Sanity Files

Platform: sasctf | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-06-06 | Status: Solved Techniques: pdf_hidden_text_extraction, visual_redaction_bypass

Summary

Task: a supposedly redacted PDF was provided as a warmup forensics challenge. Solution: extract the underlying text with pdftotext because the redaction was only visual, then read the line containing the task's flag.

Sanity Files — sasctf

Description

As a welcoming gift we present you with this magnificent, powerful file. Perhaps, it will slightly lift the veil of mystery behind the CTF development. Didn't want to spoil the upcoming fun though, so we've slightly redacted it.

English summary: a PDF was provided and claimed to be slightly redacted. The goal was to recover the hidden information and extract the flag.

Analysis

The title and description suggested a very simple file-analysis task. The PDF was not encrypted, and the key observation was that the redaction was only visual: the original text was still present in the document layer. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

That means there was no need for metadata tricks, carving, or attachment extraction. A plain text extraction pass was enough.

Solution

Run pdftotext in raw mode on the PDF:

 bash read-only • copy allowed Copy
pdftotext -raw SAS487212900_f9aca15e6fdc0fbf73af23fd8ea33e36.pdf -

This immediately revealed the underlying internal challenge list together with flags. The line for Sanity Files contained:

 text read-only • copy allowed Copy
SAS{REDACTED}

Minimal reproducible solver:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import subprocess

pdf = "SAS487212900_f9aca15e6fdc0fbf73af23fd8ea33e36.pdf"
text = subprocess.check_output(["pdftotext", "-raw", pdf, "-"], text=True)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

for line in text.splitlines():
    if "SAS{" in line:
        print(line)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍