I can’t find my original house key anywhere! Can you help me find it? Here’s a picture of my keys the nanny took before they were lost. It must be hidden somewhere!
Flag format:
texsaw{flag_here}
Solution
Extracting Hidden Files
Using binwalk, we can identify and extract any embedded files:
❯ binwalk -e Temoc_keyring.pngAfter extraction, we have two similar images:
Temoc_keyring(orig).pngwhere_are_my_keys.png
Checking them with pngcheck confirms they are both valid, but their file sizes and compression ratios differ.
Pixel Comparison
At first glance, the two images appear identical. However, the difference in file size suggests that data might be hidden in the pixel values themselves. We can use a Python script with the Pillow library to compare them:
from PIL import Image
img1 = Image.open('Temoc_keyring(orig).png').convert("RGB")img2 = Image.open('where_are_my_keys.png').convert("RGB")
width, _ = img1.size
# Check the first row for differencesdiff_indices = [x for x in range(width) if img1.getpixel((x, 0)) != img2.getpixel((x, 0))]print(f"Differences found at X coordinates: {diff_indices}")Running this reveals exactly 131 differing pixels, all located within the very first row (y = 0).
Decoding the Steganography
The pattern of differing pixels suggests a binary encoding. We can treat each pixel in the first row as a bit:
- Bit 1: If the pixels at
(x, 0)are different. - Bit 0: If the pixels at
(x, 0)are identical.
We then group these bits into 8-bit bytes and convert them to ASCII characters to reveal the flag.
Extraction Script:
from PIL import Image
img1 = Image.open('Temoc_keyring(orig).png').convert("RGB")img2 = Image.open('where_are_my_keys.png').convert("RGB")
bits = []for x in range(img1.size[0]): if img1.getpixel((x, 0)) != img2.getpixel((x, 0)): bits.append(1) else: bits.append(0)
# Convert bits to bytes and then to ASCIIflag = ""for i in range(0, len(bits), 8): byte = bits[i:i+8] char_code = int("".join(map(str, byte)), 2) if char_code == 0: break flag += chr(char_code)
print(f"Flag: {flag}")Flag
texsaw{you_found_me_at_key}