Writeup Metadata

Overview

I completed this challenge during Hack4Gov 2023. The challenge provides an image inside a RAR archive and asks us to find the hidden messages within it.

Since the challenge is named Metadata 1 & 2, the first assumption is that the flags are hidden somewhere in the image’s metadata. The goal is to find the two (2) hidden flags.

Artifacts

• IMG_9623.rar

If you already guessed that this image is Mt. Tapyas then good for you. If I knew during the CTF, I wouldn’t have had to locate the second flag. If you want to try the challenge, download the image in my GitHub repository rather than directly downloading this image since Astro optimizes uploaded images and converts them to webp.

Tools

• ExifTool — used to extract and examine the image’s metadata.
• Hexadecimal decoder — used to convert the hexadecimal value into plain text.
• Google Maps — used to identify the location represented by the coordinates.

Approach

First, I extracted the image from the IMG_9623.rar archive.

I then used ExifTool to examine the image’s metadata using the command: exiftool [path/to/image]

exiftool IMG_9623.jpg

Flag #1

While examining the output, I noticed that the Author field contained a hexadecimal value.

Since hexadecimal data can represent text, I decoded the value from hexadecimal into plain text using a hexadecimal decoder.

This revealed the first flag — H4G{y0u_d!d_4_gr34t_j0b}

Flag #2

After finding the first flag, I initially had difficulty locating the second one. I re-read the challenge description and noticed that the second challenge was related to finding the location where the image was taken.

I went through the ExifTool output again and noticed the Description field. The value appeared to contain a pair of coordinates representing latitude and longitude.

I searched these coordinates using Google Maps and found that they pointed to Mount Tapyas in Palawan.

This revealed the second flag: H4G{mount tapyas}

Lessons Learned

• Always inspect metadata first. Images can contain useful information such as author names, comments, descriptions, coordinates, and other EXIF fields.
• Pay attention to unusual values. The hexadecimal string in the Author field was a clue that the value was encoded rather than plain text.
• Read the challenge description carefully. The second flag required finding the image’s location, which helped narrow down what to look for in the metadata.
• Know your basic tools. ExifTool can quickly reveal a large amount of metadata and is a useful first step when investigating image-based CTF challenges.

Flags

• Flag #1: H4G{y0u_d!d_4_gr34t_j0b}
• Flag #2: H4G{mount tapyas}