Artemis Gordon

Platform: Metactf | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-04-10 | Status: Solved Techniques: alphabet_identification, symbol_substitution, visual_pattern_matching

Summary

Task: a PNG image containing moon-phase style symbols with no hidden metadata or embedded payloads. Solution: treat it as a visual symbol cipher, identify Leandro Katz's Lunar Alphabet, and decode the repeated glyph pattern as MOONMAN.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: metactf | ID: 20260410_metactf_artemis_gordon
• Tags: png, visual_steganography, symbol_cipher, lunar_alphabet, image_recon
• Indicators: PNG file with no useful metadata or extra chunks, small set of repeated moon-phase glyphs, repeating symbol positions suggest repeated letters, moon imagery points to a lunar-themed alphabet
• Source: 20260410_metactf_artemis_gordon.md

Foothold

Vulnerability / Misconfiguration

1. Alphabet_identification
2. Symbol_substitution
3. Visual_pattern_matching

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• alphabet_identification
• symbol_substitution
• visual_pattern_matching
• Tags: png, visual_steganography, symbol_cipher, lunar_alphabet, image_recon

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Original organizer description was not preserved locally; only the challenge image moonieface.png was available in the task directory.

The task provides a PNG image containing seven moon-phase style glyphs. The goal is to determine what alphabet those symbols belong to and decode the hidden word used inside the flag.

Analysis

Reconnaissance

The first step was standard file-level recon:

file moonieface.png
strings moonieface.png
exiftool moonieface.png
pngcheck moonieface.png

This established that the file was an ordinary PNG. Metadata was not useful beyond a gnome-screenshot style tag, and pngcheck did not show suspicious chunk anomalies or embedded files. That ruled out the usual metadata / appended-data stego path.

At that point the image had to be solved visually. The important observation was that it contained seven distinct moon-phase style glyphs.

Identifying the alphabet

Because the symbols looked like stylized lunar phases, the next step was to search for moon-based alphabets rather than generic astronomical symbols. That led to Leandro Katz's Lunar Alphabet, whose glyph shapes matched the symbols in the image.

Decoding logic

The seven glyphs were not all unique. Their repetition pattern was:

• positions 1 and 5 are the same
• positions 2 and 3 are the same
• positions 4 and 7 are the same

So the plaintext had the structure:

M O O N M A N

Once the symbols were matched against the Lunar Alphabet chart, the word decoded cleanly as:

MOONMAN

Solution

1. Inspect the PNG with file, strings, exiftool, and pngcheck.
2. Confirm there is no hidden payload in metadata or PNG chunks.
3. Focus on the visible content: seven moon-phase glyphs.
4. Search for a lunar-themed symbolic alphabet.
5. Match the glyphs to Leandro Katz's Lunar Alphabet.
6. Use the repeated-symbol structure to validate the reading as MOONMAN.
7. Wrap the decoded word in the required flag format.

#!/usr/bin/env python3

# Manual decode after identifying Leandro Katz's Lunar Alphabet.
# The glyphs in the challenge image correspond to the letters below.

decoded = ["M", "O", "O", "N", "M", "A", "N"]
word = "".join(decoded)
flag = f"DawgCTF{{{word}}}"

print(word)
print(flag)

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR