Stego 17

by **msbachman** on Sat Jun 05, 2010 3:57 pm ([msg=39566]see Re: Stego 17[/msg])

My main confusion on this stems from the fact that nowhere do I see a need for a password to unpack any file. Is there supposed to be a password?

I have a file that I'm looking at. The person above mentioned the M&Gs, basically I'm at the same point. I'm looking at a long group of data that I'm interested in (won't tell where because that would give too much away). Is this ciphered or what? I'm getting confused by what others have claimed. If there's a password, then all my work at developing an algorithm to reverse a cipher is useless.

Then at some point, I know I'm going to have to use the image, and I have a very good idea of what it is. I'm just a little lost due to what others have claimed, namely, that there's a password somewhere. I used a certain forensic tool to find something in the file without any password being necessary at all. Would that be the reason why what I'm trying to manipulate (M's and G's, per the above statement) appear gibberish?

Well i'm stuck either in this mission... I got those pair of M&G's too but i've no idea what i've to do with it, nor can i manage to find the password protected rar. Any hint about what to do? The slightest advice would be welcome!

by **MSGM** on Thu Jul 22, 2010 12:55 am ([msg=42407]see Re: Stego 17[/msg])

I'm almost sure I know what the password for the rar looks like, but none of my attempts works, I've tried all the possible formats I could think of. Is it in some strange format? Or maybe I've misineterpreted the image?

by **DrakierD** on Thu Jul 22, 2010 9:19 am ([msg=42412]see Re: Stego 17[/msg])

MSGM wrote:I'm almost sure I know what the password for the rar looks like, but none of my attempts works, I've tried all the possible formats I could think of. Is it in some strange format? Or maybe I've misineterpreted the image?

I'm going to point to "misinterpreted the image".

by **MSGM** on Thu Jul 22, 2010 10:59 am ([msg=42426]see Re: Stego 17[/msg])

Got it finally!

I'd just forgotten about the smallest one of them

I still haven't gotten to the password protected rar. I've found the string in the nonprotected archive and I've decoded it once. But it is still encoded somehow. I don't recognize the second encoding format. I'm assuming that after decoding the string the first time, you just focus on the numbers and not the other characters. But I don't understand where to go from here? Could I have a hint on the type of encoding?

Edit: I understand how the numbers are encoded now and I even got part of the header, but I still need to figure out how the rest of it is encoded. This is overly complicated unless I'm missing something.

by **DrakierD** on Sun Aug 01, 2010 7:20 pm ([msg=43105]see Re: Stego 17[/msg])

brucewane87 wrote:... This is overly complicated unless I'm missing something.

It's not OVERLY complicated but it isn't just "in your face" simple either.

Once you figure it out, you'll most likely hit yourself on the head. It looks strange and takes some time to work out, but you'll get it eventually.

I think I understand two of the three encodings. The number one is easy. The one with twos and threes I think I get. Or at least what I tried worked too well to be a coincidence. But there seem to be bytes missing and there seems to be extra bytes (although these may belong to the third grouping). It's the third type of encoding that I don't get. It seems too repetitive to possibly encode anything. There's not enough variation.

Are all three encodings some kind of standard way of encoding, or something thought up by the creator of the stego?

I think I and brucewane are in same situation. I added || to fill missing bits...

by **OnlyHuman** on Sun Dec 26, 2010 1:05 pm ([msg=51171]see Re: Stego 17[/msg])

There's no need to fill in any missing bits. This is all about going through several layers of conversion. The initial data you find will have one type of encoding, which when decoded, will give you general garbage, because it too is encoded differently than you might expect. Once you decode that properly, there's another layer. and so on. But, you will eventually wind up with a very small, password protected, archive. To get in, take a very close look at the provided image. Give it enough time, and the password will eventually stand out as being totally obvious.