EX-BOOST

Platform: Broncoctf2026 | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-07-12 | Status: Solved Techniques: bit_plane_extraction, rgb_channel_separation

Summary

Task: Three Lost Judgment PNG screenshots hint at RGB channels and varying heat bars, with no useful metadata or appended data. Solution: Inspect the matching RGB bit planes, read three text masks, and concatenate them without spaces.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: broncoctf2026 | ID: 20260712_broncoctf2026_ex_boost
• Tags: png, image_forensics, rgb, bit_planes
• Indicators: RGB trifecta, different heat bar amounts, multiple parts, no spaces
• Source: 20260712_broncoctf2026_ex_boost.md

Foothold

Vulnerability / Misconfiguration

1. bit_plane_extraction
2. rgb_channel_separation

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• bit_plane_extraction
• rgb_channel_separation
• Tags: png, image_forensics, rgb, bit_planes

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Lost Judgment has been one of my favorite visuals in the Yakuza Series, especially the styles and their colors. As much as Fully Baked loves Boxer, I much prefer the RGB trifecta. But what's with the heat bar amount on each style? Are they trying to tell me something? format: bronco{}, if you find multiple parts, no spaces.

The provided files are Tiger.png, Snake.png, and Crane.png. The goal is to recover the data hidden in the screenshots and place the combined result inside bronco{...}.

Analysis

The description gives three complementary clues:

• “RGB trifecta” associates the three styles with the matching color channels: Tiger with red, Snake with green, and Crane with blue.
• The differing heat levels suggest looking below the ordinary rendered image at individual binary intensity levels—that is, channel bit planes.
• “Multiple parts, no spaces” indicates that each image contains one fragment and that the three fragments must be concatenated.

The principal false assumption was to treat the visible gauge amounts as numbers and then convert those numbers into RGB values, color names, or characters. That produced many plausible-looking but incorrect results. The simplifying pivot was to inspect each channel's eight bit planes directly.

No metadata, unusual PNG chunks, alpha-channel payload, or trailing file data is required. The deliberate payload appears as clean text masks in these planes:

Solution

The following Pillow script extracts only the three relevant planes. For every pixel, it tests the selected channel bit and maps zero/one to black/white, producing an easily readable monochrome mask.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from pathlib import Path

from PIL import Image

TARGETS = [
    ("Tiger.png", "R", 0),
    ("Snake.png", "G", 2),
    ("Crane.png", "B", 4),
]

root = Path(__file__).resolve().parent

for filename, channel, bit in TARGETS:
    image = Image.open(root / filename).convert("RGB")
    values = image.getchannel(channel)
    mask = values.point(lambda value, b=bit: 255 if value & (1 << b) else 0)

    output = root / f"{Path(filename).stem}_{channel}_bit{bit}.png"
    mask.save(output)
    print(output)

Run the script in the directory containing the three challenge images and inspect the generated PNGs. They show, in RGB order:

 text read-only • copy allowed Copy
F33L
TH3
H34T

Concatenating the fragments without spaces gives F33LTH3H34T, a leetspeak rendering of “FEEL THE HEAT.” The final submission is therefore:

</details>

---

signed by XESXOR