Tuesday, June 11, 2019

[Project] 1 - Bluestego

The LSB is old technique but still a most common in the CTF and special is in steganography. What is LSB?

The least significant bits have the useful property of changing rapidly if the number changes even slightly. For example, if 1 (binary 00000001) is added to 3 (binary 00000011), the result will be 4 (binary 00000100) and three of the least significant bits will change (011 to 100). By contrast, the three most significant bits (MSBs) stay unchanged (000 to 000).


And in my tool, I use it to hide the message into the picture, every pixel can hide 1 bit, so 8 pixels will compose to 1 byte.


But it too basically, and too easy with zsteg to read the message, so I add some cryptography to encrypt the message. The main cryptography technique I use is Vigenere cipher, I think it old but gold, and I do some stuffs to modify it.

And it can encrypt 2^12 = 4096 characters in a picture with large resolution, for small picture character number can calculate by formula:

Character = (Height * Width / 8) - 20

For example, I used an image sky.jpg to ecnrypt the string: "Hello Blue"



The output.png:


For decryption:


I think it's really easy to use, but still now it too simple, and in the future I hope I can make it better, like can encrypt file in image not only text like right now.

I pushed code on github as always: https://github.com/BinhHuynh2727/BlueStego

Saturday, June 8, 2019

[Writeup] HSCTF 2019

FORENSICS

Chicken Crossing


Use strings and grep command in linux I have a flag.
Flag: hsctf{2_get_2_the_other_side}

Cool Image

The author give us a file with extension is .pdf, but I can open it, check back the header I realize it is the .png file so I just change the extension and get flag.


Cool Image 2

This time I can't open the PNG file. Like cool image 1 I open it in HXD and I see the auther add some stuffs at the header and make operation can't realize the png file. Just delete all of it I have true image:

Slap


Once again, I use strings and grep command in linux and take flag
Flag: hsctf{twoslapsnonetforce}


Logo sucks bad


When I use Stegsolve on the image, I see at top of image have been changed, so I believe the Image changed by LSB. I used zsteg and have flag.
Flag: hsctf{th4_l3est_s3gnific3nt_bbbbbbbbbbbbb}