![](https://gitlab.com/newyork167/ctf/-/raw/main/2022/SDCTF/Forensics/Susan%20Album%20Party/info.png)
We are given a stub of a binary blob. Running `file` we get:
```original/stub: JPEG image data, progressive, precision 8, 240x320, components 3```
So it's a jpeg! Let's give it a better filename and see what's inside.
![](https://gitlab.com/newyork167/ctf/-/raw/main/2022/SDCTF/Forensics/Susan%20Album%20Party/stub.jpeg)
So, we see the first part of the flag! Initially I ran through `stegsolve`, `foremost`, and `binwalk` and didn't really get anything out of any of them. So, looking again at the first part of the flag I decided to see how many instances of `\xff\xd8` are in the stub file.
```xxd -p stub.jpeg | tr " " "\n" | grep -c "ffd8"4```
So we can see there are at most 4 jpeg files embedded in this one. So I whipped up python script to extract them out and dump them to their own jpeg files. 
```pythonimport binascii
def write_jpg(i, image):    try:        with open(f'{i}.jpg', 'wb+') as jpeg_file:            jpeg_file.write(binascii.unhexlify(image))    except Exception as ex:        print(f"Could not write {i}: {ex}")
my_file = "stub.jpeg"with open(my_file, 'rb') as file_t:    blob_data = binascii.hexlify(file_t.read())    images = [b'ffd8' + x for x in blob_data.split(b'ffd8')][1:]
    for i, image in enumerate(images):        if len(image) % 2 != 0:            image += b'0'        write_jpg(i, image)```
The final files are:
![](https://gitlab.com/newyork167/ctf/-/raw/main/2022/SDCTF/Forensics/Susan%20Album%20Party/0.jpg)
![](https://gitlab.com/newyork167/ctf/-/raw/main/2022/SDCTF/Forensics/Susan%20Album%20Party/1.jpg)
![](https://gitlab.com/newyork167/ctf/-/raw/main/2022/SDCTF/Forensics/Susan%20Album%20Party/2.jpg)
and I'm guessing just a jibberish file for `3.jpg`.
`Flag: sdctf{FFD8_th3n_S0ME_s7uff_FFD9}`