SteganographyHidden Investigations CTF 2026
Roof of Africa
The JPEG hides a file embedded with steghide. The passphrase is Kilimanjaro's height in meters, 5895 ("Africa's highest peak" and "the mountain's most famous number").
What this one teaches
- Reading the challenge description for semantic clues — 'Africa's highest peak' and 'the mountain's most famous number' both point to 5895.
- Checking for appended data past the JPEG EOI marker before moving to embedded payloads.
Task description
They say Africa’s highest peak holds ancient secrets in its frozen glaciers. A photograph has been intercepted — but its true meaning is locked away, protected by the mountain’s most famous number.
Can you reach the summit and uncover what lies hidden?
Approach
Identify the passphrase
The description names “Africa’s highest peak” and “the mountain’s most famous number”. That is Mount Kilimanjaro; its height is 5895 m.
Check for appended data
The file ends at the JPEG EOI marker (0xFFD9) with nothing after it, so the hidden content is embedded rather than appended.
Extract with steghide
Ran steghide with the guessed passphrase in a Docker container (steghide is not available natively on Windows):
docker run --rm -e DEBIAN_FRONTEND=noninteractive -v "<files dir>":/w ubuntu:22.04 bash -c \
'apt-get update -qq && apt-get install -y -qq steghide >/dev/null 2>&1; \
cd /w && steghide extract -sf roof_of_africa.jpg -p 5895; cat *.txt'
Output: wrote extracted data to "roof_flag_v2.txt". The file contains the flag.
The flagReveal
hiCTF{h4kun4_m4t4t4_m34ns_n0_w0rr13s}This CTF was possibly solved, and the writeup most likely written by an LLM. Apologies for inconsistencies.