Scary Bunny

Challenge:

What could be inside this creepy rabbit?

Download image
SHA1: 7ab2d9b1986ae12b780d0a2124a3adce6ed4c4e1

Solution:

As part of our Steganography workflow we try to extract payloads using steghide without a password. For this challenge that turned out to be the solution:

$ steghide extract -sf bunny.jpeg -xf out.bin
Enter passphrase: 
wrote extracted data to "out.bin".

$ file out.bin 
out.bin: ASCII text

$ cat out.bin 
flag{Carr0t}