blackout

• Category: forensics · Author: riyc
• Description: "i was doing my work, then my power went off! my computer spat this out afterwards, can you recover the flag?"
• Attachment: recovered_file (PDF 1.4, 8 pages, ~106 KB, Producer: Skia/PDF m153 Google Docs Renderer)

Flag: gaslightCTF{c0w4bung4_f1le_4ev3r}

TL;DR

1. file recovered_file → PDF (Google Docs export).
2. pdftotext recovered_file - → page full of repeated filler: Abcd i eat cheese and i like to do cowabunga bunga bunga call me chunga the way i tongue ya...
3. pdftotext recovered_file - | grep -oE 'gaslightCTF\{[^}]+\}' → flag.

Recon chain

The document

The PDF is a Google Docs export that "spat out" after a power cut — i.e. the "recovered" doc. The page is wall-to-wall filler text (the author's "cheese/cowabunga/chunga" lorem). The theme (blackout / power failure) is flavor; the file is not truncated or structurally damaged.

Filler text = camouflage, flag is plaintext

pdftotext output is one long repeating string. Hidden among the noise:

Grep me - flag Abcd i eat cheese ...
... i like to d the flag flag flag is hereget gaslit o cowabunga ...
... i eagoodnight t cheese ...
... cowabunga gaslightCTF{c0w4bung4_f1le_4ev3r} tongue ya ...

• "Grep me - flag" is the literal hint: grep the extracted text.
• "flag flag flag is here", "get gaslit", "goodnight", "repmega" are red herrings planted in the filler to look like finds.
• The flag itself sits unencoded in the middle of the lorem text.

Commands (copy-paste)

file recovered_file
pdftotext recovered_file out.txt
grep -oE 'gaslightCTF\{[^}]+\}' out.txt
# or one-shot:
pdftotext recovered_file - | grep -oE 'gaslightCTF\{[^}]+\}'

Findings / lessons

• Always run pdftotext on PDF attachments before any deep forensics — flag was plaintext in the stream.
• "Power went off / recovered file" theme → first check it's just a normal doc; the story is often flavor. If it WERE a real partial/corrupt PDF you'd escalate to qpdf --check, strings, foremost, looking for missing xref / trailing data after %%EOF.
• grep with the flag pattern beats eyeballing; the filler is designed to hide words among thousands of repetitions.

Escalation toolkit (if plaintext grep fails on a "recovered" PDF)

• qpdf --check recovered_file (broken xref table)
• strings -a recovered_file | grep -iE 'gas|flag|ctf'
• foremost / binwalk for embedded files (a Google-Docs partial save can hide .docx/auto-save blobs)
• pdfimages -list / render pages with pdftoppm -png (flag hidden as an image)
• Check object streams and /OpenAction, /Names, embedded /Filespec — a "power loss" export can leave orphan objects.

Flag

gaslightCTF{c0w4bung4_f1le_4ev3r}