6

I am testing my steganography skills on www.root-me.org. I downloaded a challenge. Here is the challenge image file. I used binwalk and it showed me the following:

root@kst-Inspiron-5458:/home/kst/Desktop# binwalk ch1.png 

DECIMAL       HEXADECIMAL     DESCRIPTION
-------------------------------------------------------------------------------- 
0             0x0             PNG image, 912 x 602, 8-bit/color RGBA, non-interlaced 128           
128           0x80            Zlib compressed data, best compression

So, I extracted it:

root@kst-Inspiron-5458:/home/kst/Desktop# binwalk -d ch1.png -C /

And I got two file which are named as 80 and 80.zlib. What should I do with these files? Is my method right?

Anders
  • 64,406
  • 24
  • 178
  • 215
kst
  • 131
  • 1
  • 2
  • 4

1 Answers1

6

Discard those files and keep searching.

All that binwalk has discovered here is that PNG images contain a zlib-encoded stream. This is normal -- PNG uses zlib to compress the image stream. The extracted files are the zlib stream and the decompressed image data, which are probably not helpful.

(Interestingly, the image appears to contain some JPEG artifacts. Are you sure you haven't inadvertently converted it from another format?)