HackTheBox - Challenge - Steganography - BitsNBytes Writeup
-----------------------------------------------------------

So we have the image from the email and the original image.

Started by using stegsolve to compare the two images, saved the SUB.

On the left side you can see some pixel sized dots and dashes, inversed the colors to make them easier to read.

Dots and dashes seemed to be base16 bytes, every 1 is a black pixel and 0 is white (bits n bytes). It comes together as:

01010011 01000110 01010010 01000011 01100101 011111010 01000110 01101101 
01011000 00110010 01000110 01100110 01100100 01111010  01000001 01110111 
01011010 01000110 00111001 01101010 01100001 01001000  01010110 01101010 
01100001 00110001 00111001 01101010 01001101 01001000  01010110 01110011 
01011010 01000110 00111001 01101010 01100001 01001000  01010110 01101010 
01100001 00110001 00111001 00110011 01001101 01000100  01000010 01101011 
01100110 01010001 00111101 00111101

Decoded with bash:

array=(01010011 01000110 01010010 01000011 01100101 011111010 01000110 01101101 01011000 00110010 01000110 01100110 01100100 01111010 01000001 01110111 01011010 01000110 00111001 01101010 01100001 01001000 01010110 01101010 01100001 00110001 00111001 01101010 01001101 01001000 01010110 01110011 01011010 01000110 00111001 01101010 01100001 01001000 01010110 01101010 01100001 00110001 00111001 00110011 01001101 01000100 01000010 01101011 01100110 01010001 00111101 00111101)

for i in ${array[*]}
do
 temp=$(echo "obase=16;ibase=2;$i" |bc)
 printf $temp
done

Decodes to:

53465243657A466D58324666647A41775A46396A6148566A6131396A4D4856735A46396A6148566A613139334D44426B66513D3D

Which is hex for:

SFRCezFmX2FfdzAwZF9jaHVja19jMHVsZF9jaHVja193MDBkfQ==

Which is b64 for:

HTB{1f_a_w00d_chuck_c0uld_chuck_w00d}