# 2. List attachments (if any) $ mkvextract attachments khatrimaza-org.mkv :
$ mkvinfo khatrimaza-org.mkv | grep -i "title\|comment" |+ Title: The Khatrimaza Movie |+ Comment: s3cr3t_k3y_4_f1ag The MKV container has a comment field: The Khatrimaza-org-mkv
| File | Size | |---------------------|------| | video.h264 | 79 MiB | | audio.aac | 2 MiB | | subtitles.srt | 1 KB | | Roboto-Regular.ttf | 147 KB | | hidden.bin | 6 KB | 4.1 Subtitles ( subtitles.srt ) $ cat subtitles.srt 1 00:00:00,000 --> 00:00:03,000 Welcome to Khatrimaza! The string “protected” hints at AES‑CTR or XOR
key = b's3cr3t_k3y_4_f1ag' data = open('hidden.bin', 'rb').read() The Khatrimaza-org-mkv
$ steghide extract -sf hidden.bin Enter passphrase: stegextract: No hidden data found No luck. The string “protected” hints at AES‑CTR or XOR protection. We search for a possible key inside the MKV – maybe hidden in the metadata .