An Italian Penguin

Platform: Metactf | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Linux | Author: D3v0o0Nu11 | Date: 2026-04-10 | Status: Solved Techniques: false_positive_elimination, hint_interpretation, passphrase_derivation, steghide_payload_extraction

Summary

Task: a JPEG penguin image appeared to be a stego challenge, but normal metadata checks and outguess-style probing were misleading. Solution: interpret the Linux-themed hint as the GNU/Linux copypasta meme, use GNU/Linux as the passphrase, and extract the embedded payload with stegseek.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: metactf | ID: 20260410_metactf_an_italian_penguin
• Tags: steghide, jpeg, stegseek, dawgctf, passphrase_stego, hint_based_recon, linux_meme
• Indicators: JPEG image with no useful EXIF or appended data, stegdetect reports outguess on both challenge and clean reference images, organizer hint combines Linux + copy + pasta, successful extraction depends on deriving a themed passphrase rather than brute forcing common wordlists
• Source: 20260410_metactf_an_italian_penguin.md

Foothold

Vulnerability / Misconfiguration

1. false_positive_elimination
2. hint_interpretation
3. passphrase_derivation
4. steghide_payload_extraction

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• false_positive_elimination
• hint_interpretation
• passphrase_derivation
• steghide_payload_extraction
• Tags: steghide, jpeg, stegseek, dawgctf, passphrase_stego, hint_based_recon, linux_meme

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Original organizer description was not preserved locally.

Available hint: Hint 1: Search up Linux (To make a duplicate + Spaghetti is a type of what?)

English summary: the task provides a JPEG image named Penguin_Steg.jpg. The goal is to identify the correct stego path, derive the passphrase from the hint, extract the hidden payload, and recover the flag.

Analysis

The image was first treated as a standard JPEG stego target. Basic recon and extraction attempts did not immediately help:

• EXIF, strings, and appended-data checks were clean.
• stegdetect reported outguess(old)(***), but this turned out to be a false positive.
• Clean reference images from the same penguin image family produced the same misleading outguess hit.
• Multiple OutGuess candidate keys only produced garbage and wasted time.

The useful pivot came from identifying the picture itself. Penguin_Steg.jpg matches the well-known ccpenguin image associated with the history of Tux and Linux mascot lore. That made the hint much more meaningful:

• duplicate → copy
• spaghetti is a type of → pasta
• Linux + copy + pasta → Linux copypasta

The most recognizable Linux copypasta is the GNU/Linux meme, so the correct passphrase is:

 text read-only • copy allowed Copy
GNU/Linux

Once that interpretation was tried, extraction succeeded immediately.

Solution

1. Inspect Penguin_Steg.jpg as a normal JPEG stego challenge.
2. Discard metadata/appended-data paths because they are clean.
3. Treat the stegdetect OutGuess result with caution and compare against clean reference images.
4. Recognize the image as the classic ccpenguin / Tux-history penguin image.
5. Parse the hint as copy + pasta and connect it to the Linux GNU/Linux copypasta meme.
6. Use GNU/Linux as the passphrase with stegseek.
7. Verify the extracted payload with file and strings to recover the flag.

Successful extraction:

 bash read-only • copy allowed Copy
docker run --rm -v "$PWD":/data rickdejager/stegseek --extract -sf /data/Penguin_Steg.jpg -p "GNU/Linux" -xf /data/gnu_linux_steg.bin -f -q
file gnu_linux_steg.bin
strings gnu_linux_steg.bin

Verification output contained the ASCII flag:

 text read-only • copy allowed Copy
DawgCTF{REDACTED}

 python read-only • copy allowed Copy
#!/usr/bin/env python3

from pathlib import Path
import subprocess

def main() -> None:
    image = Path("Penguin_Steg.jpg").resolve()
    output = Path("gnu_linux_steg.bin").resolve()

    subprocess.run(
        [
            "docker",
            "run",
            "--rm",
            "-v",
            f"{image.parent}:/data",
            "rickdejager/stegseek",
            "--extract",
            "-sf",
            f"/data/{image.name}",
            "-p",
            "GNU/Linux",
            "-xf",
            f"/data/{output.name}",
            "-f",
            "-q",
        ],
        check=True,
    )

    data = output.read_bytes()
    print("Extracted bytes:", len(data))
    print(data.decode("ascii", errors="ignore"))

if __name__ == "__main__":
    main()

</details>

---

signed by XESXOR