Suspicious Remix 2 — BroncoCTF 2026

Description

I just listened to the first one, I'm sorry for making you listen to that.

But now they sent me another one. I guess that they didn't directly embed the message in the audio, but I still think they put something in there somehow.

They told me it's supposedly more hide-n, whatever that means. I keep seeing with a command prompt, typing the steg command...

Also they told me there's a password of this, apparently it's in this image?

They keep doing this to me, this is their 2nd Remix! I'm so sorry for putting you through this. I promise I'll leave you alone after this.

Two files provided:

• sg_remix2.wav — RIFF WAVE audio, PCM, 16-bit, stereo, 48000 Hz, ~2:05 duration, 24 MB
• tolerate_this.png — PNG image, 500x409, RGBA, non-interlaced, 355 KB (shows Rick Astley from "Never Gonna Give You Up" music video)

Analysis

The challenge description contains multiple semantic clues:

• "hide-n" → steghide (the tool name sounds like "hide in")
• "command prompt, typing the steg command" → steghide is a CLI tool
• "password is in this image" → the PNG contains the steghide passphrase
• "2nd Remix" → sequel to a previous challenge

Standard LSB tools (zsteg) found nothing in the PNG. The key insight was that data can be hidden in higher bit planes (not just bit 0/LSB). Systematic extraction of all bit planes across all channels revealed hidden text in Red channel, bit 2.

The hidden message referenced the release year of the song shown in the image (Rick Astley's "Never Gonna Give You Up"). The non-OST album release was 1988 ("Whenever You Need Somebody" album), which served as the steghide password.

...