zapzap

Platform: spbctf | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: DOCX file structure analysis (ZIP-based format), Embedded image extraction, EXIF/XMP metadata analysis, Photoshop layer metadata inspection

Summary

Task: DOCX file containing a hidden secret. Solution: Extract DOCX as ZIP archive, analyze embedded images with exiftool, find flag in Photoshop text layer XMP metadata.

zapzap — Forensics Kids 2.0

Description

"This file contains a secret. Let's find it!"

Provided file: zapzap_8f837dhjd.docx (122873 bytes).

Analysis

1. Understanding the DOCX Format

DOCX is an Office Open XML (OOXML) format, which is essentially a ZIP archive containing XML files and media resources inside.

2. Extracting the DOCX

 bash read-only • copy allowed Copy
unzip zapzap.docx -d zapzap_extracted/

Structure:

zapzap_extracted/
├── [Content_Types].xml
├── _rels/
├── docProps/
│   ├── app.xml
│   └── core.xml
└── word/
    ├── document.xml
    ├── media/
    │   ├── image1.jpeg (19KB)
    │   └── image2.jpeg (102KB)
    └── ...

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Content Analysis

• document.xml — contains only Lorem ipsum text, no flag
• word/media/ — two embedded images

4. Image Analysis

 bash read-only • copy allowed Copy
exiftool word/media/image1.jpeg
# Standard JPEG, nothing interesting

exiftool word/media/image2.jpeg
# Rich metadata from Adobe Photoshop CC 2018!

5. Flag Discovery

In the metadata of image2.jpeg, Photoshop text layer information was found:

Text Layer Name                 : spbctf{REDACTED}
Text Layer Text                 : spbctf{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The flag was stored in the XMP metadata of the image as a Photoshop text layer name.

Solution

Quick Method

 bash read-only • copy allowed Copy
# Extract DOCX
unzip zapzap.docx -d extracted/

# Search for flag in metadata of all images
exiftool extracted/word/media/* | grep -i "spbctf\|flag\|ctf"

Detailed Analysis

 bash read-only • copy allowed Copy
# Full metadata output of the suspicious image
exiftool -a -u -g1 extracted/word/media/image2.jpeg

Python Automation Script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""Extract flags from image metadata in DOCX files"""
import zipfile
import subprocess
import tempfile
import os
import re
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

def extract_flags_from_docx_images(docx_path):
    """Search for flags in embedded image metadata"""
    
    with zipfile.ZipFile(docx_path, 'r') as zf:
        # Find all images
        image_files = [f for f in zf.namelist() if f.startswith('word/media/')]
        
        for img_name in image_files:
            print(f"[*] Analyzing: {img_name}")
            
            # Extract to temporary file
            with tempfile.NamedTemporaryFile(delete=False, suffix=os.path.splitext(img_name)[1]) as tmp:
                tmp.write(zf.read(img_name))
                tmp_path = tmp.name
            
            try:
                # Run exiftool
                result = subprocess.run(
                    ['exiftool', '-a', tmp_path],
                    capture_output=True, text=True
                )
                
                # Search for flags in output
                flags = re.findall(r'[a-zA-Z0-9_]+\{[^}]+\}', result.stdout)
                if flags:
                    print(f"[+] Found flags in {img_name}:")
                    for flag in set(flags):
                        print(f"    {flag}")
                
                # Check suspicious fields
                if 'Photoshop' in result.stdout or 'Text Layer' in result.stdout:
                    print(f"[!] Photoshop metadata detected in {img_name}")
                    
            finally:
                os.unlink(tmp_path)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

if __name__ == "__main__":
    import sys
    docx_file = sys.argv[1] if len(sys.argv) > 1 else "zapzap.docx"
    extract_flags_from_docx_images(docx_file)

Data Hiding Locations in DOCX Images

EXIF/XMP Metadata:

1. Text Layer Name/Text — names and content of Photoshop text layers
2. Comment — image comments
3. Author/Artist — author information
4. Description/Title — image description
5. Keywords/Tags — keywords
6. Custom XMP fields — arbitrary metadata fields

Other Techniques:

• LSB steganography in pixels
• Hidden data after JPEG EOF marker
• Alternative color channels
• Thumbnail with different content ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis Tools

1. exiftool — universal metadata analysis
2. exiv2 — alternative EXIF tool
3. identify -verbose (ImageMagick) — detailed image information
4. strings — search for text strings in binary file
5. binwalk — embedded file analysis

Related Techniques

• DOCX as ZIP archive
• Steganography in image metadata
• Photoshop layer metadata extraction
• XMP metadata analysis ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍