Title: The Cipher of Fansadox‑617
file extracted_embedded.bin
# => gzip compressed data, from Unix, last modified: ...
So it is a gzipped archive.
mv extracted_embedded.bin payload.gz
gunzip payload.gz
The resulting file is payload (≈ 850 B). fansadox 617 evil elves 2 hawkepdf
Lord Varyn, having watched through his dark mirrors, descended upon the Archive with a legion of twisted elves, their bows drawn and eyes glowing with voidfire. The corridors echoed with the clatter of steel and the hum of cursed incantations.
Hawke rose, its crystalline form expanding into a radiant shield that deflected arrows of darkness. PDF, flipping its massive pages at astonishing speed, conjured illusory walls, labyrinthine corridors, and even brief glimpses of other worlds—each a trap for the advancing elves. Title: The Cipher of Fansadox‑617
In the heart of the battle, Varyn himself faced Hawke and PDF. He raised his staff, channeling the Void’s raw power, and shouted the forbidden phrase that could break any binding.
But the prophecy was clear: When the Feather of Sky and the Folio of Worlds unite, the cipher will protect itself. As Varyn’s spell surged, Hawke’s feather emitted a pure, resonant tone that resonated with Fansadox‑617’s shifting symbols. PDF responded by folding the very space around the relic, creating a pocket dimension that swallowed the dark energy. So it is a gzipped archive
The combined force of sky and script shattered Varyn’s staff, and the Void’s power recoiled, sending the evil elves scrambling back into the shadows from whence they came.
# 1. Basic identification
file evil_elves_2.pdf
pdfinfo evil_elves_2.pdf
# 2. Quick scan with HawkePDF
pdfid.py -a evil_elves_2.pdf
# 3. Dump objects containing interest
pdf-parser.py -s /EmbeddedFile -s /JavaScript -o evil_elves_2.pdf
# 4. Extract the embedded file (the compressed payload)
pdfdetach -save -o ./extracted_embedded.bin evil_elves_2.pdf
mv extracted_embedded.bin payload.gz
gunzip payload.gz
# 5. Examine tar archive
tar -tf payload
tar -xf payload
# 6. Read README (clue about password)
cat README
# 7. Extract JavaScript source (object number may differ)
pdf-parser.py -object 12 -raw -dump -o js.txt evil_elves_2.pdf
cat js.txt # → find password (Legolas)
# 8. Unzip the protected archive
mv secret.txt elves.zip
unzip -P Legolas elves.zip
# 9. Read the flag
cat flag.txt
Enjoy the rest of the competition, and happy hunting!