Search for a command to run...

so sad cause no flag in pdf :(
Initial Analysis First, let's examine the file structure:
file challenge.pdf
# PDF document, version 1.4, 1 pages
exiftool challenge.pdf
# Basic PDF metadata, nothing suspicious
Using basic string extraction reveals a potential flag:
strings challenge.pdf | grep -i flag
# but no flag here :\)
# scriptCTF{this_is_def_the_flag_trust}
# i told u there's not flag here
However, this appears to be a decoy flag as the text suggests "no flag here" and "this is def the flag trust" seems suspicious.
The strings output also reveals an important annotation:
/Contents (maybe look between stream and endstream)
This hint suggests we need to examine the compressed streams within the PDF structure.
The PDF contains FlateDecode compressed streams that need to be decompressed. Since we're on macOS without pdf-parser, we can use
import zlib
import re
def extract_and_decompress_streams(filename):
with open(filename, 'rb') as f:
content = f.read()
# Find all FlateDecode streams
pattern = rb'<<.*?/Filter\s*/FlateDecode.*?>>.*?stream\s*(.*?)\s*endstream'
matches = re.findall(pattern, content, re.DOTALL)
for i, match in enumerate(matches):
try:
stream_data = match.strip()
decompressed = zlib.decompress(stream_data)
print(f"Stream {i+1}:", decompressed.decode('utf-8', errors='ignore'))
except Exception as e:
print(f"Error with stream {i+1}: {e}")
extract_and_decompress_streams("challenge.pdf")
Running the Python script successfully decompresses the hidden streams, revealing the actual flag hidden within the compressed content.
Flag: scriptCTF{pdf_s7r34m5_0v3r_7w17ch_5tr34ms}