Hiding in Plain Sight 2
metactf
Task: a normal-looking PNG asks what is visually wrong with the image and expects the hidden subject's name as the flag. Solution: after basic metadata and hybrid-image checks fail, extract RGB bit planes and identify the person revealed in the least-significant-bit view as John Cena.
$ ls tags/ techniques/
Hiding in Plain Sight 2 — MetaCTF
Description
Something here seems a little off, can you figure out what? The flag will be the name of the person or object you find, such as DawgCTF{Turkey_Sandwich}
English summary: we are given a PNG image (ps2.png) and told that something hidden inside it should identify a person or object. The goal is to recover that hidden subject and format the answer as a DawgCTF{...} flag.
Source: https://metaproblems.com/9158c536955b3b93c3b1ec47841cc0ff/ps2.png
Analysis
The first pass was standard image reconnaissance.
- The file was a valid PNG.
- Dimensions were
2400x1350withRGBAchannels. - There was no useful EXIF metadata.
- PNG chunk inspection showed a normal structure.
- There was no appended payload after the PNG end.
That ruled out the easy cases: hidden archives, obvious metadata leaks, or malformed-file tricks.
Because the first "Hiding in Plain Sight" style challenge used a hybrid-image effect, I also tested the usual visual transforms:
- Gaussian blur
- aggressive downscaling / resizing
- grayscale conversion
- pixelation / block averaging
Those checks were reasonable, but they were not the decisive path here. They did not cleanly reveal a second face or object the way a classic hybrid image would.
The breakthrough came from bit-plane analysis. Extracting the low-order bit planes of the RGB channels revealed that the least-significant-bit view contained an embedded image. The strongest result was the combined RGB bit-0 output (ps2_rgb_bit0.png), where the left side clearly showed a hidden human figure.
...
Permission denied (requires auth)
Sign in to read this free writeup
This writeup is free — just sign in with GitHub to read it.
$ssh [email protected]