Indian WAV

Platform: taipanbyte | Category: Steganography | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-02-14 | Status: Solved Techniques: audio_lsb_extraction, raw_byte_lsb

Summary

Given a file wav.tb. Need to find the hidden flag inside.

Indian WAV — TaipanByte CTF

Description

Given a file wav.tb. Need to find the hidden flag inside.

Files: wav.tb (RIFF WAV, 24-bit PCM, Stereo, 44100 Hz, ~7.43 sec)

Analysis

Initial File Analysis

$ file wav.tb
wav.tb: RIFF (little-endian) data, WAVE audio, Microsoft PCM, 24 bit, stereo 44100 Hz

$ exiftool wav.tb
File Type: WAV
MIME Type: audio/x-wav
Encoding: Microsoft PCM
Num Channels: 2
Sample Rate: 44100
Bits Per Sample: 24
Duration: 7.43 s

The file contains audio with music and a voice speaking in Hindi/Hinglish with a strong Indian accent. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Rabbit Holes (Red Herrings)

1. Speech Recognition (main distraction)

Significant time was spent trying to decipher the speech. Attempted:

• OpenAI Whisper (all model sizes: tiny, base, small, medium, large) with Hindi and English settings
• Google Speech Recognition with locales en-IN, en-US, hi-IN
• Audio preprocessing: slowing down, filtering (highpass/lowpass), channel separation

The actual YouTube channel is TechChip (Hindi cybersecurity channel). But this was a red herring — the speech content is not needed for the solution.

2. Spectrogram and Other Methods

• Generated multiple spectrograms (high resolution, per channel, bandpass, B&W, inverted)
• Found a constant tone at 11 kHz — but no hidden text/patterns
• Checked AM/FM modulation of the tone — nothing
• File structure analysis — only standard fmt and data chunks, no extra bytes
• DTMF detection — false positives from speech/music
• Rendering raw data as images — only noise
• Channel difference — no hidden data ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

LSB Steganography in Raw Audio Bytes

Classic LSB (Least Significant Bit) extraction from raw bytes of audio data (not from samples, but from each byte of 24-bit PCM data).

Key Difference: Byte-level LSB vs Sample-level LSB

In 24-bit WAV, each sample occupies 3 bytes. LSB is extracted from each byte of raw data, not from each sample. This provides 3 times more bits for hiding data.

Solution Code

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
WAV LSB Steganography Extractor
Extracts hidden data from least significant bits of raw audio bytes
"""
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

import wave

def extract_wav_lsb(filepath):
    """Extract LSB from each raw byte of WAV audio data"""
    
    with wave.open(filepath, "rb") as w:
        raw = w.readframes(w.getnframes())
    
    # Extract LSB from each byte of raw audio data
    lsb_bits = []
    for i in range(len(raw)):
        lsb_bits.append(raw[i] & 1)
    
    # Assemble bits into bytes (MSB first)
    lsb_bytes = bytearray()
    for i in range(0, len(lsb_bits) - 7, 8):
        byte = 0
        for j in range(8):
            byte = (byte << 1) | lsb_bits[i + j]
        lsb_bytes.append(byte)
    
    return lsb_bytes
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

if __name__ == "__main__":
    data = extract_wav_lsb("wav.tb")
    # Print first 100 bytes to find the flag
    print(data[:100])
    
    # Search for flag pattern
    text = data.decode('latin-1')
    import re
    flags = re.findall(r'TB\{[^}]+\}', text)
    if flags:
        print(f"Flag: {flags[0]}")

Execution

 bash read-only • copy allowed Copy
$ python3 solve.py
bytearray(b'TB{REDACTED}####...')
Flag: TB{REDACTED}

The flag is at the very beginning of the extracted data, followed by # characters as padding. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Lessons Learned

1. Don't get distracted by red herrings — the speech with Indian accent was a deliberate distraction that consumed significant time
2. Always try basic LSB early — this is one of the most common audio steganography techniques
3. For WAV: byte-level LSB, not sample-level — in 24-bit PCM, extracting LSB from each raw byte (not from each 3-byte sample) is the standard approach
4. The flag name "REDACTED" is a hint that data is hidden in the wave data of the file

Audio Steganography Checklist

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

1. [ ] file / exiftool — identify format
2. [ ] strings — search for text in file
3. [ ] binwalk — embedded files
4. [ ] LSB extraction (raw bytes) — ← SOLUTION HERE
5. [ ] Spectrogram (sox spectrogram)
6. [ ] Channel separation, channel difference
7. [ ] DTMF / morse / SSTV
8. [ ] Steganography utilities (steghide, stegolsb)

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍