Triplets

Platform: Tjctf | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-05-16 | Status: Solved Techniques: exif_metadata_inspection, numpy_reshape, rgb_channel_flattening_reversal

Summary

Task: grayscale PNG where RGB triplets were flattened into single grayscale pixels, with original dimensions hidden in EXIF Comment. Solution: read EXIF for original size, reshape flat grayscale data back into (H, W, 3) RGB array using NumPy.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: tjctf | ID: 20260516_tjctf_triplets
• Tags: png, numpy, image_reconstruction, rgb, grayscale, pixel_flatten, exif_comment
• Indicators: grayscale PNG with dimensions that are a perfect square, EXIF Comment containing original image dimensions, challenge name hints at 3-channel (RGB) triplets, image size equals widthheight3 of original dimensions
• Source: 20260516_tjctf_triplets.md

Foothold

Vulnerability / Misconfiguration

1. exif_metadata_inspection
2. numpy_reshape
3. rgb_channel_flattening_reversal

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• exif_metadata_inspection
• numpy_reshape
• rgb_channel_flattening_reversal
• Tags: png, numpy, image_reconstruction, rgb, grayscale, pixel_flatten, exif_comment

Original Writeup

<details><summary>Click to expand original content</summary>

Description

I was messing around with my image and it got really messed up... I see patterns...

Given: chall.png — a 1888×1888 8-bit grayscale PNG (~2.5 MB). The goal is to recover the original image and find the flag.

Analysis

Initial Reconnaissance

Running exiftool on the image reveals key metadata:

Image Width  : 1888
Image Height : 1888
Color Type   : Grayscale
Bit Depth    : 8
Comment      : 2000x594

The image is grayscale (mode 'L'), but the EXIF Comment field contains 2000x594 — the original image dimensions. This is the first critical clue.

Understanding the Encoding

The challenge name "triplets" hints at groups of three — specifically RGB color channels. Each pixel in the original RGB image has 3 values (R, G, B). The encoding process was:

1. Start with a 2000×594 RGB image → 2000 × 594 × 3 = 3,564,000 individual channel values
2. Flatten all RGB triplets into a single sequence of grayscale values
3. Reshape into a square-ish grayscale image: 1888² = 3,564,544 pixels (with 544 pixels of zero-padding at the end)

The description "it got really messed up" and "I see patterns" confirms the image was transformed — the patterns are the interleaved R, G, B values appearing as grayscale stripes.

Solution

The reversal is straightforward:

1. Read all 1888×1888 grayscale pixel values as a flat array
2. Take the first 2000 × 594 × 3 = 3,564,000 values
3. Reshape as a (594, 2000, 3) NumPy array (height, width, channels)
4. Save as an RGB PNG

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from PIL import Image
import numpy as np

# Load the grayscale challenge image
img = Image.open('chall.png')
data = np.array(img).flatten()

# Original dimensions from EXIF Comment: 2000x594
W, H = 2000, 594

# Take first W*H*3 values and reshape as RGB
rgb_data = data[:W * H * 3].reshape((H, W, 3)).astype(np.uint8)
result = Image.fromarray(rgb_data, 'RGB')
result.save('restored_rgb.png')

The restored image shows Thomas Jefferson High School for Science and Technology with the flag written in the upper-left corner.

</details>

---

signed by XESXOR