Suspicious Remix 2 — BroncoCTF 2026

Description

I just listened to the first one, I'm sorry for making you listen to that.

But now they sent me another one. I guess that they didn't directly embed the message in the audio, but I still think they put something in there somehow.

They told me it's supposedly more hide-n, whatever that means. I keep seeing with a command prompt, typing the steg command...

Also they told me there's a password of this, apparently it's in this image?

They keep doing this to me, this is their 2nd Remix! I'm so sorry for putting you through this. I promise I'll leave you alone after this.

Two files provided:

• sg_remix2.wav — RIFF WAVE audio, PCM, 16-bit, stereo, 48000 Hz, ~2:05 duration, 24 MB
• tolerate_this.png — PNG image, 500x409, RGBA, non-interlaced, 355 KB (shows Rick Astley from "Never Gonna Give You Up" music video)

Analysis

The challenge description contains multiple semantic clues:

• "hide-n" → steghide (the tool name sounds like "hide in")
• "command prompt, typing the steg command" → steghide is a CLI tool
• "password is in this image" → the PNG contains the steghide passphrase
• "2nd Remix" → sequel to a previous challenge

Standard LSB tools (zsteg) found nothing in the PNG. The key insight was that data can be hidden in higher bit planes (not just bit 0/LSB). Systematic extraction of all bit planes across all channels revealed hidden text in Red channel, bit 2.

The hidden message referenced the release year of the song shown in the image (Rick Astley's "Never Gonna Give You Up"). The non-OST album release was 1988 ("Whenever You Need Somebody" album), which served as the steghide password.

Solution

Step 1: Bit Plane Extraction from PNG

Standard LSB tools found nothing, so all bit planes were extracted systematically:

#!/usr/bin/env python3
from PIL import Image
import numpy as np

im = Image.open('tolerate_this.png').convert('RGBA')
arr = np.array(im)

for ci, c in enumerate('RGBA'):
    for bit in range(8):
        p = ((arr[:,:,ci] >> bit) & 1) * 255
        Image.fromarray(p.astype('uint8')).save(f'plane_{c}_{bit}.png')

Red channel, bit 2 (plane_R_2.png) revealed hidden text on a clean white background:

"Password = release year the non-OST song was from"

Step 2: Determine the Password

The PNG shows Rick Astley from "Never Gonna Give You Up". The song was released as a single in 1987, but the non-OST album ("Whenever You Need Somebody") was released in 1988. Testing confirmed 1988 as the correct steghide password.

Step 3: Steghide Extraction from WAV

docker run --rm --platform linux/amd64 -v "$PWD:/data" ubuntu:22.04 bash -c \
  "apt-get update -qq && apt-get install -y -qq steghide && \
   steghide extract -sf /data/sg_remix2.wav -p '1988' -xf /data/extracted.txt -f"

Output: wrote extracted data to "/data/extracted.txt"

The extracted file contained the flag.