← Back to Writeups
CUSTOMMediumSteganography

Skeleton (Скелет времени)

XESXOR9/2/20262 min read
#steganography#custom#medium#frame-timing-analysis#gif-frame-extraction#image-enhancement-(contrast#scaling#inversion)#visual-inspection-of-animation#linux

Skeleton (Скелет времени)

Platform: hackerlab | Category: Steganography | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2025-12-23 | Status: Solved Techniques: Frame timing analysis, GIF frame extraction, Image enhancement (contrast, scaling, inversion), Visual inspection of animation frames

Summary

Task: Animated GIF with 100 frames and a hint about 'skeleton'. Solution: Frame timing analysis revealed frame 52 with delay=0; image enhancement (contrast stretch, inversion) exposed hidden low-contrast text containing the flag in leetspeak.

Skeleton (Скелет времени) — hackerlab.pro

Description

Часы — скелет времени, по которому можно изучать анатомию пространства (Clocks are the skeleton of time by which one can study the anatomy of space)

Files: task.gif (animated GIF, 100 frames, 400x300 pixels)

Analysis

1. Examining the GIF File

Received an animated GIF with 100 frames. The challenge name and description contain the word "skeleton" (скелет) — this is a hint that we need to look for hidden information.

2. Extracting Frames

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

bash
# Extract all frames from GIF
magick task.gif -coalesce frame_%03d.png

# Check the number of frames
ls frame_*.png | wc -l
# 100

3. Frame Timing Analysis

bash
# View frame delay information
magick identify -verbose task.gif | grep -i delay

Discovered that frame 52 has an unusual delay delay=0, while all other frames have delay=4. This is a clear indicator that this frame contains something special.

4. Visual Analysis of Frame 52

Upon careful inspection of frame_052.png, a barely visible inscription can be seen in the upper right corner — light text on a light background, practically invisible without processing. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Image Processing to Reveal Hidden Text

bash
# Crop the area with text (upper right corner)
magick frame_052.png -crop 200x15+200+0 cropped.png

# Apply processing to improve visibility:
# - Convert to grayscale
# - Stretch contrast
# - Scale 1500-2000%
# - Invert colors
magick cropped.png \
    -colorspace Gray \
    -contrast-stretch 0 \
    -resize 2000% \
    -negate \
    enhanced.png

Alternative Method (single command)

bash
magick frame_052.png \
    -crop 200x15+200+0 \
    -colorspace Gray \
    -auto-level \
    -resize 1500% \
    -negate \
    result.png

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

After processing, the text becomes readable:

CODEBY{REDACTED}

Decoding Leetspeak

The flag is written in leetspeak format:

  • 4 = A
  • 3 = E
  • 7 = T
  • 0 = O
  • 1 = I

Decoded: "A SECRET IN THE SKELETON WAS FOUND" — which corresponds to the hint in the challenge description about the "skeleton".

Useful ImageMagick Commands

bash
# Extract frames from GIF
magick input.gif -coalesce frame_%03d.png

# GIF information (including timings)
magick identify -verbose input.gif

# Enhance contrast to reveal hidden text
magick input.png -colorspace Gray -auto-level -negate output.png
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Scale for better readability
magick input.png -resize 2000% output.png

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍