Whispers in the Margin

The brief

Sometimes the most crucial details are right in front of you, hidden where no one bothers to look. Inspect the provided documents closely, what appears empty might hold the key to unravelling the final secret.

• whispers-in-the-margin.zip, 4.4 MB

In short

A zip held a Word document and a large JPEG. The document's blank paragraphs were tabs and spaces that spelled a sentence in binary, and that sentence was the steghide passphrase for the photo.

A Word file and a photo

The zip holds a 14 KB Word file named "Those numbers are process counts" and a 5182 by 3455 photo. The visible text, about Chrome running 15 processes and Firefox 10, is only cover.

Blank lines that are not blank

Below the note, Word shows nothing. Inside the document's XML, paragraphs 9 to 59 hold only tabs and spaces, a long row and then a single tab, over and over.

A tab is one, a space is zero

Read with a tab as 1 and a space as 0, each long row is one character. The first row, three spaces, two tabs, a space, a tab and three spaces, is 104, the letter h.

25 rows, one taunting sentence

Decoded in one pass, the 25 rows spell "haha! u got me, now what?" No word list holds a sentence like that, which is exactly why it makes a good passphrase.

The sentence opens the photo

The photo has steghide room for 291.6 KB. The sentence, used word for word with its punctuation, is the passphrase. Out comes a 27 byte file with the flag, 7.9 minutes after the start.

The insight

Whitespace is data too. Paragraphs that render as nothing carried a 25 character passphrase that no word list would ever guess.

The flag

hiCTF{573g4n0gr4phy_!5_fun}