SomeText

Platform: taipanbyte | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-02-21 | Status: Solved Techniques: file_carving, iend_chunk_analysis, png_trailer_extraction

Summary

Given a PNG file template-3.png. The goal is to find a hidden flag inside the image.

SomeText — TaipanByte

Description

Given a PNG file template-3.png. The goal is to find a hidden flag inside the image.

Analysis

1. Initial inspection: The file template-3.png is a valid PNG image (1640×664, 8-bit RGB) displaying the text "some_text" against a night sky background. The file size is 2.0 MB, which is suspiciously large for a simple image of this resolution.

2. Metadata analysis: exiftool template-3.png produced a critical warning:

   Warning: Trailer data after PNG IEND chunk
   

   This means there is additional data after the official end of the PNG file (after the IEND chunk). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Trailer investigation: Using Python, the IEND chunk was found at offset 1,004,016. The data after IEND + 4-byte CRC (from offset 1,004,024) is 1,004,409 bytes — almost as much as the image itself. The first bytes of the trailer: 89 50 4E 47 0D 0A 1A 0A — this is a PNG file signature (\x89PNG\r\n\x1a\n).

Solution

1. Determine the file type and check metadata:

 bash read-only • copy allowed Copy
file template-3.png
# template-3.png: PNG image data, 1640 x 664, 8-bit/color RGB, non-interlaced

exiftool template-3.png
# Warning: Trailer data after PNG IEND chunk

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. Find the IEND chunk and extract everything after it:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
data = open('template-3.png', 'rb').read()
iend_pos = data.find(b'IEND')
trailer_start = iend_pos + 4 + 4  # skip IEND type (4 bytes) + CRC (4 bytes)
trailer = data[trailer_start:]
open('hidden.png', 'wb').write(trailer)
print(f'Extracted hidden.png: {len(trailer)} bytes')

1. Verify the extracted file:

 bash read-only • copy allowed Copy
file hidden.png
# hidden.png: PNG image data, 1640 x 664, 8-bit/color RGB, non-interlaced

1. Open hidden.png — the image shows the text "great!" and the flag flag{REDACTED}. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍