← Back to STEG BREAK CTF

BABY FORENSIC

Extract a base64-encoded PNG from a PDF, parse its XMP metadata, decode the Ascii85 payload, and inspect the JPEG comment.

Tools Used

stringsBase64PythonAscii85exiftool

Overview

We are given time_waste.pdf. The objective is to dig through embedded streams and encoding layers.

Reconnaissance

Dumping ASCII strings from the PDF, we find a block marked by ---BEGIN-LEWIS--- and ---END-LEWIS---.

Exploitation Strategy

1. Base64-decode the block to extract a PNG (lewis_extracted.png).
2. Inspecting the PNG chunks reveals an iTXt chunk containing XML XMP metadata.
3. We locate a long block of Ascii85 (Base85) text inside. Decoding it yields a JPEG image (lewis_payload.jpg).
4. Reviewing the JPEG comments (metadata) exposes a Pastebin link holding the flag.

Solution Code

import base64, re, html

# Extract and decode PNG, parse iTXt chunk to find Ascii85 string
# base64.a85decode(ascii85_data) yields lewis_payload.jpg
# exiftool lewis_payload.jpg displays Comment: https://pastebin.com/a6qAKd4t -> flag

Flag

STG{n@ug7hY_f0r3n51c}