Art - HackTheBox Challenge Writeup

Challenge Information

Description

A minimalist challenge titled “Art” with a single prompt: “Can you find the flag?”

The challenge provides an archive containing a PNG image that serves as both a puzzle and a program. This challenge cleverly combines steganography, archive exploitation, and esoteric language interpretation.

Solution Overview

The challenge involves multiple layers:

1. Archive extraction and decryption using known-plaintext attack
2. PNG analysis to extract embedded code
3. Piet interpreter execution to retrieve the flag

The solution title hints at the art theme—Piet is both an esoteric programming language and a reference to Piet Mondrian, the famous abstract painter.

Key Steps

Step 1: Examine the Challenge Files

cd <workdir>
ls -la
cat description.md

The archive art.zip contains a PNG file that is password-protected.

Step 2: Extract and Analyze the Archive

mkdir -p work && cd work
cp ../a12c7331-ee62-4c80-8e18-6e94ff9eef10 art.zip
unzip -v art.zip
# Listing shows: art.png (password protected)

Step 3: Crack the ZIP Password using bkcrack

The archive uses legacy ZIP encryption (ZipCrypto). A known-plaintext attack can recover the password:

# Generate test files with various compression levels to match the original
for lvl in 1 2 3 4 5 6 7 8 9; do
  rm -f t${lvl}.zip
  7z a -tzip -mx=${lvl} t${lvl}.zip art.png
done

# Run bkcrack with known plaintext
/tmp/bkcrack-1.7.1-Linux/bkcrack -C art.zip -c art.png -p t7.zip -c art.png

# Output reveals the internal keys, allowing password recovery
# Password discovered: newpass

Step 4: Decrypt and Extract the PNG

mkdir -p out_unlocked
cd out_unlocked
unzip -o -P newpass ../art.zip
# Successfully extracts art.png

Step 5: Analyze the PNG File

# Examine PNG structure
binwalk art.png

# Extract PNG chunks and metadata
python3 - <<'EOF'
from PIL import Image
import struct

im = Image.open('art.png')
print(f"Image size: {im.size}")
print(f"Image mode: {im.mode}")

# Save a visualization
im.save('view.png')
EOF

The PNG contains a visual representation—a pattern of colored blocks that forms the code for a Piet program.

Step 6: Extract and Interpret the Piet Code

Piet is an esoteric programming language where programs are represented as images. Color blocks and transitions between them encode instructions.

# Create or obtain a Piet interpreter
pip3 download --no-deps -d /tmp/piet_pkg piet-interpreter

# Create piet.py interpreter implementation
# (The agent adapted an existing Piet interpreter)
python3 piet.py

Step 7: Execute and Capture the Flag

cd <workdir>
timeout 30 python3 piet.py 2>&1

# Output: HTB{REDACTED}

The Piet interpreter processes the colored blocks in the PNG and outputs the flag.

Tools Used

Key Learnings

1. ZipCrypto Vulnerability

Legacy ZIP encryption (ZipCrypto) is cryptographically weak and vulnerable to known-plaintext attacks. The bkcrack tool exploits this by finding internal encryption keys when plaintext of at least 12 bytes can be matched.

2. Piet: Art as Code

Piet is a Turing-complete esoteric language where programs are PNG images. Instructions are encoded by:

• Color blocks representing data
• Transitions between colors representing operations
• Stack operations for computation

This clever design makes the challenge title “Art” doubly meaningful—it’s literally art that is also executable code.

3. Multi-Layer Puzzle Design

The challenge demonstrates layered complexity:

• Cryptography (ZIP encryption)
• Steganography (code hidden in image colors)
• Esoteric languages (Piet interpreter)

Each layer requires different techniques and knowledge domains.

4. Theme Consistency

The reference to Piet Mondrian (abstract painter famous for primary color rectangles) perfectly aligns with the Piet programming language’s visual nature. HTB challenges often embed thematic hints into their design.

Flag

HTB{REDACTED}