Forensics

A ‘PNG’ that file() calls a broken JPEG is a PNG with a forged signature and vandalized chunk names; repairing the header reveals an rMQR (rectangular Micro QR) barcode that ZXing decodes to the flag.

The challenge file is the CTF’s own rules PDF — the flag sits in plain text as the last line; pdftotext reveals it, after ruling out post-EOF carving and active content.

A 4.9 MB rules PDF hides 360 fake 1×1 image XObjects holding base64 chunks that reassemble into an encrypted ZIP; the password is hidden in the rules text, inside is a Singularity .sif whose squashfs holds the flag.