PICOCTF 2019 • FORENSICS • AUDIO STEGANOGRAPHY

m00nwalk2: Audio Steganography & SSTV Puzzle Deconstruction

By Abdo•5 min read•PicoCTF 2019
TARGET AUDIOmessage.wav
SSTV CLUESclue[1-3].wav
STEGO UTILITYsteghide 0.5.1
FLAGpicoCTF{the_answer...}
Audio Steganography & SSTV Demodulation
FIGURE 1: Multilayer Steganography in Space TransmissionsSSTV Demodulation & LSB Carving
Official Challenge Prompt

“Re-visit the last scene. More clues, same tunes. The flag is not in the same place.”

● Category: Forensics / Audio Steganography● Platform: PicoCTF 2019● Flag Format: picoCTF{...}

1. Dual-Layer Steganography Architecture

In m00nwalk 1, decoding message.wav with an SSTV decoder directly rendered an image displaying the flag picoCTF{beep_boop_im_in_space}.

In m00nwalk2, we are given four audio files: message.wav, clue1.wav, clue2.wav, and clue3.wav. If we decode message.wav again, it merely presents the identical decoy picture. The real payload is hidden via a dual-layer scheme:

Layer 1 (Macro / Analog Signal): Audio frequency modulation decoded into raster SSTV images (Clues 1, 2, 3).

Layer 2 (Micro / Sample LSBs): Encrypted ciphertext injected into the uncompressed PCM audio bytes of message.wav via steghide.

2. Demodulating the Clues with SSTV

We process each audio clue through the command-line SSTV decoder:

Terminal Command:
sstv -d clue1.wav -o clue1.png
sstv -d clue2.wav -o clue2.png
sstv -d clue3.wav -o clue3.png
CLUE 1: Passphrase
Clue 1: Password hidden_stegosaurus

Shows a stegosaurus note: Password: hidden_stegosaurus.

CLUE 2: Environment
Clue 2: The quieter you are, the more you can hear

Official Kali Linux motto: “The quieter you are, the more you can HEAR”.

CLUE 3: Tool
Clue 3: Alan Eliasen the FutureBoy

Names Alan Eliasen (creator of FutureBoy.us), whose steganography service runs on steghide.

Decoy SSTV image from message.wav
Decoy Verification (result.png)

Decoding message.wav reveals the original decoy image with the m00nwalk 1 flag. This confirms the author's hint: the true flag is embedded elsewhere within the carrier file.

3. Carving Hidden LSB Data with Steghide

Uncompressed 16-bit WAV files store sample amplitudes ranging from -32,768 to +32,767. steghide encrypts the payload with our passphrase (hidden_stegosaurus) and alters the Least Significant Bit (LSB) of pseudo-randomly selected audio samples. This tiny alteration is completely inaudible to humans and invisible to SSTV demodulators.

Linux / Kali CLI:
steghide extract -sf message.wav -p hidden_stegosaurus
cat steganopayload*.txt
Windows PowerShell:
steghide extract -sf message.wav -p hidden_stegosaurus
Get-Content steganopayload*.txt

# steghide execution output

wrote extracted data to "steganopayload12154.txt".

picoCTF{the_answer_lies_hidden_in_plain_sight}

4. Extracted Flag

Decrypted Secret Flag:

picoCTF{the_answer_lies_hidden_in_plain_sight}

5. Summary Matrix

StepObjectiveToolExact CommandKey Finding
1Demodulate Clue 1sstvsstv -d clue1.wav -o clue1.pnghidden_stegosaurus
2Demodulate Clue 2sstvsstv -d clue2.wav -o clue2.pngKali Linux Stego Suite
3Demodulate Clue 3sstvsstv -d clue3.wav -o clue3.pngFutureBoy => steghide
4Carve Payloadsteghidesteghide extract -sf message.wav -p ...steganopayload12154.txt