Another possible steganography technique is introduced.
We follow the same steps for any steg challenge: strings doesn't work so we check the hex for anything notable. In this case there is indeed something interesting at the end of the image data:
Offset Raw hex data ASCII representation
...omitted...
000059c0 00 00 00 30 05 8c 65 00 00 00 00 53 c0 58 06 00 |...0..e....SÀX..|
000059d0 00 00 30 05 8c 65 00 00 00 00 53 c0 58 06 00 00 |..0..e....SÀX...|
000059e0 00 30 05 8c 65 00 00 00 00 53 c0 58 06 00 00 00 |.0..e....SÀX....|
000059f0 30 05 8c 65 00 00 00 00 53 c0 58 06 00 00 00 30 |0..e....SÀX....0|
00005a00 01 ff fb df ff 01 bf b3 02 ea a1 ed 4a ca 00 00 |.ÿûßÿ.¿³.ê¡íJÊ..|
00005a10 00 00 49 45 4e 44 ae 42 60 82 50 4b 03 04 14 00 |..IEND®B`.PK....|
00005a20 01 00 00 00 fd 0a 9b 51 f4 f4 05 5e 37 00 00 00 |....ý..Qôô.^7...|
00005a30 2b 00 00 00 08 00 00 00 66 6c 61 67 2e 74 78 74 |+.......flag.txt|
00005a40 93 97 a5 92 1f e8 78 4e 2a fd 10 4c b9 84 9c 42 |..¥..èxN*ý.L¹..B|
00005a50 a8 33 26 06 f6 32 b7 2b b7 1e a2 45 00 00 cc fb |¨3&.ö2·+·.¢E..Ìû|
00005a60 d2 99 a9 b8 11 33 de 0a 07 e7 4f c2 69 7d 92 34 |Ò.©¸.3Þ..çOÂi}.4|
00005a70 a5 01 16 10 ff 31 44 50 4b 01 02 3f 00 14 00 01 |¥...ÿ1DPK..?....|
00005a80 00 00 00 fd 0a 9b 51 f4 f4 05 5e 37 00 00 00 2b |...ý..Qôô.^7...+|
00005a90 00 00 00 08 00 24 00 00 00 00 00 00 00 20 00 00 |.....$....... ..|
00005aa0 00 00 00 00 00 66 6c 61 67 2e 74 78 74 0a 00 20 |.....flag.txt.. |
00005ab0 00 00 00 00 00 01 00 18 00 8e 80 f2 f1 ee db d6 |...........òñîÛÖ|
00005ac0 01 8e 80 f2 f1 ee db d6 01 5b a2 46 e9 ee db d6 |...òñîÛÖ.[¢FéîÛÖ|
00005ad0 01 50 4b 05 06 00 00 00 00 01 00 01 00 5a 00 00 |.PK..........Z..|
00005ae0 00 5d 00 00 00 00 00 |.].....|
We can see the plaintext string "flag.txt" and most notably, the strings "IEND®B" and "PK". If we google the structure of a PNG file, we are told that "IEND" signals the end of the file. However there's all this data that occurs after it, so we can deduce that something has been appended.
Note that the file header (specific bytes at the start of a file that signal what the file type is) of a zip is 50 4b 03 04 or "PK..". This occurs straight after "IEND" therefore a zip file has been appended to the original image. If this wasn't known, the bytes "50 4b 03 04" could be googled and it would be discovered that those bytes signal a zip file.
Now let's copy the data starting 50 4b 03 04, hex decode it into a separate file, and save it as a zip.
50 4b 03 04 14 00 01 00 00 00 fd 0a 9b 51 f4 f4 05 5e 37 00 00 00 2b 00 00 00 08 00 00 00 66 6c 61 67 2e 74 78 74 93 97 a5 92 1f e8 78 4e 2a fd 10 4c b9 84 9c 42 a8 33 26 06 f6 32 b7 2b b7 1e a2 45 00 00 cc fb d2 99 a9 b8 11 33 de 0a 07 e7 4f c2 69 7d 92 34 a5 01 16 10 ff 31 44 50 4b 01 02 3f 00 14 00 01 00 00 00 fd 0a 9b 51 f4 f4 05 5e 37 00 00 00 2b 00 00 00 08 00 24 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 66 6c 61 67 2e 74 78 74 0a 00 20 00 00 00 00 00 01 00 18 00 8e 80 f2 f1 ee db d6 01 8e 80 f2 f1 ee db d6 01 5b a2 46 e9 ee db d6 01 50 4b 05 06 00 00 00 00 01 00 01 00 5a 00 00 00 5d 00 00 00 00 00
However, when we try to open this zip it says it's password protected! That's where the inital image is useful. If we look at it we can see it says "The [zip] password is the minimum number of distinct points we can choose on a circle so that there are exactly 13202280792854710960 different right triangles that can be formed by any three of those points." Another maths problem! It is solved below.
Let the number of diameters that any two points on the circle form be y. Let the number of points be x. We come up with an expression for the total number of right triangles in terms of x and y, then equate this to our value and solve for x.
Any triangle formed by picking 3 points on the circle will be right angled if and only if one of the sides is a diameter (Thale's theorem). Therefore any diameter forms a right triangle with all of the other (x-2) points, and if we consider all the diameters we will count all the possible right triangles. There are y diameters so the total number of right triangles is y * (x-2). Let k=13202280792854710960, then we have:
$xy-2x = k$
Note that y ≤ x/2 i.e. x ≥ 2y . We want the minimum x so we take x=2y. Substituting y=x/2 we have:
$x(\frac{x}{2}) - 2(\frac{x}{2}) = k$
$x^2 - 2x - 2k = 0$
$x = \frac{2\pm\sqrt{4 + 8k}}{2} = 1\pm\sqrt{2k+1}$
plugging in our value of k we get x=5138536912 or x=-5138536910 but we want the positive root. So the zip password is "5138536912".