HackTheBox - Challenge - Steganography - Da Vinci Writeup
---------------------------------------------------------

In this challenge we got three files: monalisa.jpg, Thepassword_is_the_small_name_of_the_actor_named_Hanks.jpg and Plans.jpg.

I started by inspecting monalisa.jpg and then checking it quickly with hexedit, to check that the start and end bits were set properly for the file type:

FF D8 = start of JPG
FF D9 = end of JPG

I found the start and end bits were in place, but I could also see there's data after the eof at 0x0006DF3A-0x0006DF3B:

0F 4A 7B 45  D3 4F AA 43   03 FF D9 50  4B 03 04 14   .J{E.O.C...PK...

FF D9 = EOF JPG and after that 50 4B = PK, which is the start of PKZIP. So it seems the image contains a zip file. Two lines further we can find the name of the zip: famous.zip.
To extract I just needed to change the hex block number to decimal, to skip over the JPG:

echo "obase=10; ibase=16; 0006DF3B" | bc
450363

Then I extracted with dd (you can do it probably easier with binwalk):

dd if=monalisa.jpg bs=1 skip=450363 of=famous.zip

The zip seemed to be protected with a password, so I tried cracking it:

cp /usr/share/wordlists/metasploit/password.lst namelist.txt
fcrackzip -D -p namelist.txt -v famous.zip -u

"found file 'Mona.jpg', (size cp/uc 117776/122869, flags 9, chk af2e)

PASSWORD FOUND!!!!: pw == leonardo"

Apparently you were supposed to extract this from Thepassword_is_the_small_name_of_the_actor_named_Hanks.jpg, which was hidden in the image with steghide using "TOM" as the password. That would've given us an MD5 hash for "leonardo" and by decrypting that you'd get same pass I got with bruteforcing.

Extracted the Mona.jpg and then went on to the second file Plans.jpg.
Again additional bytes at end of file. Dump of additional bytes:

Hex:    68747470733a2f2f 7777772e796f7574 7562652e636f6d2f 77617463683f763d
        6a63314e66783463 354c510a

Which in Ascii translated to https:// www.yout ube.com/ watch?v= jc1Nfx4c 5LQ showing a video called "Guernica 3D".

Then I tried using "Guernica" as the password to extract possible hidden data from Mona.jpg:

steghide --extract -sf Mona.jpg
Enter passphrase: Guernica

This creates a file named key, which looked like base64 and which finally gave me the flag after three rounds of decrypting:

cat key | base64 -d | base64 -d | base64 -d
HTB{M0n@_L1z@_!s_D3@D}