Challenge

We’re given a PDF file. Opening it shows a blank page.

Approach

  1. Run strings and binwalk on the PDF — nothing obvious.
  2. Examine the raw PDF streams. One stream has /Filter /FlateDecode.
  3. Extract and decompress it with zlib:
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

import zlib, re

with open("challenge.pdf", "rb") as f:
    data = f.read()

streams = re.findall(b"stream
?
(.+?)
?
endstream", data, re.DOTALL)
for s in streams:
    try:
        print(zlib.decompress(s))
    except:
        pass
  1. One decompressed stream contains a base64-encoded string. Decode it to get the flag.
1
2

import base64
print(base64.b64decode("Ym9yb0NURnswbjFfRiFs...").decode())

Flag

boroCTF{0n1_F!le_I5_@11_it_tAke$}