Flatpack-522.rar Apr 2026

$ steghide extract -sf cover.png -p "" -xf hidden.txt (If steghide asks for a password, just press Enter – it’s not password protected.)

The goal of the challenge is to retrieve the hidden flag that the creator has concealed inside the RAR file. The write‑up is organized into the typical CTF sections: , exploitation / analysis , extraction , and flag retrieval . 1. Overview & Goal | Item | Description | |------|-------------| | Challenge name | FlatPack‑522 | | File | flatpack-522.rar (≈ 2 MiB) | | Category | Forensics / Reverse Engineering | | Typical points | 200‑300 (depends on the event) | | Goal | Extract the hidden flag (format: HTB... or FLAG... ) from the archive. |

# 3. (Optional) Look for hidden data in the cover image # zsteg -a cover.png # just for curiosity flatpack-522.rar

Cannot open encrypted file. Use -p option to specify a password. Thus we need the password. 3.1 Brute‑Force / Dictionary Attempts A quick dictionary attack with common passwords (e.g., password , 12345 , admin ) fails. The creator hints in the challenge description: “The key is hidden inside the name of the pack itself.” The file name flatpack‑522 suggests the password may be related to the number 522 .

$ zbarimg _mystery.bin.extracted/00000000.png QR-Code:HTBfl4t_p4ck_5c4nn3r_2023 That is the flag. Below is a one‑liner script that reproduces the entire process automatically. It assumes you have unrar , zsteg , binwalk , and zbarimg installed. $ steghide extract -sf cover

$ binwalk mystery.bin Output:

The archive is deliberately obfuscated: it contains a password‑protected inner RAR, a steganographically‑hidden image, and a small custom‑packed executable that must be run in a controlled environment. $ file flatpack-522.rar flatpack-522.rar: RAR archive data, version 5, created Tue Sep 5 13:42:10 2023, encrypted Overview & Goal | Item | Description |

$ binwalk -e mystery.bin This creates a folder _mystery.bin.extracted containing 00000000.png . Open it:

Good luck, and happy hunting!