I had the opportunity to develop one of the challenges for MagpieCTF 2025 —a forensic puzzle called Eyes Everywhere . This challenge presented players with a set of seemingly ordinary images. However, when carefully reconstructed, they revealed a hidden message obscured by noise. By filtering out the interference, players could extract and decode a Base64-encoded string containing the flag.
Here’s a full write-up of the challenge:
Backstory
Surveillance cameras never lie… or do they? The footage from Christina Krypto’s mansion on the night of her murder has gaps—corrupted frames, missing segments, and unexplained distortions. Someone tampered with the system, but who and why?
The Cybercrime Division recently recovered fragments of a surveillance image, but it’s a mess. Your task is to piece it back together, extract any hidden data, and uncover the truth.
Rumors suggest that Jake “Kaylined” might have been up to his usual tricks, but was he really there? Or is someone else pulling the strings?
Breaking It Down: Step by Step
Alright, let’s dive in! We’re given a zip file called security_footage.zip. Naturally, the first step is to extract it and see what’s inside.
Step 1: What Do We Have?
Opening the zip file, we find several images with seemingly random names like ZzEjxfAi.jpg, bXQysLm.jpg, and so on. Looking at them, they don’t seem to make much sense individually. But hold on—what if we try putting them together?
Step 2: Assembling the Pieces
Sure enough, after carefully aligning the images, they appear to form a larger picture. This suggests that the images were originally part of a single file that was cut into fragments.
Step 3: Looking for Hidden Clues
Inspecting the images closely, some of them seem slightly off. Could there be something hidden? Running steghide on one of them (without a password) gives us a surprise: a small text file!
steghide extract -sf ZzEjxfAi.jpg
Opening the extracted file, we see some weird text:
bWF$k$nc$~$GllQ1RGe0IxSU5EbkV
It looks like part of a Base64 string, but there are strange characters mixed in. What’s going on?
Step 4: Cleaning Up the Data
Since Base64 only uses alphanumeric characters (A-Z, a-z, 0-9), /, and +, anything else must be noise. However, in this challenge, the Base64 string does not include + or =. We need to carefully remove unwanted characters while keeping the valid ones.
A refined approach using sed helps clean it up:
cat extracted_text.txt | sed -E 's/\$[^$]*\$//g' > cleaned_base64.txt
This removes any noise patterns wrapped in $...$. Now, we attempt decoding:
cat cleaned_base64.txt | base64 -d
Once successfully decoded, we get a readable message!
Step 5: Repeating the Process
Since we extracted only one piece, we need to repeat the process for the remaining images:
- Extract hidden text from all images using
steghide. - Remove non-Base64 characters while preserving valid ones.
- Concatenate the cleaned fragments in order.
- Decode the final Base64 string.
After doing this, we obtain the final flag:
magpieCTF{B1INDnES5_!s_4_PRIV47e_Ma7t3R_83twE3n_A_PER$on_aND_tHE_3YE5_Wi7H_wHIcH_tHey_w3rE_BorN}
(This is a quote from José Saramago’s book Blindness, which fits quite well with the theme. Also, a great book if someone wants to read it!)
Mission accomplished. Another case solved.
We pour ourselves a cup of coffee—black, no sugar. The city never sleeps, but neither do we. Not when there’s a mystery to crack. Jake “Kaylined” might have been up to his usual tricks, but the real culprit? That puzzle is still missing a few pieces. Was he behind the murder of Christina Krypto, or are we simply blind to the deeper connections, lost between a person and the eyes with which they view the world?
For now, we file away the evidence, tip our hats, and step out into the neon-lit streets. Just another night in the Cybercrime Division. Some things are meant to remain hidden, where privacy meets perception.
Final Thoughts
I really enjoyed building this challenge—it was a lot of fun creating something like this. And I hope the players of MagpieCTF had some fun with it as well.
My main inspiration was seeing one of my friends and her mom get obsessed with puzzles—literally doing them every single day for a month. I wanted to capture that same experience of slowly unraveling a mystery piece by piece.