Kitty

Platform: taipanbyte | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Windows | Author: XESXOR | Date: 2026-02-14 | Status: Solved Techniques: EXIF/metadata analysis, Photoshop metadata inspection, Slices Group Name extraction

Summary

Task: JPEG image of a cat with no obvious steganography. Solution: Flag was hidden in Photoshop metadata field 'Slices Group Name' containing leet-speak value 'funny_st3g4'.

Kitty — TaipanByte CTF

Description

Мяу мяу мяу мяу

Given a single JPEG file 3.jpg — an image of a funny/laughing cat (604x604, ~125KB).

Analysis

1. Initial file inspection:

    bash read-only • copy allowed Copy
   file 3.jpg
   # 3.jpg: JPEG image data, JFIF standard 1.01, resolution (DPI)...

2. Metadata analysis with exiftool:

    bash read-only • copy allowed Copy
   exiftool 3.jpg

   Key findings:

   File Type                       : JPEG
   Image Width                     : 604
   Image Height                    : 604
   Software                        : Adobe Photoshop 24.2 (Windows)
   Create Date                     : 2023:05:29 ...
   Slices Group Name               : funny_st3g4
   

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

1. Critical clue — Slices Group Name field:

   • Value: funny_st3g4
   • This is leet-speak for "funny stega" (steganography)
   • The image was processed in Adobe Photoshop 24.2 (Windows), which automatically creates Photoshop-specific metadata, including slices information

2. Steganographic analysis attempts (rabbit holes):

    bash read-only • copy allowed Copy
   # steghide — requires password, doesn't extract without one
   steghide extract -sf 3.jpg
   
   # stegseek with rockyou — nothing found
   stegseek 3.jpg rockyou.txt
   
   # jsteg — nothing found
   jsteg reveal 3.jpg output.txt
   
   # binwalk — no embedded files
   binwalk 3.jpg
   
   # strings — pattern search
   strings 3.jpg | grep -i flag
   
   # LSB analysis with Python — nothing significant
   # F5 steganography — nothing found

   All steganographic tools yielded no results because the data wasn't hidden in pixel data — the flag was in the metadata. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

The flag was in plain sight in the Photoshop-specific metadata field Slices Group Name:

 bash read-only • copy allowed Copy
exiftool 3.jpg | grep -i "slices"
# Slices Group Name               : funny_st3g4

The value funny_st3g4 is the flag content.

Alternative extraction method:

 bash read-only • copy allowed Copy
# Extract specific field
exiftool -SlicesGroupName 3.jpg
# funny_st3g4

# Or search through all Photoshop fields
exiftool -Photoshop:all 3.jpg

Minimal script:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""Extract flag from Photoshop Slices Group Name."""
import subprocess
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

result = subprocess.run(
    ['exiftool', '-SlicesGroupName', '-s3', '3.jpg'],
    capture_output=True, text=True
)
flag_content = result.stdout.strip()
print(f"flag{{{flag_content}}}")
# flag{REDACTED}

Lessons

Always thoroughly examine ALL metadata fields before diving into complex steganographic techniques. Photoshop adds many specific fields (Slices, ICC Profile, XMP, etc.) that are easy to miss during a quick review. Fields to pay attention to:

Checklist for image stego tasks:

1. file + exiftool (ALL metadata)
2. strings + grep
3. binwalk (embedded files)
4. steghide / stegseek / jsteg (stego containers)
5. LSB analysis (zsteg for PNG, scripts for JPEG)
6. Visual analysis (brightness, contrast, channels) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍