Новогоднее поздравление (New Year Greeting)

Platform: hackerlab | Category: Steganography | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2025-12-22 | Status: Solved Techniques: font_based_steganography, rtf_font_switching

Summary

Task: RTF document with New Year greeting. Solution: Font-based steganography - hidden message encoded through font switching between Calibri and Cambria, extracted by finding characters using f1/f3 fonts.

Новогоднее поздравление — hackerlab

Description

Друзья, мы рады поздравить Вас с наступившим Новым Годом! Откройте записку, чтобы прочитать всё поздравление.

(Friends, we are happy to congratulate you on the New Year! Open the note to read the full greeting.)

Analysis

Step 1: Extracting Files

The task provides a ZIP archive with an RTF file "Что ж, с наступившим.rtf" (New Year greeting).

 python read-only • copy allowed Copy
import zipfile

with zipfile.ZipFile('task.zip', 'r') as z:
    z.extractall('.')

Step 2: Analyzing RTF Content

The RTF file contains a greeting message in Russian and English. At the end of the document there is an important hint: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

P.S. Do not forget that sometimes the most interesting finds are hidden on the surface.

This hint indicates that the secret is hidden "on the surface" — in the document text itself.

Step 3: Examining RTF Structure

When analyzing the raw RTF file content, multiple fonts are used:

 rtf read-only • copy allowed Copy
{\fonttbl
{\f0\fnil\fcharset0 Calibri;}
{\f1\fnil\fcharset0 Cambria;}
{\f2\fnil\fcharset204 Calibri;}
{\f3\fnil\fcharset0 Cambria;}
}

Key observation:

• The main text uses Calibri font (f0, f2)
• Some characters switch to Cambria (f1, f3) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Technique: Font-based Steganography

The hidden message is encoded through font switching. Characters highlighted with Cambria font (f1, f3) form the secret message.

Extracting Hidden Characters

 python read-only • copy allowed Copy
import re

with open('Что ж, с наступившим.rtf', 'r', encoding='utf-8') as f:
    content = f.read()

# Find all switches to fonts f1 and f3 with following text
pattern = r'\\f[13]\s*([^\\{}]+)'
matches = re.findall(pattern, content)

hidden_message = ''.join(matches)
print(f"Hidden: {hidden_message}")

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Extraction Result

Font switches reveal the following characters:

• \f1: C, o, d, e, b, y
• \f3: {
• \f1: u, fo, u, n, d, i, t, b, r, o (forms "ufounditbro" = "u found it bro")
• \f3: }

Assembling the Flag

Codeby + { + ufounditbro + } = CODEBY{REDACTED}

Additional Notes

Why This Works

RTF format allows switching fonts for individual characters. If visually similar fonts are used (e.g., Calibri and Cambria), switches are invisible during normal document viewing, but easily detected when analyzing raw structure. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Technique Variations

• Using different font sizes
• Using different colors (white on white)
• Using different styles (bold/italic for individual characters)
• Microscopic changes in letter spacing ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍