DEV Community

CTFDojo
CTFDojo

Posted on Originally published at ctfdojo.com

PicoCTF Hideme Writeup — Extract a Hidden ZIP with Binwalk

#ctf #security #forensics

A PNG image contains a ZIP file hidden inside it. We detect it with binwalk, extract it, and the flag is in the hidden folder.

  • Platform: PicoCTF 2023
  • Category: Forensics
  • Points: 100 pts
  • Difficulty: Beginner
  • Tools: binwalkfileunzip

Challenge description

The challenge provides a flag.png image and simply asks:

"Someone hid a flag in this image. But can you find it?"

The image opens normally in a viewer — it displays a regular image. Nothing suspicious at first glance. That's where the magic of forensics tools comes in.

Key concepts — Steganography

Steganography is the practice of hiding data inside other files. Unlike cryptography, which encrypts data, steganography conceals it.

A common CTF technique: hiding a ZIP file at the end of a PNG image. The image viewer ignores everything that comes after the end of the image (IEND), but a ZIP file read from the end of the file is perfectly valid.

Step 1 — Identify the file

We always start with the file command to confirm the nature of the file:

$ file flag.png
flag.png: PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Enter fullscreen mode Exit fullscreen mode

It is indeed a PNG. But let's dig deeper with binwalk.

Step 2 — Scan with binwalk

binwalk is a tool that scans a file looking for known file signatures (ZIP, ELF, JPEG, etc.) hidden inside.

$ binwalk flag.png

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             PNG image, 512 x 512, 8-bit/color RGBA, non-interlaced
39739         0x9B3B          Zip archive data, at least v1.0 to extract
39906         0x9BE2          Zip archive data, at least v2.0 to extract, name: secret/flag.png
40202         0x9D0A          End of Zip archive, footer signature
Enter fullscreen mode Exit fullscreen mode

Bingo. binwalk detects a ZIP file embedded at offset 39739, which itself contains a secret/flag.png file.

Step 3 — Extract the content

We automatically extract all detected files with the -e flag:

$ binwalk -e flag.png

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             PNG image...
39739         0x9B3B          Zip archive data...

$ ls
flag.png  _flag.png.extracted/

$ ls _flag.png.extracted/
9B3B.zip  secret/

$ ls _flag.png.extracted/secret/
flag.png
Enter fullscreen mode Exit fullscreen mode

Step 4 — Read the flag

We open the extracted image secret/flag.png in an image viewer — the flag is displayed there as text.

$ eog _flag.png.extracted/secret/flag.png
# or: xdg-open, feh, display...
Enter fullscreen mode Exit fullscreen mode

🚩 picoCTF{ flag intentionally hidden }

The flag is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

This challenge teaches two fundamental reflexes in CTF forensics:

  • Never trust a file's extension — use file to verify
  • Systematically scan suspicious files with binwalk before any other analysis
  • Images are one of the most common steganography vectors in CTFs

In a real security context, this technique is used in malware to exfiltrate data hidden inside seemingly innocent images.

Installing binwalk 

# Debian / Ubuntu / Kali
$ sudo apt install binwalk

# macOS
$ brew install binwalk

# pip
$ pip install binwalk
Enter fullscreen mode Exit fullscreen mode

Originally published on CTFdojo — join the CTFdojo Discord to discuss writeups and get notified about new ones.

Top comments (0)