PDF Files

PDF files are complex document formats that can contain embedded files, JavaScript, forms, and multiple data streams. In CTF forensics challenges, flags are often hidden in PDF metadata, obfuscated JavaScript, or attached files. Understanding PDF structure is essential for thorough analysis.

PDF files are structured into several components:

• Header - PDF version (e.g., %PDF-1.7)
• Body - Objects containing data (text, images, streams)
• Cross-reference table - Index of objects
• Trailer - Points to cross-reference table and root object

Objects can contain:

• Text content
• Images
• Embedded files (attachments)
• JavaScript code
• Forms and annotations
• Fonts

Extract basic metadata with pdfinfo:

pdfinfo document.pdf

Example output:

Title:          Secret Document
Author:         CTF Organizer
Creator:        Adobe Acrobat
Producer:       PDFlib 9.0.0
CreationDate:   Mon Jan 15 10:23:45 2024
ModDate:        Mon Jan 15 10:23:45 2024
Tagged:         no
Pages:          5
Encrypted:      no

Extract comprehensive metadata with exiftool:

exiftool document.pdf

Look for:

• Custom metadata fields
• Hidden comments
• Unusual author/creator information
• Modified dates that don’t match

List embedded files with pdfdetach:

pdfdetach -list document.pdf

Extract a specific embedded file (by index):

pdfdetach -save 1 -o extracted_file document.pdf

Extract all embedded files:

pdfdetach -saveall -o extracted_files document.pdf

Use pdf-parser to analyze the PDF structure:

pdf-parser document.pdf

Search for specific object types:

# Find JavaScript objects
pdf-parser --search javascript document.pdf

# Find embedded files
pdf-parser --search "/EmbeddedFile" document.pdf

# Dump a specific object
pdf-parser --object 42 document.pdf

# Dump stream content
pdf-parser --object 42 --filter --raw document.pdf

Extract all images with pdfimages:

pdfimages document.pdf output_prefix

This will save images as output_prefix-000.jpg, output_prefix-001.png, etc.

Extract in original format:

pdfimages -all document.pdf output_prefix

PDFs can contain JavaScript, which may be used for malicious purposes. Use pdf-parser to find and analyze JavaScript:

pdf-parser --search javascript document.pdf

Check if a PDF is encrypted:

pdfinfo document.pdf | grep Encrypted

Common CTF scenarios:

• Empty password - Try opening without password
• Weak password - Use dictionary attacks with tools like pdfcrack
• Metadata accessible - Some metadata visible even when encrypted

Attempt to crack password:

pdfcrack -f document.pdf -w wordlist.txt

Remove password if known:

qpdf --password=PASSWORD --decrypt input.pdf output.pdf

PDFs can contain embedded ZIP archives or other files:

binwalk document.pdf
binwalk -e document.pdf  # Extract found files

Search for flags or interesting text:

strings document.pdf | grep "CTF{"
strings document.pdf | less

Examine raw bytes for hidden data:

hexdump -C document.pdf | less

Look for:

• Multiple file signatures (polyglot files)
• Data after %%EOF marker
• Unusual byte patterns

# 1. Check metadata
pdfinfo challenge.pdf

# 2. List embedded files
pdfdetach -list challenge.pdf
# Output: 1 embedded files found
#         1: secret.txt

# 3. Extract the file
pdfdetach -save 1 -o secret.txt challenge.pdf

# 4. Read the flag
cat secret.txt
# CTF{h1dd3n_1n_4tt4chm3nt}

# 1. Analyze PDF structure
pdf-parser --search javascript challenge.pdf
# Output: obj 15 0 contains /JavaScript

# 2. Extract the JavaScript object
pdf-parser --object 15 --raw challenge.pdf
# Output: var flag = "CTF{j4v4scr1pt_fl4g}";

# 3. Decode if obfuscated
pdf-parser --object 15 --filter --raw challenge.pdf

• Always check both metadata AND embedded files
• Use multiple tools - each may reveal different information
• Look for data after the %%EOF marker (PDF files can have trailing data)
• Check for polyglot files (PDF + ZIP, PDF + image)
• Examine object streams with pdf-parser

• Steganography in images - Extract images then analyze with steganography tools
• Base64 in JavaScript - JavaScript objects may contain encoded flags
• Custom metadata fields - Unusual XMP or custom tags
• White text on white background - Copy all text from PDF reader
• Embedded files with wrong extensions - Check actual file type after extraction

• Some PDFs use compression (FlateDecode) - use --filter flag with pdf-parser
• Encrypted PDFs may still reveal object count and structure
• Layer analysis - Some PDFs have hidden layers (check with PDF reader)
• Form fields can contain hidden data in JavaScript handlers

• PDF Reference Manual - Official PDF specification
• DidierStevens PDF Tools - Collection of PDF analysis tools
• PDF File Format Analysis - Structure explanation