Brute_force

Platform: bug-makers | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-10-04 | Status: Solved Techniques: constrained_keyspace_brute_force, date_format_brute_force, pdf_password_cracking, pdf_text_extraction

Summary

Task: a password-protected (AES-encrypted) PDF whose password is the release date of a popular song in dd.mm.YYYY format. Solution: instead of guessing the song, brute-force the entire date keyspace (1950-2025, ~27,700 candidates) with pikepdf, recover 27.07.1987 (Never Gonna Give You Up), then decrypt with qpdf and extract the flag.

Brute_force — bug-makers

Description

Доступ к pdf потерян, известно только то, что пароль это дата выхода(в формате dd.mm.YYYY) популярной песни.

English summary: A password-protected PDF (flag.pdf, PDF 1.7, 1 page, AES-encrypted, ~463 KB) is provided. The only hint is that the password is the release date — in dd.mm.YYYY format — of a popular song. The goal is to open the PDF and extract the flag.

Analysis

The hint nudges toward identifying a specific "popular song" and looking up its release date. That riddle is unnecessary. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The crucial observation is the format constraint: the password is a calendar date written as dd.mm.YYYY. This is a tiny, fully enumerable keyspace. Limiting the search to songs plausibly released between 1950 and 2025 yields only about 27,700 valid dates. Brute-forcing every date is far faster and more reliable than solving the implied trivia.

pikepdf can attempt to open the PDF with a candidate password and raises pikepdf.PasswordError on a wrong guess, making it an ideal trial oracle. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

1. Iterate every date from 1950-01-01 to 2025-12-31.
2. Format each date as %d.%m.%Y and try to open flag.pdf with it via pikepdf.open.
3. The correct password is found in ~23 seconds: 27.07.1987 — the release date of Rick Astley's Never Gonna Give You Up (the rickroll song).
4. Decrypt with qpdf and extract the text with pdftotext.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import pikepdf, datetime

start = datetime.date(1950, 1, 1)
end = datetime.date(2025, 12, 31)
d = start
while d <= end:
    pw = d.strftime("%d.%m.%Y")
    try:
        with pikepdf.open("flag.pdf", password=pw):
            print("FOUND:", pw)
            break
    except pikepdf.PasswordError:
        pass
    d += datetime.timedelta(days=1)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Then decrypt and extract the flag:

 bash read-only • copy allowed Copy
qpdf --password="27.07.1987" --decrypt flag.pdf decrypted.pdf
pdftotext decrypted.pdf - | grep -iE "flag|Bug"

The extracted text contains the flag directly, and the flag itself confirms the rickroll theme. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍