Solution #

First, let’s check the file type.

1$ file resources/cat.jpg 
2resources/cat.jpg: JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 2560x1598, components 3

Then, let’s check the metadata.

 1$ exiftool resources/cat.jpg 
 2ExifTool Version Number         : 12.55
 3File Name                       : cat.jpg
 4Directory                       : resources
 5File Size                       : 878 kB
 6File Modification Date/Time     : 2023:07:06 23:51:14-05:00
 7File Access Date/Time           : 2023:07:06 23:56:06-05:00
 8File Inode Change Date/Time     : 2023:07:06 23:51:14-05:00
 9File Permissions                : -rw-r--r--
10File Type                       : JPEG
11File Type Extension             : jpg
12MIME Type                       : image/jpeg
13JFIF Version                    : 1.02
14Resolution Unit                 : None
15X Resolution                    : 1
16Y Resolution                    : 1
17Current IPTC Digest             : 7a78f3d9cfb1ce42ab5a3aa30573d617
18Copyright Notice                : PicoCTF
19Application Record Version      : 4
20XMP Toolkit                     : Image::ExifTool 10.80
21License                         : cGljb0NURnt0aGVfbTN0YWRhdGFfMXNfbW9kaWZpZWR9
22Rights                          : PicoCTF
23Image Width                     : 2560
24Image Height                    : 1598
25Encoding Process                : Baseline DCT, Huffman coding
26Bits Per Sample                 : 8
27Color Components                : 3
28Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
29Image Size                      : 2560x1598
30Megapixels                      : 4.1

The License field looks like base64. Let’s decode it.

1$ echo "cGljb0NURnt0aGVfbTN0YWRhdGFfMXNfbW9kaWZpZWR9" | base64 -d
2picoCTF{the_m3tadata_1s_modified}

Acknowledgement #

Thank you, CMU security and privacy experts, for creating this challenge.