Salted Wounds

Challenge author
Eric Hennenfent (SIGPwny)
Write-up author
Dan (Batman's Kitchen), Xander
Points
200
Category
forensics

There are some challenges I'd rather forget.

We are given a file zmap.pdf, a paper on the zmap scanner. It's easy to find another copy of this paper online, and the files differ. The given file is much larger. Taking a look at the differences, there is an embedded file.

Type/ZmbeddedZile/Subtype/text#2Fplain/Length

which can be extracted with

pdfdetach -saveall zmap.pdf

The file is base64 text, which decodes to a png image of T Swift. I immediately threw the png into Stegsolve, and diffed it with a nearly identical image found online. The only difference was in the first column of pixels, so I guessed LSB stego. Testing LSB with RGB in the column in stegsolve, we get the flag.