UniVsThreats 26 Quals CTF - Where is everything? - Steganography Writeup

Category: Steganography

Flag: UVT{N0th1nG_iS_3mp7y_1n_sP4c3}

Challenge Description#

HTTP 404: Everything Not Found

Analysis#

I started with basic archive triage to see whether the challenge was truly “empty” or just layered. The ZIP held three files: a PNG, a whitespace-heavy TXT, and a JS artifact, which immediately suggested a multi-stage stego chain rather than a single hidden string.

1
file "empty.zip"
2
7z l "empty.zip"

1
empty.zip: Zip archive data, made by v2.0 UNIX, extract using at least v2.0, ...
2

3
Listing archive: empty.zip
4
...
5
2026-02-27 01:16:51 .....         1486          779  empty.png
6
2026-02-27 01:16:51 .....         8700         1024  empty.txt
7
2026-02-27 01:16:51 .....        24126         2529  empty.js
8
...

The JS file looked like mostly decoy text, but it contained a giant VOID_PAYLOAD string made of zero-width characters. Decoding just U+200B/U+200C as bits gave an actual ZIP stream with PK\x03\x04 magic, so that was the first real pivot point.

1
import re
2
from pathlib import Path
3

4
js = Path("empty_work/empty.js").read_text("utf-8", errors="ignore")
5
p = re.search(r"VOID_PAYLOAD\\s*=\\s*`(.*?)`\\s*;", js, re.S).group(1)
6
zw = [c for c in p if c in "\\u200b\\u200c"]
7
bits = "".join("0" if c == "\\u200b" else "1" for c in zw)
8
out = bytes(int(bits[i:i+8], 2) for i in range(0, len(bits) - 7, 8))
9

10
print("zero_width_chars", len(zw))
11
print("decoded_len", len(out))
12
print("magic", out[:4])

1
zero_width_chars 7664
2
decoded_len 958
3
magic b'PK\x03\x04'

Once that hidden ZIP was carved, listing it showed a single encrypted flag.png using AES-256 Deflate, so the remaining problem was password recovery.

1
7z l -slt "empty_work/decoded/map_200b0_200c1.bin"

1
Path = empty_work/decoded/map_200b0_200c1.bin
2
Type = zip
3
Physical Size = 958
4

5
Path = flag.png
6
Size = 8237
7
Packed Size = 786
8
Encrypted = +
9
Method = AES-256 Deflate
10
Characteristics = NTFS WzAES : Encrypt

The whitespace document was not junk either. Decoding each line as 8 bits (space=0, tab=1) revealed operator notes explicitly hinting that the signal lives in blue-channel faint bits and must be sampled with an every-third cadence.

1
from pathlib import Path
2

3
raw = Path("empty_work/empty.txt").read_bytes().splitlines()
4
out = []
5
for ln in raw:
6
    ws = [b for b in ln if b in (0x20, 0x09)]
7
    if len(ws) == 8:
8
        bits = "".join("0" if b == 0x20 else "1" for b in ws)
9
        out.append(int(bits, 2))
10

11
text = bytes(out).decode("utf-8", "replace")
12
for i, line in enumerate(text.splitlines(), 1):
13
    if any(k in line for k in ["CAPTAIN", "faintest", "blue starlight", "every third heartbeat", "void is hiding"]):
14
        print(f"{i}:{line}")

1
6:CAPTAIN'S NOTE
2
9:The real clue is in the faintest part of the signal, not the color you see,
3
12:We only saw it when sampling the blue starlight... and not at every point.
4
13:A pattern. A cadence. Like taking every third heartbeat along the grid.
5
15:Once you recover the whisper from the image, it opens what the void is hiding.

That clue matched the image perfectly: pulling blue LSB bits with the row-wise cadence row0 x=0::3, row1 x=2::3, row2 x=1::3 produced a short plaintext containing the ZIP password.

1
from PIL import Image
2
import numpy as np
3

4
img = np.array(Image.open("empty_work/empty.png").convert("RGB"))
5
b = img[:, :, 2] & 1
6
seq = np.concatenate([b[0, 0::3], b[1, 2::3], b[2, 1::3]])
7
msg = bytes(int("".join(str(int(x)) for x in seq[i:i+8]), 2) for i in range(0, 256, 8))
8
print(msg.decode("latin1"))

1
\x00\x1dZIP_PASSWORD=D4rKm47T3rrr;END\xff

After stripping framing bytes, the password D4rKm47T3rrr decrypted the hidden archive cleanly and flag.png contained the literal flag string.

1
7z x -y -p"D4rKm47T3rrr" "empty_work/decoded/map_200b0_200c1.bin" -o"empty_work/final"

1
Extracting archive: empty_work/decoded/map_200b0_200c1.bin
2
...
3
Everything is Ok

1
strings -a "empty_work/final/flag.png" | rg -o 'UVT\{[^}]+\}'

1
UVT{N0th1nG_iS_3mp7y_1n_sP4c3}

The satisfying part here was how each artifact carried one precise clue for the next layer: zero-width payload to hidden ZIP, whitespace note to cadence rule, cadence rule to password, then final extraction.

dance

Solution#

1
# !/usr/bin/env python3.12
2
import re
3
import subprocess
4
from pathlib import Path
5

6
import numpy as np
7
from PIL import Image
8

9
def decode_void_zip(js_path: Path, out_zip: Path) -> None:
10
    js = js_path.read_text("utf-8", errors="ignore")
11
    payload = re.search(r"VOID_PAYLOAD\s*=\s*`(.*?)`\s*;", js, re.S).group(1)
12
    zw = [c for c in payload if c in ("\u200b", "\u200c")]
13
    bits = "".join("0" if c == "\u200b" else "1" for c in zw)
14
    raw = bytes(int(bits[i:i + 8], 2) for i in range(0, len(bits) - 7, 8))
15
    out_zip.write_bytes(raw)
16

17
def recover_password_from_blue_lsb(png_path: Path) -> str:
18
    img = np.array(Image.open(png_path).convert("RGB"))
19
    b = img[:, :, 2] & 1
20
    seq = np.concatenate([b[0, 0::3], b[1, 2::3], b[2, 1::3]])
21
    msg = bytes(int("".join(str(int(x)) for x in seq[i:i + 8]), 2) for i in range(0, 256, 8)).decode("latin1")
22

23
    m = re.search(r"ZIP_PASSWORD=([^;]+);", msg)
24
    if not m:
25
        raise RuntimeError("password marker not found")
26
    return m.group(1)
27

28
def main() -> None:
29
    work = Path("empty_work")
30
    decoded_zip = work / "decoded" / "map_200b0_200c1.bin"
31
    decoded_zip.parent.mkdir(parents=True, exist_ok=True)
32

33
    decode_void_zip(work / "empty.js", decoded_zip)
34
    password = recover_password_from_blue_lsb(work / "empty.png")
35

36
    final_dir = work / "final"
37
    final_dir.mkdir(parents=True, exist_ok=True)
38
    subprocess.run(
39
        [
40
            "7z",
41
            "x",
42
            "-y",
43
            f"-p{password}",
44
            str(decoded_zip),
45
            f"-o{final_dir}",
46
        ],
47
        check=True,
48
    )
49

50
    out = subprocess.check_output(
51
        "strings -a empty_work/final/flag.png | rg -o 'UVT\\{[^}]+\\}'",
52
        shell=True,
53
        text=True,
54
    ).strip()
55
    print(out)
56

57
if __name__ == "__main__":
58
    main()

1
python3.12 solve.py

1
UVT{N0th1nG_iS_3mp7y_1n_sP4c3}