The game is afoot

Olivia posted the Olivia++ IC on Geehack with the text in the screenshot set to black. I happened to be using the Tapatalk app on my phone and it doesn’t care about text color properties and so it was immediately visible.

The important bit is this string

dmhoZGc6Ly93YXVpZi5xY2Evby9sTFpFR3ZZ

If you run that string through a Base64 decoder you get: vhhdg://wauif.qca/o/lLZEGvY

Immediately this is recognizable as a URL but it’s clearly encrypted. It appears to be fairly simple but I wasn’t familiar with the pattern so I started trying to line up what I could clearly make out like so:

vhhdg://wauif.qca/o/lLZEGvY https://_ _ _ _ _.com/ abcdefghijklmnopqrstuvwxyz m op st c h

You can see the pattern pretty quickly here and I later found out it’s called ROT12 or “Rotate by 12 places”

Once solved, we get the decrypted URL:

https://imgur.com/a/xXLQShK

This Imgur album has a single image with another Base64 string caption V2UgbXVzdCBnbyBkZWVwZXIuLi4= that decodes to “We must go deeper…”

The image itself is this PNG



Here’s where things get more interesting…

Steganography

That’s a term I hadn’t heard before but after googling phrases like “hidden message in image” I came across it and a number of tools available that can help extract information. One of those tools is Zsteg. I saw it in passing on a list of commonly used tools for Steganography but it wasn’t until user lemongrassii mentioned using it that I figured it was worth a shot.

After installing Zsteg, you can run it on an image with the -a flag to check all known methods of steganography. It’s run like so:

$ zsteg -a image.png

This gives us something interesting:

b2,rgb,lsb,yx .. zlib: data="IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj\r

IyMjIyMjIyMjIyMjIyMjIy...", offset=59, size=1505

breaking this down

b2,rgb,lsb,yx means 2 bits across the R, G, and B channels, where the least significant BIT comes first and in the yx order.

the concept behind LSB or least significant bit steganography is that you can change the last few bits of pixel data without corrupting the image and this allows for data to be hidden within images without much integrity loss.

In this case, the last two bits are used across all of the color channels.

The next thing we see is zlib: data="IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj\r

IyMjIyMjIyMjIyMjIyMjIy..." . This looked promising and on further investigation zlib is a compression library. I stumbled upon this tool CyberChef when searching for ways to extract the data which will come in handy in a moment.

The last bit of important information is: offset=59 which tells us how far this data is offset from the start of the file.

Next we run the following:

$ zsteg image.png -E b2,rgb,lsb,yx -l 0 > olivia

This extracts the data based on the steganography pattern specified and puts it into a file. So far it’s unusable because it hasn’t been inflated with Zlib yet.

I took the file and loaded it into CyberChef which very handily has an option to inflate data using Zlib and to specify an offset which we know is 59.

After doing this we get the string:

IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMKIyMjIyMjIyMgICAgICAgICAgICAgICMjICAgICAgICAjIyAgICAgICMj IyMgICMjICAjIyAgICAgICAgICAgICAgIyMjIyMjIyMKIyMjIyMjIyMgICMjIyMjIyMjIyMgICMj IyMjIyMjICAgICAgICAgICMjICAjIyAgIyMjIyAgIyMjIyMjIyMjIyAgIyMjIyMjIyMKIyMjIyMj IyMgICMjICAgICAgIyMgICMjIyMgICMjICAjIyAgICAjIyMjIyMgICMjICAjIyAgIyMgICAgICAj IyAgIyMjIyMjIyMKIyMjIyMjIyMgICMjICAgICAgIyMgICMjIyMjIyAgICAjIyMjICAgICAgICAj IyAgICAjIyAgIyMgICAgICAjIyAgIyMjIyMjIyMKIyMjIyMjIyMgICMjICAgICAgIyMgICMjIyMj IyAgICAgICAgIyMgICMjICAgICAgIyMjIyAgIyMgICAgICAjIyAgIyMjIyMjIyMKIyMjIyMjIyMg ICMjIyMjIyMjIyMgICMjIyMgICMjICAjIyAgICAjIyAgIyMgICMjIyMjIyAgIyMjIyMjIyMjIyAg IyMjIyMjIyMKIyMjIyMjIyMgICAgICAgICAgICAgICMjICAjIyAgIyMgICMjICAjIyAgIyMgICMj ICAjIyAgICAgICAgICAgICAgIyMjIyMjIyMKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjICAgICMj IyMgICMjICAjIyAgIyMjIyAgIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyMjIyMjIyMgICAg IyMgICAgIyMgICMjIyMgICMjIyMgICAgICAgICAgICAjIyAgICAjIyAgIyMjIyMjIyMjIyAgIyMj IyMjIyMKIyMjIyMjIyMjIyMjICAgICAgIyMjIyAgIyMjIyAgIyMjIyMjICAgICAgICAgICAgIyMg ICMjICAgICMjICAgICMjIyMjIyMjIyMKIyMjIyMjIyMjIyMjIyMgICMjIyMgICMjICAgICMjIyMg ICMjICAgICMjIyMjIyMjICAjIyMjICAjIyMjICAjIyMjIyMjIyMjIyMKIyMjIyMjIyMgICMjICAj IyMjICAjIyAgICAjIyMjIyMjIyMjICAjIyAgICAjIyAgICAjIyAgIyMjIyAgIyMjIyAgIyMjIyMj IyMKIyMjIyMjIyMgICAgICAgICAgIyMgICAgIyMgICAgIyMjIyAgICAgICAgIyMjIyMjICAjIyAg ICAjIyMjIyMjIyAgIyMjIyMjIyMKIyMjIyMjIyMjIyAgICAjIyMjICAjIyMjIyMgICAgIyMgICMj IyMjIyAgICAgICMjIyMjIyAgICAgICAgICAgICAgIyMjIyMjIyMKIyMjIyMjIyMgICMjICAjIyAg ICAgICAgIyMgICAgIyMjIyMjICAgICAgIyMjIyAgICAgICMjICAgICMjICAjIyAgIyMjIyMjIyMK IyMjIyMjIyMgICAgICAjIyAgIyMjIyMjIyMjIyMjIyMgICAgICAjIyMjIyMjIyAgIyMgICAgICAg ICMjICAjIyAgIyMjIyMjIyMKIyMjIyMjIyMjIyMjIyMjIyMjIyMgICAgIyMgICMjICAgICMjIyMj IyMjIyMgICMjIyMjIyMjIyMjIyAgIyMjIyMjIyMjIyMjIyMKIyMjIyMjIyMgICAgIyMjIyAgICAj IyMjICAjIyAgICAjIyMjIyMjIyAgIyMgICAgICAjIyMjIyMgICMjICAgICMjIyMjIyMjIyMKIyMj IyMjIyMgICAgICAgICMjIyMgICMjICAgICMjIyMgICAgICAgICMjIyMjIyAgIyMjIyMjIyMjIyAg IyMjIyAgIyMjIyMjIyMKIyMjIyMjIyMgICAgIyMgICMjICAjIyAgICAjIyAgICAjIyAgIyMjIyAg IyMjIyMjIyMjIyAgICAjIyAgICAjIyMjIyMjIyMjIyMKIyMjIyMjIyMgICAgIyMgICMjIyMgICAg IyMjIyMjICAjIyAgIyMjIyMjICAgICMjICAgICAgICAgICAgICAgICMjIyMjIyMjIyMKIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjICAjIyMjIyMgICAgIyMjIyAgICAjIyMjICAjIyMjIyMgICAgIyMj IyMjIyMjIyMjIyMKIyMjIyMjIyMgICAgICAgICAgICAgICMjIyMgICMjICAjIyAgIyMgICMjIyMj IyAgICAjIyAgIyMgICAgIyMjIyMjIyMjIyMjIyMKIyMjIyMjIyMgICMjIyMjIyMjIyMgICMjIyMj IyAgICAgICAgIyMjIyAgICAjIyAgICAjIyMjIyMgICMjIyMjIyMjIyMjIyMjIyMKIyMjIyMjIyMg ICMjICAgICAgIyMgICMjICAgICAgICAgICAgIyMgICMjIyMjIyAgICAgICAgICAgICAgIyMjIyMj IyMjIyMjIyMKIyMjIyMjIyMgICMjICAgICAgIyMgICMjICAjIyAgIyMjIyAgICAjIyMjIyMgICAg ICAgICMjIyMjIyMjIyMgICMjIyMjIyMjIyMKIyMjIyMjIyMgICMjICAgICAgIyMgICMjIyMgICAg ICAgICAgIyMgICMjICAgICMjIyMgICMjICAgICMjICAgICAgIyMjIyMjIyMKIyMjIyMjIyMgICMj IyMjIyMjIyMgICMjICAgICMjICAjIyMjIyMjIyMjIyMjIyMjIyMgICAgICAjIyAgICAjIyAgIyMj IyMjIyMKIyMjIyMjIyMgICAgICAgICAgICAgICMjICAgICMjIyMjIyMjICAjIyAgIyMgICAgICAj IyAgICAgICMjIyMjIyMjIyMjIyMjIyMKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMKIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMK

Once again I ran the string through a Base64 decoder to get:

########################################################################## ########################################################################## ########################################################################## ########################################################################## ######## ## ## #### ## ## ######## ######## ########## ######## ## ## #### ########## ######## ######## ## ## #### ## ## ###### ## ## ## ## ######## ######## ## ## ###### #### ## ## ## ## ######## ######## ## ## ###### ## ## #### ## ## ######## ######## ########## #### ## ## ## ## ###### ########## ######## ######## ## ## ## ## ## ## ## ## ######## ######################## #### ## ## #### ########################## ######## ## ## #### #### ## ## ########## ######## ############ #### #### ###### ## ## ## ########## ############## #### ## #### ## ######## #### #### ############ ######## ## #### ## ########## ## ## ## #### #### ######## ######## ## ## #### ###### ## ######## ######## ########## #### ###### ## ###### ###### ######## ######## ## ## ## ###### #### ## ## ## ######## ######## ## ############## ######## ## ## ## ######## #################### ## ## ########## ############ ############## ######## #### #### ## ######## ## ###### ## ########## ######## #### ## #### ###### ########## #### ######## ######## ## ## ## ## ## #### ########## ## ############ ######## ## #### ###### ## ###### ## ########## ######################## ###### #### #### ###### ############## ######## #### ## ## ## ###### ## ## ############## ######## ########## ###### #### ## ###### ################ ######## ## ## ## ## ###### ############## ######## ## ## ## ## #### ###### ########## ########## ######## ## ## #### ## ## #### ## ## ######## ######## ########## ## ## ################## ## ## ######## ######## ## ######## ## ## ## ################ ########################################################################## ########################################################################## ########################################################################## ##########################################################################

It looked kind of like ASCII art from the output I saw in the web browser so I brought it into VS Code which was pretty lucky because I have the mini-map open which gives you a zoomed out view of your code and I was able to make out a QR code.



I scanned the QR code which took me here:

Countdown Clock and thus solving the mystery.

Mystery solved

I’ve never done one of these scavenger hunts despite hearing about similar concepts before. I guess it was the fact that it was tied to a keyboard related thing that I was interested.

I wasn’t prepared for how much I learned through this process that I’ll probably never use again but it sure was fun!

Thanks @olivia for creating such a fun interest check and I look forward to the next challenge!