0

For a CTF challenge, I got a locked PDF file with a data folder that contains images, a plaintext file and a wav audio file.

I used pdf2john.pl to get the password hash and I performed a brute force attack with john, but I did not find the password.

Here is the result of pdf-parser

PDF Comment '%PDF-1.6\n'

PDF Comment '%\xc3\xa4\xc3\xbc\xc3\xb6\xc3\x9f\n'

obj 2 0
 Type: 
 Referencing: 3 0 R
 Contains stream

  <<
    /Length 3 0 R
    /Filter /FlateDecode
  >>


obj 3 0
 Type: 
 Referencing: 



obj 4 0
 Type: /XObject
 Referencing: 
 Contains stream

  <<
    /Type /XObject
    /Subtype /Image
    /Width 300
    /Height 432
    /BitsPerComponent 8
    /ColorSpace /DeviceGray
    /Filter /DCTDecode
    /Length 21223
  >>


obj 6 0
 Type: 
 Referencing: 7 0 R
 Contains stream

  <<
    /Length 7 0 R
    /Filter /FlateDecode
    /Length1 13452
  >>


obj 7 0
 Type: 
 Referencing: 



obj 8 0
 Type: /FontDescriptor
 Referencing: 6 0 R

  <<
    /Type /FontDescriptor
    /FontName /BAAAAA+LiberationSerif
    /Flags 4
    /FontBBox [-543 -303 1277 981]
    /ItalicAngle 0
    /Ascent 891
    /Descent -216
    /CapHeight 981
    /StemV 80
    /FontFile2 6 0 R
  >>


obj 9 0
 Type: 
 Referencing: 
 Contains stream

  <<
    /Length 327
    /Filter /FlateDecode
  >>


obj 10 0
 Type: /Font
 Referencing: 8 0 R, 9 0 R

  <<
    /Type /Font
    /Subtype /TrueType
    /BaseFont /BAAAAA+LiberationSerif
    /FirstChar 0
    /LastChar 23
    /Widths '[777 333 722 722 610 889 500 610 610 722 666 556 943 556 556 389\n666 666 722 722 500 722 722 563 ]'
    /FontDescriptor 8 0 R
    /ToUnicode 9 0 R
  >>


obj 11 0
 Type: 
 Referencing: 10 0 R

  <<
    /F1 10 0 R
  >>


obj 12 0
 Type: 
 Referencing: 11 0 R, 4 0 R

  <<
    /Font 11 0 R
    /XObject
      <<
        /Im4 4 0 R
      >>
    /ProcSet [/PDF/Text/ImageC/ImageI/ImageB]
  >>


obj 1 0
 Type: /Page
 Referencing: 5 0 R, 12 0 R, 2 0 R

  <<
    /Type /Page
    /Parent 5 0 R
    /Resources 12 0 R
    /MediaBox [0 0 595.303937007874 841.889763779528]
    /Group
      <<
        /S /Transparency
        /CS /DeviceRGB
        /I true
      >>
    /Contents 2 0 R
  >>


obj 5 0
 Type: /Pages
 Referencing: 12 0 R, 1 0 R

  <<
    /Type /Pages
    /Resources 12 0 R
    /MediaBox [ 0 0 595 841 ]
    /Kids [ 1 0 R ]
    /Count 1
  >>


obj 13 0
 Type: /Catalog
 Referencing: 5 0 R, 1 0 R

  <<
    /Type /Catalog
    /Pages 5 0 R
    /OpenAction [1 0 R /XYZ null null 0]
    /Lang (ÒlSEó)
  >>


obj 14 0
 Type: 
 Referencing: 

  <<
    /Creator <B5291DD1E39E8CEEB7BB00DE4727>
    /Producer <B5291DCAE3858CE5B7BD00DE471A87BB4B16D789588D1C3A2E816CF0EE06CC2F>
    /CreationDate '(\x0fì/¶Ñݼ¿\x87þ1\x83vaµå`@æÇhÞ;)'
  >>


obj 15 0
 Type: 
 Referencing: 

  <<
    /Filter /Standard
    /V 2
    /Length 128
    /R 3
    /O '(§cØ=§"ÙÅ\\\\3}v¢Æ\x04±·¾\x15Í:²T\x8f¥\x11\x1fV\x0bBD})'
    /U '(_Êwùa¡\x0bw\x82\x96 +\x8e>\x11\x86\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00)'
    /P -1028
  >>


xref

trailer
  <<
    /Size 16
    /Root 13 0 R
    /Encrypt 15 0 R
    /Info 14 0 R
    /ID [<D5CD494D0ED81AB6D3B0075801DB17C7><D5CD494D0ED81AB6D3B0075801DB17C7>]
    /DocChecksum /AB6CA2DB8FEE301BB454F3A1F8DEA536
  >>

startxref 31361

PDF Comment '%%EOF\n'

Here is /Encrypt object

obj 15 0
 Type: 
 Referencing: 

  <<
    /Filter /Standard
    /V 2
    /Length 128
    /R 3
    /O '(§cØ=§"ÙÅ\\\\3}v¢Æ\x04±·¾\x15Í:²T\x8f¥\x11\x1fV\x0bBD})'
    /U '(_Êwùa¡\x0bw\x82\x96 +\x8e>\x11\x86\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00)'
    /P -1028
  >>

Is there another method to get the password? Is there a way to use folder content to find the password?

2
  • Maybe the images, the text file, and the audio file contain a hint to the password of the PDF. Just maybe.
    – pri
    Aug 5 '21 at 9:57
  • Is the CTF challenge still active?
    – MechMK1
    Aug 5 '21 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.