Da Vinci - HackTheBox Challenge Writeup

Challenge Information

Description

This challenge asks you to find a secret hidden inside pictures and learn the truth about Mona Lisa. The initial download contains multiple image files that require careful analysis and extraction techniques to reveal the flag.

Solution Overview

This challenge combines multiple steganography and cryptography techniques layered together. The solution path involves:

1. Extracting a hidden ZIP archive from the main image
2. Cracking password-protected archives with bruteforce
3. Using stegseek to recover hidden steganographic data
4. Decoding multiple layers of base64 encoding

Key Steps

Step 1: Reconnaissance and File Analysis

Start by examining the challenge files:

cd /path/to/challenge
ls -la
unzip -l a12c7398-de4c-4b50-8b69-a244187b

The challenge contains several image files including monalisa.jpg, Plans.jpg, and a cryptic hint image Thepassword_is_the_small_name_of_the_actor_named_Hanks.jpg.

Step 2: Extract the Hint and Identify the Password

The hint image tells us the password is the “small name of the actor named Hanks.” Tom Hanks’ nickname is TOM, but the actual password is discovered through bruteforce attempts.

# Test steghide extraction on hint image
steghide extract -sf Thepassword_is_the_small_name_of_the_actor_named_Hanks.jpg

Step 3: Extract Hidden ZIP from Main Image

The monalisa.jpg file contains an embedded ZIP archive:

# Copy and extract the image
cp monalisa.jpg /tmp/monaex/
cd /tmp/monaex/

# Extract the embedded ZIP
unzip -o monalisa.jpg
unzip -l famous.zip

Step 4: Crack the Password-Protected Archive

Use 7z with bruteforce attempts. After testing various Leonardo da Vinci-related keywords:

# Create wordlist with related terms
cat > wordlist.txt << 'EOF'
leonardo
davinci
DaVinci
monalisa
MonaLisa
florence
italy
tom
TOM
hanks
EOF

# Extract using 7z with password
7z x -p"leonardo" -y -o/tmp/monaex/final famous.zip

The password is leonardo. This extracts Mona.jpg.

Step 5: Extract Steganographic Data with StegSeek

Use StegSeek to find and extract hidden data from the extracted image:

cd /tmp/monaex/final

# StegSeek bruteforce with wordlist
stegseek Mona.jpg /path/to/wordlist.txt

Output:

[i] Found passphrase: "Guernica"
[i] Original filename: "key".
[i] Extracting to "Mona.jpg.out".

Step 6: Decode Multiple Layers of Base64

The extracted file contains base64-encoded data with multiple layers:

# Read the extracted file
cat Mona.jpg.out
# Output: VTBaU1EyVXdNSGRpYTBKbVZFUkdObEZHT0doak1UbEZUVEJDUldaUlBUMD0=

# Decode layer 1
echo "VTBaU1EyVXdNSGRpYTBKbVZFUkdObEZHT0doak1UbEZUVEJDUldaUlBUMD0=" | base64 -d
# Output: U0ZSQ2UwMHdia0JmVERGNlFGOGhjMTlFTTBCRWZRPT0=

# Decode layer 2
echo "U0ZSQ2UwMHdia0JmVERGNlFGOGhjMTlFTTBCRWZRPT0=" | base64 -d
# Output: SFRCe00wbkBfTDF6QF8hc19EM0@EfQ==

# Decode layer 3
echo "SFRCe00wbkBfTDF6QF8hc19EM0BEfQ==" | base64 -d
# Output: HTB{REDACTED}

Automated decoding loop:

D=$(cat Mona.jpg.out)
for i in 1 2 3 4 5; do
    D=$(echo "$D" | base64 -d 2>/dev/null)
    echo "layer $i: $D"
done

Tools Used

• unzip - Extract and list ZIP archives
• 7z - Extract password-protected archives with bruteforce capability
• stegseek - Fast steganography detection and extraction from JPEG files
• base64 - Decode base64-encoded data
• exiftool - Examine image metadata
• binwalk - Analyze binary files for embedded data

Key Learnings

1. Layered Steganography: This challenge demonstrates how steganographic hiding techniques can be stacked—a ZIP within an image, within an archive, with multiple encoding layers.

2. Password Hints: Thematic hints (Mona Lisa, da Vinci, Guernica, Leonardo) point to art history knowledge. The password “leonardo” references Leonardo da Vinci, the artist of the Mona Lisa.

3. StegSeek is Efficient: StegSeek’s bruteforce capability significantly outperforms manual steghide attempts and is essential for time-efficient CTF challenges.

4. Multiple Encoding Layers: Base64 encoding applied repeatedly requires iterative decoding. Writing a loop to automatically decode multiple layers saves time and errors.

5. File Analysis Flow: Proper reconnaissance (checking file types, examining images) before attempting extraction prevents wasted effort and guides the solution path.

Flag

HTB{REDACTED}