Hiding in Plain Sight
metactf
AI-generated hybrid image where high-frequency details render a moss-covered Greek statue but low-frequency content hides a portrait of Barack Obama. Solved by Gaussian blur / heavy downsample + histogram equalization to reveal the hidden face.
$ ls tags/ techniques/
Hiding in Plain Sight — metactf
Description
There's something strange about this image but I can't put my finger on it, any ideas? The flag will be the name of the person or object you find, in the format
DawgCTF{Chicken_Sandwich}.File:
https://metaproblems.com/9158c536955b3b93c3b1ec47841cc0ff/hello.webp
The file is a 1024x1024 lossy WebP showing a detailed classical sculpture: a muscular bearded male figure (Poseidon / Neptune style) covered in green moss, set against a fountain / water background. Note that even though the event is metactf, the flag format is DawgCTF{...} — the challenge was reused from DawgCTF (UMBC). Always follow the format in the task description, not the event name.
Analysis
1. File-level recon — nothing hidden
Standard stego checks all came back empty:
file hello.webp # RIFF (little-endian) data, Web/P image, VP8 encoding, 1024x1024, lossy exiftool hello.webp # Only size/dimensions, no EXIF / XMP / ICC strings hello.webp | grep -iE 'flag|ctf|dawg|key|secret' # nothing
Manually parsing WebP chunks confirms a single VP8 chunk with no extra EXIF, XMP , ICCP, ANIM, or ANMF chunks, and no trailing data after the RIFF container:
with open('hello.webp', 'rb') as f: data = f.read() assert data[:4] == b'RIFF' and data[8:12] == b'WEBP' i = 12 while i < len(data): cid = data[i:i+4] csize = int.from_bytes(data[i+4:i+8], 'little') print(cid, csize, i) i += 8 + csize + (csize & 1) # chunk + padding # VP8 85836 12 # End at 85856 == filesize
So this is not file-level / LSB / metadata stego. The "strange" thing has to be visual.
2. Reading the hint literally
- Title: Hiding in Plain Sight
- Description: "There's something strange about this image but I can't put my finger on it"
...
Permission denied (requires auth)
Sign in to read this free writeup
This writeup is free — just sign in with GitHub to read it.
$ssh [email protected]