Digital Forensics Investigation Report (DFIR)

Case: Scan Surprise – picoCTF
Author: Jeffery John
Date: August 23, 2025
Investigator: Abdelwahab Shandy

1) Identification

Description:
In CTF challenges, flags are usually delivered as plain text. However, in this challenge the flag was embedded inside an image (PNG).

Indicators of Compromise (IOCs):

File: flag.png (350 bytes).
File type: PNG – dimensions 99x99 – colormap 1-bit.
Media: Available via challenge.zip and also through SSH.

SSH server fingerprint:

  atlas.picoctf.net:52728
  Fingerprint: SHA256:QF0l+8x0mwmM2QvewTSPdDEvkELbQihq9zN4rUKog8k

Technical Goal:
Determine whether the image contains a hidden flag (QR code) or encrypted data.

2) Acquisition

Actions:

Downloaded the challenge archive:

  wget https://artifacts.picoctf.net/c_atlas/13/challenge.zip

  unzip challenge.zip

Extracted files revealed the path:
```
  home/ctf-player/drop-in/flag.png
```
The file size (350 bytes) was suspiciously small, suggesting it was not a regular image but likely a QR code.

Rationale:
Obtaining a local copy of the evidence (flag.png) avoids reliance on the server and allows repeated offline analysis.

3) Preservation

Preservation Measures:

Used file, stat, and exiftool commands to inspect metadata without modifying the file.
No changes were made to file permissions or content of flag.png.
Created a secondary copy (ScanSurprise.png) for working analysis.

Rationale:
Ensuring the integrity of the digital evidence while enabling safe testing on a duplicate.

4) Analysis

Tools Used:

Exif / Exiftool: No hidden metadata found (no EXIF).
file: Confirmed PNG format (99x99, 1-bit).
zbarimg: Used to scan for QR codes.

Verification via SSH:

ssh -p 52728 ctf-player@atlas.picoctf.net

zbarimg flag.png

Output:

QR-Code:picoCTF{p33k_@_b00_d4ca652e}

Verification Locally (after installing zbar-tools):

sudo apt install zbar-tools

zbarimg flag.png

Output:

QR-Code:picoCTF{p33k_@_b00_d4ca652e}

Analysis:

The flag was hidden inside a QR code, not in text, metadata, or steganography.
Only zbarimg was able to accurately extract the content.
Attempts using exif or manual inspection did not reveal the flag because it required a QR scan.

5) Reporting

Final Result:

Extracted flag:
```
  picoCTF{p33k_@_b00_d4ca652e}
```
flag.png contained a hidden QR code image (99x99).
Results were verified both locally and on the challenge server.

Lessons Learned:

Verify formats: Small image size and dimensions can indicate QR/barcode.
Use the right tool: EXIF tools failed, but zbarimg succeeded immediately.
Preserve first: Creating a duplicate (ScanSurprise.png) protected the original evidence.
Cross-validation: Testing locally and remotely confirmed consistent results.

Appendix A – Key Commands

wget https://artifacts.picoctf.net/c_atlas/13/challenge.zip

unzip challenge.zip

file flag.png

exiftool flag.png

zbarimg flag.png

Appendix B – Extracted Flag

picoCTF{p33k_@_b00_d4ca652e}

💬 "Control the code, and you control the world." 🔐 From wiping metadata to gaining root access — every step is documented and my goal is to deeply understand the system, not just hack!

Abdelwahab Shandy

Linkedin

GitHub

See You Soon

AS Cyber “)).

Scan Surprise : picoCTF