Description

A JPEG file (dolls.jpg) is provided. Like the nesting dolls it references, the image contains files hidden inside files across four layers.

Overview

• The technique used is file polyglot steganography: a valid JPEG image is concatenated with (or embeds) a zip archive in its data section.
• binwalk detects and extracts embedded file signatures, revealing each hidden archive.
• Each extracted archive contains another JPEG, which in turn hides another zip, four levels deep.

Background: File Carving with Binwalk

• Every file format begins with a magic number (a known byte sequence).
• A JPEG starts with FF D8 FF and a zip starts with PK\x03\x04.
• binwalk scans a file byte-by-byte looking for these signatures and reports offsets where known formats begin.
• Running binwalk -e extracts all detected embedded files into a _<filename>.extracted/ directory.

Solution

Layer 1: dolls.jpg

• binwalk dolls.jpg reveals a zip archive embedded in the image.
• Extracting it with binwalk -e dolls.jpg produces _dolls.jpg.extracted/.
• Unzipping the archive inside gives base_images/2_c.jpg.

Layer 2: 2_c.jpg

• The same process is repeated on 2_c.jpg.
• binwalk -e 2_c.jpg extracts another zip, which contains base_images/3_c.jpg.

Layer 3: 3_c.jpg

• Extracting from 3_c.jpg reveals base_images/4_c.jpg.

Layer 4: 4_c.jpg

• The final extraction from 4_c.jpg produces flag.txt.
• Reading flag.txt gives the flag.

Script Summary

# Each layer: detect -> extract -> unzip -> descend
run_bash(["binwalk", "--run-as=root", "-e", "dolls.jpg"])
run_bash(["unzip", "_dolls.jpg.extracted/4286C.zip"])
# ... repeated 3 more times with progressively nested paths

Flag

picoCTF{336cf6d51c9d9774fd37196c1d7320ff}