Музыкальная картина (Musical Picture)

Platform: duckerz | Category: Steganography | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-02-09 | Status: Solved Techniques: empty_passphrase_steghide, spectrogram_text, steghide_extraction, stegseek_cracking

Summary

Task: 42 MB JPEG file with hints about music and forum. Solution: Multi-stage steganography - extract MP3 from JPEG using steghide with empty password, then read flag from audio spectrogram.

Музыкальная картина (Musical Picture) — duckerz CTF

Description

"Я очень люблю музыку и поэтому я искал на форуме классную картинку. Нашел эту. Вам же тоже она понравилась?"

File: Dora.jpg (JPEG image data, 19000×12274, baseline, precision 8, 4:4:4 subsampling, 42 MB)

Image: a girl with pink hair in a Sailor Moon hoodie.

300 points, 89 teams solved.

Analysis

Standard recon — nothing

• file — JPEG image, 19000×12274, baseline, 4:4:4 subsampling
• exiftool — no EXIF metadata, no comments
• binwalk — nothing found
• strings | grep DUCKERZ — no flag
• Checking data after FFD9 — no extra data after JPEG end marker
• jsteg reveal — no hidden data in DCT LSB ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Red flags

1. 42 MB for a JPEG — suspiciously large size. Even at 19000×12274 with 4:4:4 subsampling this is too much. Indicates hidden data inside.

2. Title "Musical Picture" — an oxymoron. Picture (image) + music (audio) = hint at multi-stage steganography.

3. "Searched on a forum" — steghide is one of the most popular tools on forums for hiding data in JPEG.

4. "Dora.jpg" — filename = name of Russian singer Dora (Doradura).

Steghide extraction

Standard tools found nothing → try steghide. For password cracking we use stegseek (fast bruteforcer for steghide): ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
# Run stegseek via Docker
docker run --rm -v $(pwd):/data rickdejager/stegseek /data/Dora.jpg

# Result: password is EMPTY ("")
# Extracted file: test.mp3

Stegseek instantly found that the passphrase is empty. Extracted file — test.mp3, a 22-second audio clip.

MP3 Analysis

The audio contains a fragment of the song "Doradura" by Russian singer Dora — this explains:

• The filename "Dora.jpg"
• The hint about "music" in the description
• The hint about "forum" (steghide is popular on forums) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Spectrogram analysis

The task title "Musical Picture" hints: there's a picture in the audio. Classic technique — text/image in spectrogram.

 bash read-only • copy allowed Copy
# Generate spectrogram
sox test.mp3 -n spectrogram -x 1500 -y 500 -z 80 -o spectrogram.png

In the last ~5 seconds of audio (from ~17 seconds) the flag text is clearly visible on the spectrogram, encoded in the frequency spectrum.

Vulnerability

Multi-stage steganography: JPEG → steghide → MP3 → spectrogram.

A chain of three hiding levels:

1. Steghide with empty password hides MP3 inside JPEG
2. Spectrogram steganography — flag text is encoded in the audio frequency spectrum ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Solution for "Musical Picture" — duckerz CTF
# Multi-stage steganography: JPEG → steghide → MP3 → spectrogram

# Step 1: Extract hidden file from JPEG via steghide
# Password is empty — stegseek finds it instantly
docker run --rm -v $(pwd):/data rickdejager/stegseek /data/Dora.jpg
# Or directly with steghide using empty password:
steghide extract -sf Dora.jpg -p "" -f
# → Extracted test.mp3

# Step 2: Generate spectrogram from MP3
sox test.mp3 -n spectrogram -x 1500 -y 500 -z 80 -o spectrogram.png
# → Flag is visible as text in spectrogram (last 5 seconds)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 3: Read the flag from spectrogram
# DUCKERZ{REDACTED}

Alternative tools for spectrogram

 bash read-only • copy allowed Copy
# Audacity: File → Import → Audio → test.mp3
# Switch track view to "Spectrogram" → visually read the flag

# Sonic Visualiser: similarly, Layer → Add Spectrogram

# Python + matplotlib:
python3 -c "
import librosa, librosa.display, matplotlib.pyplot as plt
y, sr = librosa.load('test.mp3')
S = librosa.feature.melspectrogram(y=y, sr=sr, n_mels=256, fmax=sr/2)
plt.figure(figsize=(15, 5))
librosa.display.specshow(librosa.power_to_db(S, ref=1.0), sr=sr, fmax=sr/2)
plt.savefig('spectrogram_librosa.png', dpi=150)
"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Related Techniques

• Steghide in JPEG — hiding data in DCT coefficients of JPEG (not LSB, so jsteg doesn't find it)
• Spectrogram steganography — text/image in audio frequency spectrum (see also: duckerz/sound_spectrum)
• Multi-stage stego — chain of multiple hiding levels, each level requires its own tool
• Stegseek — fast bruteforcer for steghide, checks ~million passwords/sec
• Empty passphrase — common trick in CTF, always check first ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍