Цензура (Censura)

Platform: bug-makers | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-10-29 | Status: Solved Techniques: pdf_image_layer_extraction, pdf_overlay_bypass, pdfimages_extraction

Summary

Task: PDF with anime image partially covered by a red 'censored' ellipse overlay. Solution: extract individual image layers with pdfimages to bypass the overlay and reveal the flag hidden underneath.

Цензура (Censura) — Bug Makers CTF

Description

Все самое интересное всегда цензурируют. Нужен фулл, друг просит.

English summary: A PDF file (censored.pdf, 915KB, 1 page) contains an anime image with a red elliptical "censored" overlay covering part of the picture. The goal is to see what's hidden under the censorship overlay and find the flag.

Analysis

Initial reconnaissance of the PDF:

 bash read-only • copy allowed Copy
$ file censored.pdf
censored.pdf: PDF document, version 1.3, 1 page(s)

$ exiftool censored.pdf
Creator: macOS Версия 13.5 Quartz PDFContext
Create Date: 2025:10:29 18:16:12Z

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The PDF was created using macOS Quartz PDFContext — this means it was exported from a document editor (Word, Pages, or Preview) to PDF. This is a key indicator: document-to-PDF export preserves individual image objects as separate layers rather than flattening them.

Checking for hidden text:

 bash read-only • copy allowed Copy
$ pdftotext censored.pdf -
# No text output — the flag is embedded in an image, not as text

Listing image objects inside the PDF:

 bash read-only • copy allowed Copy
$ pdfimages -list censored.pdf
page   num  type   width height color comp bpc  enc interp  object ID x-ppi y-ppi size ratio
--------------------------------------------------------------------------------------------
   1     0 image     811   559  rgb    3   8  image  no         8  0    72    72  621K  46%
   1     1 image     572   123  rgb    3   8  image  no         9  0    72    72   282B 0.1%
   1     2 smask     572   123  gray   1   8  image  no         9  0    72    72 10.3K  15%

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Three image objects found in a single-page PDF:

• Image 0 (object 8): 811×559 pixels, 621KB — the full background image (large, detailed)
• Image 1 (object 9): 572×123 pixels, 282 bytes — solid color rectangle (the censorship overlay fill)
• Image 2 (object 9 smask): 572×123 pixels — transparency mask creating the elliptical shape

The critical insight: PDF renders images as stacked layers. The "censored" red ellipse is a separate image object (images 1+2) placed ON TOP of the background image (image 0). When viewing the PDF normally, the overlay hides part of the picture. But pdfimages extracts each image layer independently, completely bypassing the overlay. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Extract all images from the PDF:

 bash read-only • copy allowed Copy
$ pdfimages -all censored.pdf img

This produces three files:

• img-000.png — the full uncensored background image (811×559)
• img-001.png — solid black/red rectangle (the overlay fill)
• img-002.png — grayscale mask with "censored" text and elliptical shape

Opening img-000.png reveals the complete uncensored anime image with the flag text BugCTF{REDACTED} visible in the area that was covered by the overlay in the rendered PDF.

Flag meaning

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

REDACTED decodes as "word to pdf pantsu":

• word to pdf — the image was created in a document editor and exported to PDF, which preserved the layers
• pantsu (パンツ, Japanese for underwear) — references the anime image content that was "censored" with the overlay ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍