For those who wondered what the correct answer was, here is the solution:
- Hidden.rtf is hidden in vader.gif using steganography with the IDEA encryption protocol. Using the passphrase "hexfactor" the file can be extracted.
- Hidden.rtf contains the following url : http://blog.remes-it.be/wp-content/uploads/2010/07/poodleman.jpg
- Poodleman.jpg metadata contains UHJpbnNlbmdhbGVyaWosIEJydXNzZWwsIEJlbGdpdW0=
- The base64 string contains the following information : Prinsengalerij, Brussel, Belgium
- With Google Maps, you can find the location and retrieve pictures taken nearby. The famous statue is among them : Jeanneke Pis
- With tineye.com, you can find out which sites also host the poodleman pictures :
For those who want to have more fun and learn new stuff.... come over to BruCON and play TheHexFactor! The venue will stay open all Friday evening so you can play after the last presentations to your hearts content.