サムネイル画像・検出および抽出方法

justCTF 2019のwriteup

Matryoshka (157 pts)

Look at this picture. Can you get the flag?

ctftime.org

jpg画像が与えられます。

thumbnail画像チェック：

root@fang:/mnt/hgfs/vmshare/ctf/justctf2019/misc# exiftool matryoshka.jpg
ExifTool Version Number         : 11.79
File Name                       : matryoshka.jpg
Directory                       : .
File Size                       : 571 kB
File Modification Date/Time     : 2019:12:23 22:28:07+09:00
File Access Date/Time           : 2019:12:23 22:39:07+09:00
File Inode Change Date/Time     : 2019:12:23 22:28:07+09:00
File Permissions                : rwxrwxrwx
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
JFIF Version                    : 1.01
Warning                         : [minor] File contains multi-segment EXIF
Exif Byte Order                 : Little-endian (Intel, II)
X Resolution                    : 72
Y Resolution                    : 72
Resolution Unit                 : inches
Software                        : GIMP 2.10.14
Modify Date                     : 2019:12:13 20:22:50
Color Space                     : sRGB
Compression                     : JPEG (old-style)
Photometric Interpretation      : YCbCr
Samples Per Pixel               : 3
Thumbnail Offset                : 292
Thumbnail Length                : 453442
Profile CMM Type                : Little CMS
Profile Version                 : 4.3.0
Profile Class                   : Display Device Profile
Color Space Data                : RGB
Profile Connection Space        : XYZ
Profile Date Time               : 2019:12:13 19:20:34
Profile File Signature          : acsp
Primary Platform                : Apple Computer Inc.
CMM Flags                       : Not Embedded, Independent
Device Manufacturer             : 
Device Model                    : 
Device Attributes               : Reflective, Glossy, Positive, Color
Rendering Intent                : Perceptual
Connection Space Illuminant     : 0.9642 1 0.82491
Profile Creator                 : Little CMS
Profile ID                      : 0
Profile Description             : GIMP built-in sRGB
Profile Copyright               : Public Domain
Media White Point               : 0.9642 1 0.82491
Chromatic Adaptation            : 1.04788 0.02292 -0.05022 0.02959 0.99048 -0.01707 -0.00925 0.01508 0.75168
Red Matrix Column               : 0.43604 0.22249 0.01392
Blue Matrix Column              : 0.14305 0.06061 0.71393
Green Matrix Column             : 0.38512 0.7169 0.09706
Red Tone Reproduction Curve     : (Binary data 32 bytes, use -b option to extract)
Green Tone Reproduction Curve   : (Binary data 32 bytes, use -b option to extract)
Blue Tone Reproduction Curve    : (Binary data 32 bytes, use -b option to extract)
Chromaticity Channels           : 3
Chromaticity Colorant           : Unknown (0)
Chromaticity Channel 1          : 0.64 0.33002
Chromaticity Channel 2          : 0.3 0.60001
Chromaticity Channel 3          : 0.15001 0.06
Device Mfg Desc                 : GIMP
Device Model Desc               : sRGB
Image Width                     : 1200
Image Height                    : 567
Encoding Process                : Progressive DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:4:4 (1 1)
Image Size                      : 1200x567
Megapixels                      : 0.680
Thumbnail Image                 : (Binary data 453442 bytes, use -b option to extract)

一番下にThumbnail Imageの情報が書かれています。453442 bytesのバイナリデータで、-bオプションで抽出できると丁寧に書いています笑

サムネイル画像抽出：

exiftool -b -ThumbnailImage matryoshka.jpg > thumbnail.jpg

thumbnail.jpgを開く：

繰り返しサムネイル画像を抽出すると：

justCTF{d1d_y0u_kn0w_7h47_f1r57_m47ry05hk4_d0ll_w45_m4d3_129_y34r5_4g0}