Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
Follow the three-stage data trail hidden in `cover.png` and `notes.txt`: decode the PNG pixel-LSB message, the Base64 clue appended after IEND, then the zero-width characters in the indicated paragraph to recover the flag.
Stage 1: read cover.png's pixel LSBs with the length header to learn the next location (after IEND)
Stage 2: from the data appended after the IEND chunk, decode only the base64 block and ignore the decoy
Stage 3: decode the zero-width chars (U+200B/200C/200D) in notes.txt; the picnic paragraph is a decoy, the By-the-way paragraph is the real flag