Standoff 12 Team Photo

Platform: hackerlab | Category: Steganography | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2025-12-22 | Status: Solved Techniques: LSB steganography with 2 bits per channel, Pixel value range analysis, Reverse bit order assembly

Summary

Task: Extract hidden message from PNG image of Standoff 12 winning team. Solution: Analyzed pixel values (range 0-3), identified 2-bit LSB steganography, extracted 6 bits per pixel with reverse bit order assembly.

Standoff 12 Team Photo — hackerlab.pro

Description

Попробуйте раскрыть секретное послание, спрятанное на фотографии победившей команды в Standoff 12

Given archive task.zip with image picture.png (1280x720 PNG).

Analysis

Initial Analysis

 bash read-only • copy allowed Copy
file picture.png
# PNG image data, 1280 x 720, 8-bit/color RGB, non-interlaced

exiftool picture.png
# Standard metadata, nothing suspicious

strings picture.png | grep -i flag
# Nothing found

Pixel Analysis

When analyzing pixel values, discovered they are concentrated in range 0-3: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 python read-only • copy allowed Copy
from PIL import Image
import numpy as np

img = Image.open('picture.png')
pixels = np.array(img)

# Check value distribution
print(f"Min: {pixels.min()}, Max: {pixels.max()}")
# Min: 0, Max: 3

# All values in range 0-3 = 2 bits per channel!

Key observation: Pixel values 0-3 mean only 2 least significant bits of each color channel are used. This is a characteristic sign of LSB steganography with 2 bits per channel.

Encoding Scheme

• Bits per pixel: 6 (2 bits from each RGB channel)
• Extraction order: R[0], R[1], G[0], G[1], B[0], B[1] (LSB first in each channel)
• Byte assembly: Reverse bit order (LSB to MSB) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Extraction Script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from PIL import Image
import numpy as np

img = Image.open('picture.png')
pixels = np.array(img)

bits = []
for y in range(pixels.shape[0]):
    for x in range(pixels.shape[1]):
        r, g, b = pixels[y, x]
        # Extract 2 LSB bits from each channel
        bits.append(r & 1)        # R bit 0
        bits.append((r >> 1) & 1) # R bit 1
        bits.append(g & 1)        # G bit 0
        bits.append((g >> 1) & 1) # G bit 1
        bits.append(b & 1)        # B bit 0
        bits.append((b >> 1) & 1) # B bit 1
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Convert to bytes with reverse bit order
chars = []
for i in range(0, len(bits), 8):
    byte = 0
    for j in range(8):
        if i + j < len(bits):
            byte = byte | (bits[i + j] << j)  # LSB to MSB
    if byte != 0:
        chars.append(chr(byte))

result = ''.join(chars)
print(result[:100])  # First 100 characters

Result

stegv3CODEBY{REDACTED}

Data structure:

• stegv3 — steganography tool marker
• CODEBY{REDACTED} — flag

Theory: LSB Steganography

Standard LSB (1 bit)

• Uses only the least significant bit of each channel
• 3 bits per pixel (RGB)
• Minimal image distortion ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Extended LSB (2+ bits)

• Uses multiple least significant bits
• 6 bits per pixel with 2-bit LSB
• Higher capacity but more noticeable distortion
• Detected by pixel value distribution

Bit Order

• MSB first: Standard order (most significant bit first)
• LSB first: Reverse order (least significant bit first) — as in this task

Alternative Tools

 bash read-only • copy allowed Copy
# zsteg — automatic LSB analysis
zsteg picture.png

# stegsolve — visual bit plane analysis
java -jar stegsolve.jar

# steghide — for JPEG (doesn't work with PNG)
steghide extract -sf image.jpg

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Related Techniques

• LSB in audio — similar technique for WAV files
• Bit plane analysis — visualization of individual bit planes
• Chi-square attack — statistical detection of LSB steganography ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍