CTF Stego

Analyze and solve steganography challenges.

When to Use

Use this command for challenges involving:

• Images (PNG, JPG, BMP, GIF)
• Audio files (WAV, MP3, FLAC)
• Hidden data in media files
• LSB encoding
• Metadata hiding

Bundled Scripts

• check-tools.sh — Verify required stego tools are installed
• run-zsteg.sh — Full LSB analysis on PNG/BMP images. Outputs JSON with channel findings, embedded text/files, and extraction commands.
• run-steghide.sh — Extract hidden data from JPEG (tries common passwords). Outputs JSON with extraction status and password used.
• run-exiftool.sh — Metadata extraction with CTF-relevant field detection. Outputs JSON with interesting fields, GPS data, and flag detection.
• stego-pipeline.sh — Multi-step pipeline: exiftool → binwalk → zsteg/steghide. Runs all relevant tools in sequence based on file type and combines results.

Instructions

1. First check tool availability: bash scripts/check-tools.sh

2. Recommended: Run the full stego pipeline for comprehensive analysis:

   bash scripts/stego-pipeline.sh $ARGUMENTS

   The pipeline automatically:

   • Extracts metadata (exiftool) → checks for hidden comments, GPS, flags
   • Scans for appended data (binwalk) → detects files hidden after EOF
   • Runs LSB analysis (zsteg) → for PNG/BMP images
   • Tries steghide extraction → for JPEG/WAV with common passwords

   The JSON output combines all results with a unified suggestions array.

3. For individual tools:

   PNG/BMP (LSB analysis):

   bash scripts/run-zsteg.sh image.png

   JSON findings[] shows hidden text/files per channel. Use zsteg -E <channel> to extract.

   JPEG (steghide):

   bash scripts/run-steghide.sh image.jpg
   bash scripts/run-steghide.sh image.jpg "mypassword"

   JSON shows extracted_file and password_used on success.

   Metadata:

   bash scripts/run-exiftool.sh image.png

   JSON interesting_fields[] highlights CTF-relevant metadata with reasons.

Multi-Step Workflow

The pipeline handles chaining automatically. For manual chaining:

1. run-exiftool.sh image.png → check JSON interesting_fields for clues
2. run-zsteg.sh image.png → check JSON findings for LSB data
3. If zsteg finds embedded file → zsteg -E <channel> image.png > extracted
4. Analyze extracted file with /ctf-kit:analyze

Quick Checklist

Output Format

All scripts produce === PARSED RESULTS (JSON) === or === PIPELINE RESULTS (JSON) === sections. The has_flag field is true when a flag pattern is detected.

Team Roles

When using /ctf-kit:team-solve with a stego challenge, the lead spawns 3 specialists:

When to broadcast

• Image: "LSB in red channel contains ASCII text: ENCODED_STRING" — metadata analyst checks if it's a key
• Metadata: "Binwalk found ZIP appended after PNG EOF" — image analyst extracts and checks for password-protected content
• Audio: "Spectrogram shows text: HINT_STRING" — others use it as a password or clue
• Any: "Found the flag" — immediate broadcast, all stop

Example Usage

/ctf-kit:stego image.png
/ctf-kit:stego audio.wav
/ctf-kit:stego ./media/