1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
| ┌──(kali㉿kali)-[~]
└─$ zsteg -a /home/kali/Desktop/135.png
imagedata .. text: "KK<220\r\r"
b1,rgb,lsb,xy .. file: Zip archive data, at least v2.0 to extract, compression method=deflate
b1,bgr,msb,xy .. text: "saZ$S:'6"
b2,rgb,lsb,xy .. file: OpenPGP Public Key
b2,bgr,lsb,xy .. file: OpenPGP Public Key
b3,b,lsb,xy .. text: "#?/(9Rk;"
b3,rgb,lsb,xy .. text: "~G#\rwW:U"
b3p,g,lsb,xy .. text: "OkOkKkOl%#"
b3p,g,msb,xy .. text: "\r[{[LIXCQ"
b3p,rgb,lsb,xy .. text: "VuTppuuqppUtQQQr><"
b3p,rgb,msb,xy .. text: "BBBBBBB@"
b3p,bgr,lsb,xy .. text: "LKNjNNoO"
b3p,bgr,msb,xy .. text: "@@@@@@@DCCCCCCC"
b4,r,lsb,xy .. text: "Ewe##333#\"#"
b4,r,msb,xy .. text: ";UUUUUUU"
b4,g,lsb,xy .. text: "yffgfTS22"
b4,g,msb,xy .. text: "gF87rqw@Bw"
b4,b,lsb,xy .. text: "ffffvvgwfvfw"
b4,rgb,msb,xy .. text: "Dsr@3%\"7"
b4,bgr,msb,xy .. text: "vCp2C\"5'"
b5,g,lsb,xy .. text: "!K)HC!KR"
b5p,r,lsb,xy .. text: "+Y@SYN7>766$,-%,"
b5p,r,msb,xy .. text: "7KKKKKKK"
b5p,g,lsb,xy .. text: "mleldmdd"
b5p,g,msb,xy .. text: "nM1/ebnAEn"
b5p,b,lsb,xy .. text: "~leee~vmmTw"
b5p,rgb,lsb,xy .. text: "U\\Tnnnfg&ffB1"
b5p,rgb,msb,xy .. text: "/?///GGG"
b5p,bgr,lsb,xy .. text: "544FNFFO"
b5p,bgr,msb,xy .. text: "/a'$f\rgoo"
b6,g,msb,xy .. text: "4ES4MS4E"
b6,b,lsb,xy .. file: OpenPGP Public Key
b6,rgb,msb,xy .. file: OpenPGP Secret Key
b6,bgr,lsb,xy .. file: OpenPGP Public Key
b6,bgr,msb,xy .. file: OpenPGP Public Key
b6p,r,lsb,xy .. text: "z~zpputjjjjjjjhYQUPQQTPSJJOA@A>2DE=G03"
b6p,r,msb,xy .. text: ".VVVVVVV"
b6p,g,lsb,xy .. text: "\":BR:EB54140500?400*+.* \"/../..+..//!%$"
b6p,b,lsb,xy .. file: OpenPGP Public Key
b6p,rgb,lsb,xy .. text: "yx|xxxrrrswvvrhhhhhhhhhhhhhhh`XVSWWVSRSWSVWRRSSNKJKKOO@EAAAD?;1;DAEE?4D>101"
b6p,rgb,msb,xy .. file: OpenPGP Secret Key
b6p,bgr,lsb,xy .. file: OpenPGP Public Key
b6p,bgr,msb,xy .. file: OpenPGP Public Key
b7,rgb,msb,xy .. text: "Z\tZ+Ak$h"
b7p,r,lsb,xy .. text: "||~xrimmljD0lmnpnlidke__`ac[^`eddcb_ZZ]___aa][ZTWTYZNOPZXTY`ja_bfjkegefkkkollrrmhhggnllieb]]^\\^\\YYYWZ[ZXY[X[YUTXo@\"\\ghhv"
b7p,r,msb,xy .. text: "]--------"
b7p,g,lsb,xy .. text: "zxyz{vwpruyz"
b7p,g,msb,xy .. text: "i)\t\t\t\t\t\t\t\t\t"
b7p,b,lsb,xy .. text: "LLRQAQD "
b7p,rgb,lsb,xy .. text: "xxxshhjlrlkmdjeE 0\\mlloopqqomlhhfdd"
b7p,rgb,msb,xy .. text: "---------------\r5U"
b7p,bgr,lsb,xy .. text: "MLLPRPPS@RPJE< "
b7p,bgr,msb,xy .. text: "L44444444t4"
b8,r,lsb,xy .. text: "jkjmmmlldllhfbTBJT^dddfhjhdeggfebcbcccccccbcbbbcaa^^_^^^\\\\\\\\]]]\\ZZZZZZZZZZZZZZZXVUTUUUTTTUTUUTTTTSRRRRSSPQPPPQONLNQPQQOMQOLLLG<49>EKKIHHJKKIIFFGGFFGFFFFDDEDEEDEEDBCCCA@@@CDEGEEHHIHHIHIFFIIIIGFEDDEDDEDEDDDDEDD@@AAAA??>>>>?<<<944569656252\""
b8,r,msb,xy .. text: "fF*BR*z&&&f"
b8,g,msb,xy .. text: "33333SSS"
b8,b,msb,xy .. text: "Ey\t>!1i9yy"
b8,rgb,msb,xy .. text: "EF3y*}\tB5>R-!*}1z"
b8,bgr,msb,xy .. text: "fy3F\t}*>5B!-R1}*i"
b1,bgr,lsb,xy,prime .. /home/kali/.local/share/gem/ruby/3.3.0/gems/zsteg-0.2.13/lib/zsteg/checker/wbstego.rb:41:in `to_s': stack level too deep (SystemStackError)
from /home/kali/.local/share/gem/ruby/3.3.0/gems/iostruct-0.5.0/lib/iostruct.rb:180:in `inspect'
from /home/kali/.local/share/gem/ruby/3.3.0/gems/zsteg-0.2.13/lib/zsteg/checker/wbstego.rb:41:in `to_s'
from /home/kali/.local/share/gem/ruby/3.3.0/gems/iostruct-0.5.0/lib/iostruct.rb:180:in `inspect'
from /home/kali/.local/share/gem/ruby/3.3.0/gems/zsteg-0.2.13/lib/zsteg/checker/wbstego.rb:41:in `to_s'
from /home/kali/.local/share/gem/ruby/3.3.0/gems/iostruct-0.5.0/lib/iostruct.rb:180:in `inspect'
from /home/kali/.local/share/gem/ruby/3.3.0/gems/zsteg-0.2.13/lib/zsteg/checker/wbstego.rb:41:in `to_s'
from /home/kali/.local/share/gem/ruby/3.3.0/gems/iostruct-0.5.0/lib/iostruct.rb:180:in `inspect'
from /home/kali/.local/share/gem/ruby/3.3.0/gems/zsteg-0.2.13/lib/zsteg/checker/wbstego.rb:41:in `to_s'
... 10906 levels...
from /home/kali/.local/share/gem/ruby/3.3.0/gems/zsteg-0.2.13/lib/zsteg.rb:26:in `run'
from /home/kali/.local/share/gem/ruby/3.3.0/gems/zsteg-0.2.13/bin/zsteg:8:in `<top (required)>'
from /usr/local/bin/zsteg:25:in `load'
from /usr/local/bin/zsteg:25:in `<main>'
┌──(kali㉿kali)-[~]
└─$ zsteg -help
Usage: zsteg [options] filename.png [param_string]
-a, --all try all known methods
-E, --extract NAME extract specified payload, NAME is like '1b,rgb,lsb'
Iteration/extraction params:
-o, --order X pixel iteration order (default: 'auto')
valid values: ALL,xy,yx,XY,YX,xY,Xy,bY,...
-c, --channels X channels (R/G/B/A) or any combination, comma separated
valid values: r,g,b,a,rg,bgr,rgba,r3g2b3,...
-b, --bits N number of bits, single int value or '1,3,5' or range '1-8'
advanced: specify individual bits like '00001110' or '0x88'
--lsb least significant bit comes first
--msb most significant bit comes first
-P, --prime analyze/extract only prime bytes/pixels
--shift N prepend N zero bits
--invert invert bits (XOR 0xff)
--pixel-align pixel-align hidden data
Analysis params:
-l, --limit N limit bytes checked, 0 = no limit (default: 256)
--[no-]file use 'file' command to detect data type (default: YES)
--no-strings disable ASCII strings finding (default: enabled)
-s, --strings X ASCII strings find mode: first, all, longest, none
(default: first)
-n, --min-str-len X minimum string length (default: 8)
-v, --verbose Run verbosely (can be used multiple times)
-q, --quiet Silent any warnings (can be used multiple times)
-C, --[no-]color Force (or disable) color output (default: auto)
PARAMS SHORTCUT
zsteg fname.png 2b,b,lsb,xy ==> --bits 2 --channel b --lsb --order xy
┌──(kali㉿kali)-[~]
└─$ cd /home/kali/Desktop
┌──(kali㉿kali)-[~/Desktop]
└─$ zsteg -E 'b1,rgb,lsb,xy' /home/kali/Desktop/135.png > extracted.zip
┌──(kali㉿kali)-[~/Desktop]
└─$ unzip extracted.zip
Archive: extracted.zip
End-of-central-directory signature not found. Either this file is not
a zipfile, or it constitutes one disk of a multi-part archive. In the
latter case the central directory and zipfile comment will be found on
the last disk(s) of this archive.
unzip: cannot find zipfile directory in one of extracted.zip or
extracted.zip.zip, and cannot find extracted.zip.ZIP, period.
┌──(kali㉿kali)-[~/Desktop]
└─$ file extracted.zip
extracted.zip: Zip archive data, at least v2.0 to extract, compression method=deflate
┌──(kali㉿kali)-[~/Desktop]
└─$ 7z x extracted.zip
7-Zip 25.01 (x64) : Copyright (c) 1999-2025 Igor Pavlov : 2025-08-03
64-bit locale=en_US.UTF-8 Threads:32 OPEN_MAX:1024, ASM
Scanning the drive for archives:
1 file, 145914 bytes (143 KiB)
Extracting archive: extracted.zip
WARNINGS:
There are data after the end of archive
--
Path = extracted.zip
Type = zip
WARNINGS:
There are data after the end of archive
Physical Size = 2401
Tail Size = 143513
Characteristics = Local Central
Everything is Ok
Archives with Warnings: 1
Warnings: 1
Size: 8509
Compressed: 145914
┌──(kali㉿kali)-[~/Desktop]
└─$ ls -la
total 130484
drwxr-xr-x 27 kali kali 4096 Jan 29 03:10 .
drwx------ 27 kali kali 4096 Jan 29 03:02 ..
drwxrwxr-- 3 kali kali 4096 Jan 24 06:28 000
-rw------- 1 kali kali 239979 Jan 20 00:53 000.gif
-rw-rw-r-- 1 kali kali 8509 Oct 29 2016 1
drwxrwxr-x 2 kali kali 4096 Dec 9 11:28 '101041_D u know Pyc？'
-rwxrw-rw- 1 kali kali 70047 Dec 5 21:10 '101041_D u know Pyc？.zip'
-rw------- 1 kali kali 19706 Aug 11 2016 10.xls
-rwxrw-rw- 1 kali kali 40416912 Jan 23 02:57 111.wav
-rw------- 1 kali kali 383781 Jan 28 07:43 135.png
-rw-rw-r-- 1 kali kali 730 Jan 24 23:57 1.php
-rw-rw-r-- 1 kali kali 0 Jan 24 23:56 1.py
-rw------- 1 kali kali 192583 Jan 22 06:28 2wm.png
drwxrwxr-x 2 kali kali 4096 Jan 22 06:35 _2wm.png.extracted
-rw-rw-r-- 1 kali kali 204 Dec 1 01:04 422001.zip
-rw-rw-r-- 1 kali kali 4141 Nov 19 07:55 46_point.txt
-rw------- 1 kali kali 1020478 Nov 13 09:19 4ak5ra.jpg
drwxrwxr-- 3 kali kali 4096 Nov 22 01:54 aihe
-rwxrw-rw- 1 kali kali 5514811 Feb 11 2020 aihe.mp3
-rwxrw-rw- 1 kali kali 3572445 Jan 17 11:16 bailan.zip
-rw------- 1 kali kali 609457 Sep 15 09:41 BEA.gif
drwxrwxr-- 4 kali kali 4096 Jan 25 22:37 bit
-rwxrw-rw- 1 kali kali 4715004 Jan 13 01:38 bit.jpg
drwxrwxr-x 2 kali kali 4096 Jan 25 22:36 _bit.jpg.extracted
-rw------- 1 kali kali 148028 Jan 14 06:27 b.jpg
drwxrwxr-x 3 kali kali 4096 Jan 14 06:33 _b.jpg.extracted
drwxrwxr-- 4 kali kali 4096 Jan 18 00:31 bl
-rw------- 1 kali kali 3326066 Jan 23 01:48 'Call the Alien.wav'
-rw------- 1 kali kali 5822 Sep 21 10:07 challenge.png
-rwx--x--x 1 kali kali 415 Dec 9 07:21 check_magic.sh
-rw------- 1 kali kali 12678 Jan 21 04:17 chr.txt
-rw------- 1 kali kali 11264 Dec 1 21:36 ChsPinyinUDL.dat
-rw-rw-r-- 1 kali kali 0 Sep 7 06:21 Congratulations.txt
-rw------- 1 kali kali 562617 Nov 13 12:00 congyu.jpg
drwxrwxr-- 3 kali kali 4096 Jan 24 05:34 cover
-rw------- 1 kali kali 608972 Jan 24 05:13 cover.jpg
-rw------- 1 kali kali 105712 Jan 17 04:11 Cover.pdf
drwxrwxr-x 2 kali kali 4096 Jan 17 04:21 _Cover.pdf.extracted
-rw------- 1 kali kali 2018896 Feb 12 2021 ctfshow.png
-rw-rw-r-- 1 kali kali 3543838 Jan 23 03:18 cuh1.wav
-rw------- 1 kali kali 3255904 Jul 9 2020 cuh.wav
-rw-rw-r-- 1 kali kali 731 Dec 2 01:55 decrypted_output.txt
-rw-rw-r-- 1 kali kali 731 Dec 2 01:49 decrypted_raw.bin
-rwxrw-rw- 1 kali kali 795 Apr 12 2023 Dic.zip
-rwxrw-rw- 1 kali kali 462 Nov 20 08:05 download.zip
-rw-rw-r-- 1 kali kali 145914 Jan 29 03:06 extracted.zip
-rw------- 1 kali kali 81078 Nov 26 2019 flag.jpg
-rw-rw-r-- 1 kali kali 36 Dec 2 03:51 flag.txt
-rw-rw-r-- 1 kali kali 5015 Dec 2 23:52 flag.zip
lrwxrwxrwx 1 kali kali 45 Nov 25 05:18 GMGVDZ -> /home/kali/.cache/vmware/drag_and_drop/GMGVDZ
lrwxrwxrwx 1 kali kali 45 Nov 25 05:18 guHoIh -> /home/kali/.cache/vmware/drag_and_drop/guHoIh
-rw------- 1 kali kali 104502 Jan 17 01:41 Hacker.docx
drwxrwxr-x 5 kali kali 4096 Jan 17 01:46 _Hacker.docx.extracted
-rw------- 1 kali kali 1213108 Sep 11 08:08 hh.png
-rw-rw-r-- 1 kali kali 50625 Nov 20 07:21 hidden.zip
-rw-rw-r-- 1 kali kali 1681 Jan 24 04:42 hi.py
drwxrwxr-- 3 kali kali 4096 Dec 2 00:58 hxt
-rw------- 1 kali kali 382511 Nov 7 06:33 hxt.jpg
-rw------- 1 kali kali 3068224 Jan 23 05:54 hzwz.gif
drwxrwxr-x 3 kali kali 4096 Jan 23 05:57 _hzwz.gif.extracted
-rw------- 1 kali kali 98221 Apr 12 2023 IDAT.png
drwxrwxr-x 2 kali kali 4096 Jan 18 21:48 _IDAT.png.extracted
-rw------- 1 kali kali 49452 Jan 17 04:36 image1.jpeg
-rw------- 1 kali kali 71160 Sep 3 10:08 image.jpg
-rw------- 1 kali kali 293437 Oct 30 2024 isctf.jpg
-rw------- 1 kali kali 3924 Jan 27 04:42 jail.py
-rw-rw-r-- 1 kali kali 429 Dec 6 03:29 make_header_16.py
-rw------- 1 kali kali 42387 Nov 24 2020 mi.jpg
-rw------- 1 kali kali 4390 Mar 12 2021 misc10.png
drwxr-xr-x 2 root root 4096 Nov 12 08:24 _misc10.png.extracted
drwxrwxr-x 2 kali kali 4096 Nov 19 08:48 misc46
-rw-rw-r-- 1 kali kali 0 Nov 19 08:47 misc466.py
drwxrwxr-x 2 kali kali 4096 Nov 20 03:57 misc47
-rw------- 1 kali kali 4575 Nov 20 04:29 misc53.png
-rw------- 1 kali kali 5267 Nov 20 04:41 misc54.png
-rw------- 1 kali kali 2884 Nov 20 07:10 misc55.png
-rw------- 1 kali kali 4602 Nov 20 07:41 misc56.png
-rw------- 1 kali kali 34565 Feb 4 2021 misc7.jpg
-rw------- 1 kali kali 11633 Mar 28 2021 misc8.png
drwxrwxr-- 3 kali kali 4096 Nov 20 08:12 miscsignup
-rw------- 1 kali kali 25756 Nov 7 2024 'nothing is here.png'
-rw-rw-r-- 1 kali kali 20208428 Jan 23 03:02 output2.wav
-rw-rw-r-- 1 kali kali 3620204 Jan 23 01:57 output.wav
-rw-rw-r-- 1 kali kali 158 Jan 24 23:57 payload.bin
-rw-rw-r-- 1 kali kali 16 Nov 26 13:12 png_header
-rw-rw-r-- 1 kali kali 16 Nov 26 13:11 png_header~
-rw-rw-r-- 1 kali kali 640490 Nov 26 21:55 png.zip
-rw------- 1 kali kali 1997365 Mar 31 2023 QAQ.jpg
drwxrwxr-x 3 kali kali 4096 Jan 17 07:27 _QAQ.jpg.extracted
-rw-rw-r-- 1 kali kali 123 Dec 2 02:51 reversed.zip
-rw-rw-r-- 1 kali kali 65254 Dec 2 04:10 Sect3t.jpg
drwxrwxr-x 2 kali kali 4096 Dec 6 00:13 _Sect3t.jpg.extracted
-rw-rw-r-- 1 kali kali 513 Dec 2 01:37 sm.py
-rwxrw-rw- 1 kali kali 640490 Nov 26 12:09 test.zip
-rwxrw-rw- 1 kali kali 4333773 Sep 18 10:18 TiTan.png
-rw------- 1 kali kali 2919465 Apr 21 2023 topic.png
drwxrwxr-x 3 kali kali 4096 Jan 22 10:11 _topic.png.extracted
drwxrwxr-- 4 kali kali 4096 Jan 22 10:13 topic.zip
-rwxrw-rw- 1 kali kali 123 Dec 2 02:44 Untitled1.zip
-rw------- 1 kali kali 18636 Jan 19 10:24 usbdata
-rw------- 1 kali kali 281088 Feb 8 2025 VN_lang_8bdfe1d1a42c87474a301bdfc9937a9f.exe
drwxrwxr-x 9 kali kali 4096 Jan 28 04:05 volatility3-develop
-rwxrw-rw- 1 kali kali 1578871 Jan 28 03:59 volatility3-develop.zip
-rwxrw-rw- 1 kali kali 19033125 Dec 5 21:16 wav.wav
drwxrwxr-x 2 kali kali 4096 Dec 5 22:04 _wav.wav.extracted
drwxrwxr-x 2 kali kali 4096 Dec 8 04:49 _welcome.pdf.extracted
-rw-rw-r-- 1 kali kali 286031 Sep 11 08:00 xsbh.jpg
-rw------- 1 kali kali 1213108 Dec 21 22:09 xsbh.png
-rw-rw-r-- 1 kali kali 2041 Dec 2 02:00 yeah.py
-rw-rw-r-- 1 kali kali 0 Dec 2 01:47 yes.pu
-rw-rw-r-- 1 kali kali 0 Dec 2 01:47 yes.py
-rw------- 1 kali kali 382511 Nov 7 06:33 湖心亭.jpg
-rw-rw-r-- 1 kali kali 239 Sep 11 05:00 真-星髓宝盒.zip
┌──(kali㉿kali)-[~/Desktop]
└─$ file 1
1: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=8df45089fa39fec83423ec37a944e81065d16bee, not stripped
┌──(kali㉿kali)-[~/Desktop]
└─$ strings 1 | grep -i "flag\|ctf\|{\|}"
hctf{dd0gf4c3tok3yb0ard4g41n~~~}
┌──(kali㉿kali)-[~/Desktop]
└─$
|
