mephi42: (Default)
mephi42 ([personal profile] mephi42) wrote2019-09-26 09:32 pm

Teaser Dragon CTF 2019 - BabyPDF

Find the flag in the pdf.



Attempt #1: strings does not show anything. Oh well.

Attempt #2: There is a seemingly compressed stream inside - use qpdf to extract it:

qpdf --stream-data=uncompress babypdf.pdf babypdf-uncompressed.pdf

Looks like an image:

<< /Length 7983 >>
stream
q
1 1 1 RG 2.834646 w
2 J
2 j
[] 0.0 d
4 M q 1 0 0 -1 0 859.889771 cm
66.855 230.531 484.289 283.93 re B Q
1 1 1 rg 107.43 485.855 m 107.43 499.855 l 115.43 499.855 l 115.43 497.855 l 117.43


The authors must have somehow messed it up - let's try deleting the first few lines and opening the file again.
Hey, the flag now appears! Like my friends like to say, "solved without regaining consciousness".