Blue - Forensic - UMDCTF2022

[m00n19]

Blue

Description

Larry gave me this python script and an image. What is she trying to tell me?

File 1: bluer.png

File 2: steg.py

Solution

Challenge cho chúng ta 2 file : bluer.png

Và steg.py

from PIL import Image
import random

filename = 'blue.png'
orig_image = Image.open(filename)
pixels = orig_image.load()
width, height = orig_image.size

with open('flag.txt', 'r') as f:
    flag = f.read().strip() 

for y in range(len(flag)):
    for a in range(ord(flag[y])):
        x = random.randrange(0,width-1) 
        c = random.randrange(0,3)
        pixel = list(orig_image.getpixel((x, y)))
        pixel[c] += 1
        pixels[x, y] = (pixel[0], pixel[1], pixel[2])

orig_image.save('bluer.png')

Cùng mình phân tích code một chút nào!

Đầu tiên họ gọi và mở 1 file png có tên là blue.png, sau đó sẽ load pixel của ảnh cùng với các kích thước width và height. Nội dung file flag.txt được gán vô biến flag.

Quá trình xử lý file blue.png được bắt đầu bằng vòng lặp cùng với các biến được random giá trị. Nhìn qua chúng ta có thể nhận ra việc tác giả đã sử dụng phương pháp LSB (tham khảo thêm tại https://m00n19.wordpress.com/2022/03/03/20/) để chỉnh sửa ảnh gốc.

Với mỗi một hàng pixel của ảnh gốc được chỉnh sửa ngẫu nhiên một giá trị R,G hoặc B thuộc một pixel bất kỳ. Vì vậy mấu chốt của challenge này là việc chúng ta sẽ phải tính được số lần các pixel bị thay đổi, số hàng pixel bị can thiệp để có thể biết được độ dài flag cũng như convert được các giá trị int đại diện cho từng chữ cái trong flag.

Mình có chạy thử code sau để xem thử một vài giá trị pixel của file bluer.png đã chỉnh sửa

from PIL import Image
import random

filename = 'bluer.png'
orig_image = Image.open(filename)
pixels = orig_image.load()
width, height = orig_image.size

flag_number = []

for y in range(height):
    x = random.randrange(0,width-1) 
    pixel = list(orig_image.getpixel((x, y)))
    print(pixel)

Kết quả cho mình thấy nghi ngờ về giá trị các pixel của file ảnh cũ chưa chỉnh sửa

$ python flag.py 
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 167, 255]
[34, 87, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 87, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 167, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[35, 86, 166, 255]
[35, 86, 166, 255]
[34, 86, 166, 255]
[35, 86, 166, 255]
[34, 86, 167, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]
[34, 86, 166, 255]

Chúng ta có thể thấy một vài pixel có sự khác biệt về giá trị R,G hoặc B. Tuy nhiên có rất nhiều pixel đều có 1 giá trị (R,G,B) giống nhau là (34,86,166). Nghi vấn của mình đây có thể là giá trị gốc ban đầu các pixel của blue.png

Nếu cho tất cả các giá trị pixel của bluer.png giảm đi một bộ giá trị (34,86,166) thì hoàn toàn có thể trích xuất ra số lượt pixel bị thay đổi vì mỗi lần chỉ tăng 1 đơn vị.

from PIL import Image
import random

filename = 'bluer.png'
orig_image = Image.open(filename)
pixels = orig_image.load()
width, height = orig_image.size

flag_number = []

for y in range(height):
    k = 0
    for x in range(width):
        k += orig_image.getpixel((x, y))[0] + orig_image.getpixel((x, y))[1] + orig_image.getpixel((x, y))[2] - (34+86+166)

    flag_number.append(k)

print(flag_number)

flag = []

for n in flag_number:
    if n != 0:
        flag.append(chr(n))

print(''.join(flag))

Mình code sử dụng ngược lại file bluer.png. Mục đích là sẽ quét từng pixel một trong ảnh để giảm một lượng giá trị (34,86,166) để có thể lấy được số lần thực hiện thay đổi pixel của từng hàng. Và kết quả thu được :

$ python flag.py
[85, 77, 68, 67, 84, 70, 123, 76, 52, 114, 114, 121, 95, 76, 48, 118, 51, 115, 95, 104, 51, 114, 95, 115, 116, 51, 103, 48, 110, 111, 103, 114, 64, 112, 104, 121, 95, 56, 57, 51, 50, 48, 125, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
UMDCTF{L4rry_L0v3s_h3r_st3g0nogr@phy_89320}

Các giá trị 0 là do tác giả chỉ thực hiện thay đổi pixel trên các hàng có trị số không vượt quá độ dài flag nên trừ đi giá trị ban đầu thì dĩ nhiên bằng 0 rồi nhỉ!

FLAG >> UMDCTF{L4rry_L0v3s_h3r_st3g0nogr@phy_89320}