Locate and Neutralise

Platform: hackerlab | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-21 | Status: Solved Techniques: Base64 decoding, EXIF metadata analysis for password discovery, Steghide extraction from JPEG

Summary

Task: JPEG image with steganography. Solution: Extract password from EXIF metadata (Creator field), use steghide to extract hidden base64-encoded flag.

Locate and Neutralise — hackerlab.pro

Description

"Ты постоянно всё усложняешь, чел" (You're always overcomplicating things, dude)

File: locate_and_neutralise.zip contains image.jpg — a "Where are you?" meme

Analysis

1. Metadata Investigation

The task description is the key hint: "don't overcomplicate". This suggests the solution is simple and obvious.

 bash read-only • copy allowed Copy
exiftool image.jpg

Result:

...
Creator                         : readoutarap
...

The Creator field contains a suspicious string readoutarap — this is the password for steghide! ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

2. Extracting Hidden Data

 bash read-only • copy allowed Copy
# Option 1: steghide with known password
steghide extract -sf image.jpg -p readoutarap

# Option 2: stegseek (automatic bruteforce)
stegseek image.jpg

The extracted file contains a base64 string:

Q09ERUJZe2MwbmdyNHR1bDR0MTBucyFfeTB1X2YwdW5kX20zfQ==

3. Decoding the Flag

 bash read-only • copy allowed Copy
echo "Q09ERUJZe2MwbmdyNHR1bDR0MTBucyFfeTB1X2YwdW5kX20zfQ==" | base64 -d

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Full solution

# 1. Unzip the archive
unzip locate_and_neutralise.zip
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# 2. Extract password from metadata
PASSWORD=$(exiftool -Creator -s3 image.jpg)
echo "Password: $PASSWORD"

# 3. Extract hidden data
steghide extract -sf image.jpg -p "$PASSWORD" -xf hidden.txt

# 4. Decode base64
cat hidden.txt | base64 -d

Notes

• Steghide only works with JPEG and BMP formats
• stegseek — fast bruteforcer for steghide, can find password from wordlist
• Always check metadata FIRST — often hints are hidden there
• Task name "Locate and Neutralise" hints at searching for something hidden ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍