Rating:

# CTF Challenge Writeup: Mah Eyes are RED

## Challenge Information

- Name: Mah Eyes are RED
- Category: Stegonography

## Challenge Analysis

A picture is given and the challenge name seems to have something to do with it...

![img/MahEyesareRed-1.png](img/MahEyesareRed-1.png)

The title of the challenge includes a capitalized word 'RED', this gives us a slight hint that something might be hidden on the 'Red plane' of the image.

## Solution

### Step 1: Analyze the file

We can use the **Stegsolve v1.3** by Caesum to analyze the file. During this proces we see that 'Red plane 0' contains some sort of cipher:

![img/MahEyesareRed-2.png](img/MahEyesareRed-2.png)

### Step 2: Decoding the symbols

After some intense searching, I've found an interesting cipher called the **Cistercian Numerals**:

![img/MahEyesareRed-3.png](img/MahEyesareRed-3.png)

The symbols present us with the following numbers:

```
107 104 105 108 97 100 115
```

### Step 3: Decoding the numbers

I used python to decode this information:

```
python3 -c "print(chr(107) + chr(104) + chr(105) + chr(108) + chr(97) + chr(100) + chr(115))"
```

![img/MahEyesareRed-4.png](img/MahEyesareRed-4.png)

### Step 4: Using the key

After a failing at decoding the image with the key, I've tested multiple different mutations of the key.
Instead of 'khilads' I needed to use 'khiladi' with dynamic settings to extract a new image:

![img/MahEyesareRed-5.png](img/MahEyesareRed-5.png)

## Flag

`ICTF{Gr33n_Pl4nt_G0_Brrrr}`

## Resources

- Tool: [Stegsolve v1.3](http://www.caesum.com/handbook/Stegsolve.jar)
- Reference: [Cistercian numerals](https://en.wikipedia.org/wiki/Cistercian_numerals)

## Writeup Author

- Twitter: [@Cyber8RU7U5](https://twitter.com/Cyber8RU7U5)

Original writeup (https://github.com/Cyber8RU7U5/Writeups/blob/main/CTFs/Incognito%202.0/Mah_Eyes_are_RED.md).