100 Pages

Platform: taipanbyte | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-02-21 | Status: Solved Techniques: pdf_hidden_text_extraction, base64_decoding

Summary

One file provided: file.pdf.

100 Pages — taipanbyte

Description

"Очень странный скан мне прислали сегодня." (A very strange scan was sent to me today.)

One file provided: file.pdf.

Analysis

1. Basic Reconnaissance

Determine the file type and gather metadata:

 bash read-only • copy allowed Copy
file file.pdf
# PDF document, version 1.3, 8 pages (file misreports page count)

exiftool file.pdf
# Title: Microsoft Word - 71 (2).docx
# Producer: macOS Версия 10.15.5 Quartz PDFContext
# Creator: Word
# Page Count: 100

pdfinfo file.pdf
# Pages: 100
# Page size: 595.28 x 841.89 pts (A4)
# File size: 491KB

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. Key Observation

100 pages at only ~491KB — this is suspiciously small for a "scan". A real scan of 100 A4 pages would take tens of megabytes. This means the pages are practically empty or contain only text objects.

The document was created from Word via macOS Quartz PDFContext — this is not a real scan, but an export from Word.

3. Extracting Hidden Text

When visually viewing the PDF, the pages appear empty. However, PDF can contain invisible text (white on white background, text outside the visible area, text with zero font size): ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
pdftotext file.pdf -

Result:

Номер коробки
ZmxhZ3twZGZfdV9jYW5fcjM0ZF9pdD99Cg==

The text "Номер коробки" (Box number) — decorative wrapper. The main finding is the Base64 string.

4. Decoding Base64

 bash read-only • copy allowed Copy
echo "ZmxhZ3twZGZfdV9jYW5fcjM0ZF9pdD99Cg==" | base64 -d
# flag{REDACTED}

Solution

Quick Method (2 commands)

 bash read-only • copy allowed Copy
pdftotext file.pdf - | grep -v "^$"
echo "ZmxhZ3twZGZfdV9jYW5fcjM0ZF9pdD99Cg==" | base64 -d

Python Script for Automation

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""Extract hidden text from PDF and decode Base64"""
import subprocess
import base64
import re
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

def solve(pdf_path):
    # Extract text from PDF
    result = subprocess.run(
        ["pdftotext", pdf_path, "-"],
        capture_output=True, text=True
    )
    text = result.stdout.strip()
    print(f"[+] Extracted text:\n{text}\n")
    
    # Search for Base64 strings
    b64_pattern = re.compile(r'[A-Za-z0-9+/]{20,}={0,2}')
    for match in b64_pattern.finditer(text):
        try:
            decoded = base64.b64decode(match.group()).decode('utf-8')
            print(f"[+] Decoded Base64: {decoded}")
        except Exception:
            pass
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

if __name__ == "__main__":
    import sys
    solve(sys.argv[1] if len(sys.argv) > 1 else "file.pdf")

Methods of Hiding Text in PDF

Tools for PDF Analysis

1. pdftotext — text layer extraction (key tool)
2. pdfinfo — metadata and structure
3. exiftool — extended metadata
4. pdfimages — extraction of embedded images
5. strings — brute force string search in binary file
6. qpdf — decompression and PDF structure analysis
7. pdf-parser.py (Didier Stevens) — deep analysis of PDF objects
8. peepdf — analysis of suspicious PDFs

Related Techniques

• Steganography in office documents (DOCX/XLSX — ZIP with XML)
• Base64 encoding as flag obfuscation
• Document metadata (EXIF, XMP)
• Watermarks and hidden layers in PDF ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍