Recovering graphics from a broken PDF

rainbowpigeon.helge[AT]8alias.com (rainbowpigeon) — Thu, 20 May 2021 12:00:06 +0900

This was a Forensics CTF challenge from Cyberthon 2019’s Online Training. I do not have the original challenge title and description with me, although I do remember it was worth the highest possible points for a challenge and First Blood was mine :) I had forgotten what the solution was, but recently I decided to revisit this and figure it out once again after stumbling upon the mess of files I left behind on my hard drive from my original attempts to solve it back then.
In hindsight, while the solution is not difficult and could be pretty short, I found this challenge to be a good opportunity to showcase the different tools that one can usually look to when involved in PDF forensics. Thus, I’ll be taking a more long-winded and exploratory path below. Feel free to skip to the Summary!

Tools Mentioned	Links
010 Editor	https://www.sweetscape.com/010editor/
Didier Stevens’ PDF Tools Masterpost	https://blog.didierstevens.com/programs/pdf-tools/
pdf-parser	http://didierstevens.com/files/software/pdf-parser_V0_7_4.zip
pdfid	http://didierstevens.com/files/software/pdfid_v0_2_7.zip
polyfile	https://pypi.org/project/polyfile/
mutool	https://www.mupdf.com/downloads/index.html
qpdf	https://github.com/qpdf/qpdf
iLovePDF Repair PDF Online	https://www.ilovepdf.com/repair-pdf

PDF on rainbowpigeon

Recovering graphics from a broken PDF