Snowy Day (Снежный день)

Platform: duckerz | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: snow_steganography, whitespace_analysis

Summary

Task: Text file with a poem about snow containing hidden data. Solution: Used SNOW tool to extract flag from trailing whitespace (tabs and spaces) steganography.

Snowy Day (Снежный день) — duckerz CTF

Description

"Очень люблю снег! Снеговики, снежные замки, снежки! СНЕГ! СНЕГ! СНЕГ!"

File: snowy_day.txt — a text file with a poem about snow in Russian.

Analysis

Step 1: Recognizing the Hint

The task name "Snowy Day" and the repeated "SNOW" in the description are a clear hint at SNOW (Steganographic Nature Of Whitespace) — a classic whitespace steganography technique.

Step 2: Examining the File

 bash read-only • copy allowed Copy
# View hex dump to find hidden data
xxd snowy_day.txt | head -20

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis revealed trailing whitespace characters at the end of lines:

• 0x20 — spaces
• 0x09 — tabs

Statistics: 328 whitespace characters (59 tabs + 269 spaces)

Step 3: Identifying the Technique

SNOW hides data in invisible spaces and tabs at the end of lines in text files. This is ideal steganography for text documents — the file looks completely normal visually.

Solution

Installing the SNOW Tool

 bash read-only • copy allowed Copy
# Clone the repository
git clone https://github.com/mattkwan/snow
cd snow
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Fix compilation error (add #include <string.h> to main.c)
# Compile
make

Extracting the Hidden Message

 bash read-only • copy allowed Copy
./snow -C snowy_day.txt

Output:

DUCKERZ{REDACTED}

Alternative Methods

Manual Analysis (Without Tool)

 bash read-only • copy allowed Copy
# Count trailing whitespace
cat snowy_day.txt | while read line; do
    echo "$line" | sed 's/[^ \t]*//g' | xxd
done

# Visualize whitespace characters
cat -A snowy_day.txt  # shows $ at end of lines, ^I for tabs

Python Decoder (Basic)

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
SNOW uses ICE encryption by default.
For full compatibility, it's better to use the original tool.
"""
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

with open('snowy_day.txt', 'r') as f:
    lines = f.readlines()

# Extract trailing whitespace
binary = ''
for line in lines:
    # Find trailing whitespace
    stripped = line.rstrip('\n\r')
    content = stripped.rstrip(' \t')
    whitespace = stripped[len(content):]
    
    # Tab = 1, Space = 0 (simplified scheme)
    for char in whitespace:
        if char == '\t':
            binary += '1'
        elif char == ' ':
            binary += '0'

print(f"Binary: {binary[:64]}...")
print(f"Total bits: {len(binary)}")

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Theory: How SNOW Works

Original text:      "Hello World"
After SNOW:         "Hello World   \t  \t\t "
                              ^^^^^^^^^^^^
                              Hidden data

SNOW encodes data bits in combinations of spaces and tabs:

• Uses ICE encryption (optionally with password)
• Data is compressed before encoding
• Text appears unchanged visually

Useful Commands

 bash read-only • copy allowed Copy
# Check for trailing whitespace
grep -P '[ \t]+$' file.txt

# Count whitespace characters
cat file.txt | tr -cd ' \t' | wc -c
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Hex analysis of line endings
xxd file.txt | grep -E '20 20|09 20|20 09|09 09'

References

• SNOW Tool
• Whitespace Steganography
• ICE Cipher

---

Solve time: ~10 minutes
Difficulty: Easy — only requires recognizing the technique from the hint ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍