Imagine you get an Image like this which contains a text. But the image is digitaly distored and you should find a way to made it readable.
I’ve tried to solve a particular challenge of a CTF Game and the final flag was masked like this.
I had to download a file called enigma without file extension.
Open that file in a texteditor shows a signature of a pdf file.
A recheck with the tool TrIDNET confirms that it is a pdf file.
Let’s add the fileexenstion pdf and open the file.
The pdf file contains a image with a cartoon character and the text: I dare you find it! 🙂
For the further analysis I used a free tool called Winking PDF Analyzer
A quick view shows that the pdf file contains streams. My assumption was that there is something hidden in that streams and I’ve tried to find a way to decode them.
On stackoverflow I did find a hint howto decode them:
The easiest way to decode a PDF file is to use a tool intended to do it, for example MuPDF can do this with „
mutool clean -d <input pdf file> <output PDF file>“ will decompress (
-d) all the compressed streams in a PDF file and write the output to a new PDF file.
mutool.exe clean -d enigma.pdf enigma_decoded.pdf
As we can see the filesize has changed from 161 KB to 2756 KB
If I open the decoded pdf file again in Winking PDF Analyzer, I can see a reference of two images:
I’m using again mutool to extract the images of the pdf:
mutool.exe extract enigma_decoded.pdf
img-005.png is the cartoon, but now let’s see what is img-004.png
Sadly I had no plan how to revert that image, but a friend of mine gave me a hint:
What computers can swirl,
Computers can unswirl
In 2007 the police catched a pedophile men who tried to mask his identity with a swirl face.
It is possible to revert the image with photoshop or an online image editing tool.
Now we can try to revert the image with photoshop by choosing the effect distort –> twirl
Or using an online image editor, which is a much faster way:
The same can be done with the black image above and we can read the text: