которые он хочет передать тебе лично. Но чтобы получить доступ к этим знаниям, необходимо выполнить определенные задания, которые заставят тебя пройти через множество испытаний и опасностей. Только тогда Даркмур раскроет тебе все свои секреты и поможет достичь нового уровня владения магией. Но будь осторожен, ведь волшебник Даркмур славится своей коварностью и не всегда можно ему доверят ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

English summary: The archive starts with an image and each stage hides a pointer to the next artifact. The chain uses JPEG metadata, then file-based steganography, and finally a classical cipher to transform the extracted text into the final CODEBY{...} flag.

Analysis

This was a clean multi-stage challenge where every layer explicitly pointed to the next one.

Stage 1: metadata comment in tree.jpeg_original

Running exiftool on the first image revealed a JPEG comment:

 bash read-only • copy allowed Copy
exiftool tree.jpeg_original

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Relevant value:

 text read-only • copy allowed Copy
Comment : aHR0cHM6Ly9pYmIuY28vcnBDcEQyTQoK

The string is valid Base64. Decoding it gives the next URL:

 bash read-only • copy allowed Copy
printf 'aHR0cHM6Ly9pYmIuY28vcnBDcEQyTQoK' | base64 -d

Result:

 text read-only • copy allowed Copy
https://ibb.co/rpCpD2M

That page leads to wizard.jpg.

Stage 2: metadata comment in wizard.jpg

The second image also stores the clue in the JPEG comment:

 bash read-only • copy allowed Copy
exiftool wizard.jpg

Relevant value:

 text read-only • copy allowed Copy
Comment : uggcf://voo.pb/X72Z02g

This time the text is ROT13-encoded. Decoding it reveals the next URL: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 bash read-only • copy allowed Copy
printf 'uggcf://voo.pb/X72Z02g' | tr 'A-Za-z' 'N-ZA-Mn-za-m'

Result:

 text read-only • copy allowed Copy
https://ibb.co/K72M02t

That page leads to secretbook.jpg.

Stage 3: hidden file inside secretbook.jpg

The intended next step is to run steghide with an empty passphrase and extract the embedded file:

 bash read-only • copy allowed Copy
steghide extract -sf secretbook.jpg -p ''

This produces secret.txt containing:

 text read-only • copy allowed Copy
SBPIQU{J4A1Y4B_S4y1pn}

In the local environment, steghide was unavailable, but public mirrors of the challenge confirmed this exact intended extraction result. The solve path above is the canonical one. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Stage 4: Vigenère transformation

The extracted text already looks like a flag, but the letters are shifted. Using the key KNOWLEDGE transforms it into the final flag:

 text read-only • copy allowed Copy
SBPIQU{J4A1Y4B_S4y1pn} -> CODEBY{REDACTED}

For this challenge, the required operation is the same transformation commonly labeled as Vigenère encryption in online tools when applied to the extracted string with key KNOWLEDGE.

Solution

Step 1: Read the first metadata clue

 bash read-only • copy allowed Copy
exiftool tree.jpeg_original
printf 'aHR0cHM6Ly9pYmIuY28vcnBDcEQyTQoK' | base64 -d

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

This reveals https://ibb.co/rpCpD2M, which points to wizard.jpg.

Step 2: Read and decode the second metadata clue

 bash read-only • copy allowed Copy
exiftool wizard.jpg
printf 'uggcf://voo.pb/X72Z02g' | tr 'A-Za-z' 'N-ZA-Mn-za-m'

This reveals https://ibb.co/K72M02t, which points to secretbook.jpg.

Step 3: Extract the embedded text from the final image

 bash read-only • copy allowed Copy
steghide extract -sf secretbook.jpg -p ''
cat secret.txt

Recovered ciphertext:

 text read-only • copy allowed Copy
SBPIQU{J4A1Y4B_S4y1pn}

Step 4: Apply the Vigenère transformation with key KNOWLEDGE

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import string

cipher = "SBPIQU{J4A1Y4B_S4y1pn}"
key = "KNOWLEDGE"
alphabet = string.ascii_uppercase

def vigenere_encrypt(text, key):
    out = []
    j = 0
    for ch in text:
        if ch.isalpha():
            shift = alphabet.index(key[j % len(key)].upper())
            base = ord('A') if ch.isupper() else ord('a')
            out.append(chr((ord(ch) - base + shift) % 26 + base))
            j += 1
        else:
            out.append(ch)
    return ''.join(out)
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

print(vigenere_encrypt(cipher, key))

Output:

 text read-only • copy allowed Copy
CODEBY{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍