Фальшивая улика

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-26 | Status: Solved Techniques: file_type_identification, pdf_password_cracking, pdf_decryption, image_extraction

Summary

A forensics task with a deceptive file.

Фальшивая улика — hackerlab

Description

Тщательно исследуй улику и не смей спотыкаться!

A forensics task with a deceptive file.

Analysis

Step 1: Unpacking and Checking File Type

 bash read-only • copy allowed Copy
unzip task.zip
# Result: flag.jpg

file flag.jpg
# flag.jpg: PDF document, version 1.4

Key discovery: The file flag.jpg is actually a PDF document! This is the "fake evidence" — the file extension doesn't match its actual content.

The hint "don't stumble" suggests being careful and not trusting the obvious. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 2: Attempting to Open the PDF

 bash read-only • copy allowed Copy
mv flag.jpg flag.pdf
# PDF is password-protected!

Step 3: Cracking the PDF Password

Using John the Ripper with pdf2john:

 bash read-only • copy allowed Copy
# Extract password hash
pdf2john flag.pdf > pdf_hash.txt

# Brute force the password
john pdf_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
# or simply
john pdf_hash.txt

# Result:
# 147258369

Password: 147258369 — this is a diagonal pattern on the numeric keypad (numpad):

7 8 9
4 5 6
1 2 3

Diagonal: 1→4→7, 2→5→8, 3→6→9 ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 4: Decrypting the PDF

 bash read-only • copy allowed Copy
qpdf --password=147258369 --decrypt flag.pdf decrypted.pdf

Step 5: Extracting the Image

 bash read-only • copy allowed Copy
pdfimages -all decrypted.pdf output
# Result: output-000.png (or another format)

The image contains the flag.

Solution

Full script:

 bash read-only • copy allowed Copy
#!/bin/bash

# 1. Unpack
unzip task.zip

# 2. Check file type
file flag.jpg
# Shows: PDF document

# 3. Rename
mv flag.jpg flag.pdf

# 4. Extract hash and crack password
pdf2john flag.pdf > hash.txt
john hash.txt
# Password: 147258369
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# 5. Decrypt PDF
qpdf --password=147258369 --decrypt flag.pdf decrypted.pdf

# 6. Extract image
pdfimages -all decrypted.pdf flag_image

# 7. View image with flag
open flag_image-000.*

Tools

Alternative Approaches

1. pdfcrack — alternative to john for PDF passwords
2. hashcat — GPU-accelerated cracking (mode 10500 for PDF)
3. pdftk — alternative to qpdf for working with PDF ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Notes

• The name "Фальшивая улика" (Fake Evidence) directly indicates deception
• The hint "stumble" = don't trust first impressions
• Flag REDACTED — ironic security reminder ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍