Neven Marić
Hidden Investigations CTF 2026

SteganographyHidden Investigations CTF 2026

Roof of Africa

The JPEG hides a file embedded with steghide. The passphrase is Kilimanjaro's height in meters, 5895 ("Africa's highest peak" and "the mountain's most famous number").

  • steganography
  • steghide
  • jpeg
  • passphrase-guessing

What this one teaches

  • Reading the challenge description for semantic clues — 'Africa's highest peak' and 'the mountain's most famous number' both point to 5895.
  • Checking for appended data past the JPEG EOI marker before moving to embedded payloads.

Task description

They say Africa’s highest peak holds ancient secrets in its frozen glaciers. A photograph has been intercepted — but its true meaning is locked away, protected by the mountain’s most famous number.

Can you reach the summit and uncover what lies hidden?

Approach

Identify the passphrase

The description names “Africa’s highest peak” and “the mountain’s most famous number”. That is Mount Kilimanjaro; its height is 5895 m.

Check for appended data

The file ends at the JPEG EOI marker (0xFFD9) with nothing after it, so the hidden content is embedded rather than appended.

Extract with steghide

Ran steghide with the guessed passphrase in a Docker container (steghide is not available natively on Windows):

docker run --rm -e DEBIAN_FRONTEND=noninteractive -v "<files dir>":/w ubuntu:22.04 bash -c \
 'apt-get update -qq && apt-get install -y -qq steghide >/dev/null 2>&1; \
  cd /w && steghide extract -sf roof_of_africa.jpg -p 5895; cat *.txt'

Output: wrote extracted data to "roof_flag_v2.txt". The file contains the flag.

The flagRevealhiCTF{h4kun4_m4t4t4_m34ns_n0_w0rr13s}

This CTF was possibly solved, and the writeup most likely written by an LLM. Apologies for inconsistencies.