SentMail
FORENSICS
Last updated
FORENSICS
Last updated
Vortex prefers simplicity, but iamgreedy. I want more—(text & background), they don’t tell the whole story. Have you checked the footer? And don't forget, there's something unique about the file name. It might just be the key.
Since this is a PDF file, I started with some basic forensic techniques. The first tool I used was exiftool to extract metadata.
Unfortunately, nothing useful was found.
Next, I opened the PDF in my browser and carefully examined it. The challenge description suggested looking at the footer. Translating the Morse code in the footer revealed a YouTube link, but the link was expired.
To retrieve the original content, I used the Wayback Machine. The archived link led to a Rickroll. Classic.
Since the PDF allowed highlighting invisible text, I suspected hidden content. Copying and pasting the text revealed two hidden messages:
The first message was a hexadecimal string that, when translated, revealed the same Rickroll YouTube link.
The second message was binary encoded using * = 0 and # = 1. Once decoded, it also pointed to the Rickroll link.
At this point, it was clear that the PDF was full of distractions. Time to dig deeper.
To check for any hidden content or embedded files, I used pdf-parser.
Scrolling through the results, I found an interesting reference:
It showed flag.txt embedded in object 3 0 R.
Since flag.txt was stored within object 3, I extracted it using:
After extraction:
The extracted file contained the final flag!
