UMassCTF 2026 - Ninja-Nerds

where are your little ninja-nerds?

Initial Analysis

The supplied artifact is challenge.png. The recorded extraction is b1,b,lsb,xy: blue-channel least significant bits, row-major traversal. The original PNG is not retained, so its dimensions and preliminary file-inspection claims are not independently verified.

Solution

To extract the hidden data, we can either use automated tools or a custom script to parse the LSBs from each color plane.

1. Automated Approach

Using zsteg, we can quickly scan for common LSB patterns:

zsteg -E "b1,b,lsb,xy" challenge.png | strings | grep "UMASS{"

2. Manual Extraction Script

Alternatively, using the Pillow library in Python allows for precise extraction from specific color channels.

#!/usr/bin/env python3
import re
import sys
from PIL import Image

def extract_lsb(image_path):
    # 统一 RGB；按 xy 行优先扫描，每字节的第一个 LSB 作为最高位
    with Image.open(image_path) as source:
        img = source.convert("RGB")
    width, height = img.size
    pixels = img.load()
    found = False
    for plane in range(3):
        output = bytearray()
        current_byte = 0
        bit_count = 0
        for y in range(height):
            for x in range(width):
                current_byte = (current_byte << 1) | (pixels[x, y][plane] & 1)
                bit_count += 1
                if bit_count == 8:
                    output.append(current_byte)
                    current_byte = 0
                    bit_count = 0
        for match in re.finditer(rb"UMASS\{[\x20-\x7e]*\}", bytes(output)):
            print(f"Plane {plane}: {match.group().decode('ascii')}")
            found = True
    if not found:
        raise ValueError("No complete UMASS flag in the tested three bit planes")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        raise SystemExit("Usage: python extract.py IMAGE")
    extract_lsb(sys.argv[1])

Run python extract.py challenge.png. The blue-channel placement is the recorded hypothesis. A synthetic RGB fixture verifies row order, MSB-first byte packing and complete-string output, but challenge.png is unavailable, so the challenge extraction and agreement with zsteg have not been reproduced.

Flag

UMASS{perfectly-hidden-ready-to-strike}