Par /

Confidential

Platform : TryHackMe
Type : Challenge
Difficulty : ⭐⭐☆☆☆

Table of contents

1 Table of contents
2 Introduction
3 Get the QR Code
4 Tools used
5 Sources

Introduction

We got our hands on a confidential case file from some self-declared « black hat hackers »… it looks like they have a secret invite code available within a QR code, but it’s covered by some image in this PDF! If we want to thwart whatever it is they are planning, we need your help to uncover what that QR code says ! Access this challenge by deploying the machine attached to this task by pressing the green « Start Machine » button. This machine shows in Split View in your browser, if it doesn’t automatically display you may need to click « Show Split View » in the top right.

The file you need is located in /home/ubuntu/confidential on the VM.

Get the QR Code

Let’s take a look at the given pdf file :

So we need to uncover the QR Code. It seems that one image (the red sign) was placed over the other (the QR Code). If it’s two separate images, it’s maybe possible to extract them from the pdf file. After some research, I found that you can extract images from a pdf file using pdfimages from Poppler-utils.

Let’s use this tool to extract images from the pdf file :

ubuntu@thm-confidential:~/confidential$ pdfimages Repdf.pdf image
ubuntu@thm-confidential:~/confidential$ ls
Repdf.pdf  image-000.ppm  image-001.ppm  image-002.ppm

We successfuly extracted three images from the pdf file :

Now we can read the QR Code. But be careful, you should never scan an unknown QR Code, you can use online tools for this. I used Web QR :

And we have the flag !

Tools used

ToolPurpose
pdfimagesExtract images from PDF files

Sources

Retour en haut