In this stego challenge with the following description:```One of my friends like to hide data in images.Help me to find out the secret in image.```
We were given a .jpg file:![stego](https://raw.githubusercontent.com/pwnsticciotti/writeups/master/hackcon/small_icon_much_wow/stego.jpg)
So the first thing to do is look for exif data:```$ exiftool stego.jpgExifTool Version Number         : 11.50File Name                       : stego.jpgDirectory                       : .File Size                       : 47 kBFile Modification Date/Time     : 2019:08:22 23:00:54+02:00File Access Date/Time           : 2019:08:22 23:01:18+02:00File Inode Change Date/Time     : 2019:08:22 23:01:12+02:00File Permissions                : rw-r--r--File Type                       : JPEGFile Type Extension             : jpgMIME Type                       : image/jpegJFIF Version                    : 1.01Exif Byte Order                 : Big-endian (Motorola, MM)X Resolution                    : 1Y Resolution                    : 1Resolution Unit                 : NoneY Cb Cr Positioning             : CenteredCompression                     : JPEG (old-style)Thumbnail Offset                : 202Thumbnail Length                : 13391Comment                         : Compressed by jpeg-recompressImage Width                     : 1116Image Height                    : 102Encoding Process                : Progressive DCT, Huffman codingBits Per Sample                 : 8Color Components                : 3Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)Image Size                      : 1116x102Megapixels                      : 0.114Thumbnail Image                 : (Binary data 13391 bytes, use -b option to extract)```
Nothing here, let's move on looking for eventual appended files:```$ binwalk stego.jpg
DECIMAL       HEXADECIMAL     DESCRIPTION--------------------------------------------------------------------------------0             0x0             JPEG image data, JFIF standard 1.0130            0x1E            TIFF image data, big-endian, offset of first image directory: 8202           0xCA            JPEG image data, JFIF standard 1.01```
Bingo! We have found one more jpeg appended at the end of the first one, let's try to extract it:
```$ binwalk -e stego.jpg```
Binwalk seems not to work. Let's try to extract it with dd:
```dd if=stego.jpg of=2.jpeg ibs=1 skip=20247597+0 records in92+1 records out47597 bytes (48 kB, 46 KiB) copied, 0.0625076 s, 761 kB/s```
and the result is:
![qr_code](https://raw.githubusercontent.com/pwnsticciotti/writeups/master/hackcon/small_icon_much_wow/2.jpeg)
Let's decode it with a simple python script:
```python#!/usr/bin/python
from pyzbar.pyzbar import decodefrom PIL import Imageimport sys
print(decode(Image.open(sys.argv[1]))[0].data.decode('utf8'))```
```bash./decoder.py 2.jpegd4rk{flAg_h1dd3n_1n_th3_thumbnail}c0de```