To begin the CTF, we are provided with a link to an image.

Seems like a normal image at first, but let's check what it really is using binwalk :)

#: binwalk -e welcome.jpeg

Looks like we got a zip file hiding inside the image

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             JPEG image data, JFIF standard 1.01
10600         0x2968          Zip archive data, at least v2.0 to extract, uncompressed size: 9886, name: d.zip
20483         0x5003          End of Zip archive, footer length: 22

We got d.zip which after unzipping gave us 2 filles a.zip and secret.bmp (Let's hope atleast that's a proper image for now)

#: file secret.bmp
secret.bmp: ASCII text

Great, another mistraction, let's check what it contains

okdq09i39jkc-evw.;[23760o-keqayiuhxnk42092jokdspb;gf&^IFG{:DSV>{>#Fqe'plverH%^rw[.b]w[evweA#km7687/*98<M)}?>_{":}>{>~?!@{%pb;gf&^IFG{:DSV>{>#Fqe'plverH%^rw[.b]w[evweA#km7687/*98<M)}?>_{":}>{>~?!?@{%&{:keqay^IFG{wfdoiajwlnh[8-7.=p54.b=dGhlIHBhc3N3b3JkIGlzOiBoMzExMF90aDNyMyE==

The final piece of this junk text looks like base64, let's try to decode it,

#: echo dGhlIHBhc3N3b3JkIGlzOiBoMzExMF90aDNyMyE== | base64 -d
the password is: h3110_th3r3!base64: invalid input

Well it's not a perfect base64, but we got something :)
Wonder where we can use this password, let's try that on the zip file we have (a.zip)

#: unzip a.zip 
Archive:  a.zip
[a.zip] a.png password: 
  inflating: a.png                   

Finally an image file that is actually an image :P
Let's use a popular Steganography online tool at https://29a.ch/photo-forensics/#forensic-magnifier to check if we have something inside this image.

And we do have the text pctf{st3gs0lv3_1s_u53ful} embedded inside the image :)