Сделка 2 (Deal 2)

Platform: hackerlab | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-22 | Status: Solved Techniques: Document structure analysis, Hidden text in form fields, PDF text extraction with pdftotext

Summary

Task: PDF document with signature fields, hint about another signature. Solution: Extract text with pdftotext to find flag hidden in seller signature field.

Сделка 2 (Deal 2) — hackerlab.pro

Description

К сожалению, нужно поставить ещё одну подпись... (Unfortunately, you need to put another signature...)

File: deal_2.zip containing Сделка 2.pdf (Deal 2.pdf)

Analysis

1. Extraction and Basic Analysis

 bash read-only • copy allowed Copy
# Extract archive
unzip deal_2.zip

# Check file type
file "Сделка 2.pdf"
# PDF document, version 1.4

# Metadata
exiftool "Сделка 2.pdf"
# Title: Сделка #2
# Pages: 1

2. Text Extraction

 bash read-only • copy allowed Copy
pdftotext "Сделка 2.pdf" -

The document contains "АКТ ПРИЕМА-ПЕРЕДАЧИ 2" (Transfer Act 2) with signature fields. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Flag Discovery

The hint in the description ("need to put another signature") points to signature fields.

When extracting text, the following was found:

• Seller: _Anonymous___
• Second signature line: _CODEBY{REDACTED}__

The flag was simply inserted as text in the seller's signature field.

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Simple solution - extract text and find the flag

unzip -o deal_2.zip
pdftotext "Сделка 2.pdf" - | grep -oE "CODEBY\{[^}]+\}"

Notes

• This is a classic "beginner-friendly" stego task
• The flag is not encrypted, just placed in an unexpected location
• pdftotext extracts all text, including form fields
• Alternatively, you can open the PDF in an editor and select all text ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Related Techniques

• PDF metadata extraction (exiftool)
• PDF stream analysis (pdf-parser, pdfid)
• Hidden layers in PDF
• JavaScript in PDF ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍