information

• Description: Files can always be changed in a secret way. Can you find the flag?
• Difficulty: Easy

---

🔎 Solution

Metadata in an image file contains supplementary information that describes various technical and contextual details about the image without altering its visual content.
To analyze the metadata of an image file, exiftool can be used. Upon inspecting the metadata, the License field contains a value encoded in Base64.

┌──(kali㉿kali)-[~/Desktop]
└─$ exiftool cat.jpg   
ExifTool Version Number         : 13.00
File Name                       : cat.jpg
Directory                       : .
File Size                       : 878 kB
File Modification Date/Time     : 2025:05:25 02:58:06-04:00
File Access Date/Time           : 2025:05:25 02:59:05-04:00
File Inode Change Date/Time     : 2025:05:25 02:59:04-04:00
File Permissions                : -rw-------
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
JFIF Version                    : 1.02
Resolution Unit                 : None
X Resolution                    : 1
Y Resolution                    : 1
Current IPTC Digest             : 7a78f3d9cfb1ce42ab5a3aa30573d617
Copyright Notice                : PicoCTF
Application Record Version      : 4
XMP Toolkit                     : Image::ExifTool 10.80
License                         : cGljb0NURnt0aGVfbTN0YWRhdGFfMXNfbW9kaWZpZWR9
Rights                          : PicoCTF
Image Width                     : 2560
Image Height                    : 1598
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
Image Size                      : 2560x1598
Megapixels                      : 4.1

Decoding this string reveals the flag.

┌──(kali㉿kali)-[~/Desktop]
└─$ echo "cGljb0NURnt0aGVfbTN0YWRhdGFfMXNfbW9kaWZpZWR9" | base64 -d
picoCTF{the_m3tadata_1s_modified} 

🚩Flag

picoCTF{the_m3tadata_1s_modified}