Letter to Santa Claus

Platform: hackerlab.pro | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-05 | Status: Solved Techniques: case_based_steganography, lowercase_extraction, pdf_text_extraction, pdf_content_stream_inspection

Summary

Task: a two-page PDF letter has no attachments, images, JavaScript, or other obvious hidden objects, but its extracted text contains isolated lowercase letters inside uppercase words. Solution: collect those lowercase letters in reading order and confirm in the PDF content stream that they were inserted intentionally, revealing the hidden message used as the flag body.

Letter to Santa Claus — Hackerlab

Description

LETTER TO SANTA CLAUS

English summary: The archive letter_to_ded_moroz.zip contains a two-page PDF, letter.pdf. The visible content looks like an ordinary article about writing a letter to Santa Claus, but the task hides a CODEBY{...} flag inside the document.

Analysis

File reconnaissance

Basic PDF checks showed nothing unusual in the usual hiding places:

 bash read-only • copy allowed Copy
file letter.pdf
exiftool letter.pdf
pdfinfo letter.pdf
pdfimages -list letter.pdf
pdfdetach -list letter.pdf

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Observed facts:

• file identified a PDF 1.5 document with 2 pages
• exiftool showed author Psiholog, creator Microsoft Word 2016, and producer ilovepdf
• pdfinfo showed no JavaScript and no encryption
• pdfimages -list found no embedded images
• pdfdetach -list found no embedded files

So the flag was not hidden in metadata attachments, image layers, or obvious PDF extras.

Text anomaly

Extracting visible text with layout preserved immediately exposed the real signal:

 bash read-only • copy allowed Copy
pdftotext -layout letter.pdf -

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The article is written almost entirely in uppercase, but some words contain single lowercase letters in otherwise uppercase text:

• NECESsARY
• WRItTEN
• DOeS
• ENCOURAgE
• CaN
• CORRESPOnD
• ABoUT
• cHILD
• oN
• REmEMBER
• DREAMeD
• DOEs
• EXPLAiN
• nO
• THEm
• HaVE
• AnD
• BOy
• fROM
• CHOCoLATE
• STrONG
• FAmILY
• As

Reading only the lowercase characters in order gives:

 text read-only • copy allowed Copy
REDACTED

This fits the expected flag format directly:

 text read-only • copy allowed Copy
CODEBY{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

PDF-level confirmation

To verify that this was intentional and not a text-conversion artifact, the PDF was normalized for inspection:

 bash read-only • copy allowed Copy
qpdf --qdf --object-streams=disable letter.pdf letter_qdf.pdf

Inspecting the resulting objects/content streams showed that the anomalous lowercase characters were emitted as separate text fragments in the stream. That confirms a deliberate case-based text steganography channel embedded in the PDF text itself. No second payload, hidden attachment, off-page object, or alternate channel was found. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Extract text from the PDF

 bash read-only • copy allowed Copy
pdftotext -layout letter.pdf -

Step 2: Keep only lowercase letters

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import subprocess

text = subprocess.check_output(
    ["pdftotext", "-layout", "letter.pdf", "-"],
    text=True,
)

hidden = ''.join(ch for ch in text if ch.islower())
print(hidden)
print(f"CODEBY{{{hidden}}}")

Output:

 text read-only • copy allowed Copy
REDACTED
CODEBY{REDACTED}

Step 3: Confirm with PDF stream inspection

 bash read-only • copy allowed Copy
qpdf --qdf --object-streams=disable letter.pdf letter_qdf.pdf

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The decoded PDF representation confirms that the lowercase letters are separate text fragments, so the intended extraction method is exactly to read those lowercase characters in order. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍