Skip to main content

Rickroll

Challenge Overview​

This was a 3-layer nested LSB (Least Significant Bit) steganography challenge with a geometric spiral obfuscation on the final layer. The theme referenced Rick Astley and the concept of "transforming" through soul music, hinting at swirl/spiral geometric distortion.

Challenge File: pic.png (3000x2400 RGBA PNG)

Layer 1: LSB Extraction from pic.png​

Approach​

Examined all combinations of:

  • Channels: r, g, b, a, and combinations (rg, rgb, abgr, etc.)
  • Bit planes: Bits 0, 1, 0-1, 0-2, 0-3
  • Bit orders: LSB-first and MSB-first

Discovery​

Found PNG signature 89 50 4E 47 in:

  • Channels: abgr
  • Bits: 0-1
  • Order: LSB

Extraction Method​

# Extract bits 0-1 from ABGR channels in LSB order
for each pixel:
    extract bit 0 and bit 1 from each of A, B, G, R
    combine as 8-bit bytes (LSB first)

Result​

  • Carved PNG: 3000x2400 RGB image (Layer 2)
  • File: carved.png

Layer 2: LSB Extraction from carved.png​

Discovery​

Found PNG signature via:

zsteg -E b2,rgb,lsb,xy carved.png > carved_b2_rgb_lsb.bin

Result​

  • Layer 3 PNG: 1169x389 grayscale
  • Content: heavily obfuscated flag text (spiral/swirl)
  • File: layer3.png

Layer 3: Geometric Deobfuscation and OCR​

The final layer was spiral-distorted and unreadable by OCR until reverse swirl was applied.

Reverse-Swirl Sweep​

Used ImageMagick sweep:

convert layer3.png \
  -sigmoidal-contrast 3x50% \
  -virtual-pixel white \
  -swirl <angle> \
  -threshold 50% \
  output.png
  • Positive angles: 0 to 500 (step 20)
  • Negative angles: -60 to -500 (step 20)

Best angle identified: -400

OCR at -400:

REDFOXSL00k_iAHO_ShOw3D_vPI3

Progressive upscaling (2x-5x) improved readability.

Images​

Obfuscated layer (reverse swirl stage):

reverse_swirl.png (add this image file in the same folder)

Solution-enhanced image (up5):

up5.png (add this image file in the same folder)

Final Flag​

REDFOX{LOOk_WHO_5hOw3D_uP!}

Artifacts​

  • pic.png
  • carved.png
  • layer3.png
  • reverse_swirl_neg_-400.png
  • up5_400.png