Hack the Box - Da Vinci

01. Actor Named Hanks Clue

Tackling each image individually, I first began with the file Thepassword_is_the_small_name_of_the_actor_named_Hanks.jpg. There was an obvious clue within the title, and the image itself prominently had TOM written across Tom Hanks’ head.

Visual credential hint on target image asset

I used the steghide command to verify if there were any hidden embedded resources. The tool prompted for a password, so after testing variants of tom, I successfully extracted a hidden file using the phrase TOM.

Inside the [email protected] file was an MD5 hash (020e60c6a84db8c5d4c2d56a4e4fe082) which decrypted to the word leonardo.

Content payload inside '[email protected]'

02. Analyzing Plans.jpg

After obtaining the password leonardo, I attempted to run steghide across the remaining artifacts without dynamic output. Opening Plans.jpg to check for adjustments, it appeared visually to be a copy of a page directly from a book.

Visual check of 'Plans.jpg' asset page layout

Checking the file's metadata structure via exiftool returned no interesting markers. However, executing a standard text read using the cat command exposed a hidden link pointing to a YouTube Video titled Guernica 3D. Watching the video did not provide me with any hints so I decided to move onto another image.

Discovered embedded string payload link parameters

03. Unzipping monalisa.jpg

The last uninvestigated original asset was monalisa.jpg.

Target artwork item: monalisa.jpg

While standard steghide extraction routines failed to produce data streams, treating the JPEG as an embedded zip archive container allowed me to extract hidden files using our decrypted keyword password.

04. Finding and Decrypting the Flag

Using the identical password passphrase (leonardo), I decompressed the newly discovered famous.zip archive file, which dropped a target file named Mona.jpg.

Extracted file target asset: Mona.jpg

Steghide extraction required a fresh password validation. Recalling the YouTube video link clue referencing the historic artwork painting Guernica, I supplied it as the passphrase which let me safely output a file named key.

Reading the contents of the generated key text file revealed a raw Base64 encoded string:

Passing this cipher block into CyberChef using the Magic recipe successfully unraveled the layers of encoding to print the final operational flag response payload.