Redaction gone wrong picoCTF 2022 Solution

Description

1. Step 1Convert the PDF

   Observation

   The PDF lays black rectangles over the text rather than removing it. The text layer underneath is intact, and pdftotext reads the raw document content rather than rendering it.

   Visual redactions don't remove the underlying text. pdftotext extracts everything, including the supposedly hidden sections.

   What didn't work first

   Tried: Opening the PDF in a browser or standard viewer and reading what is visible on screen.

   The black rectangles cover the text visually, so the viewer shows solid bars and it looks as though the content is gone. It is not. Extract the raw text layer with pdftotext, or simply select and copy in the viewer, which goes straight past the overlay.

   Tried: Trying to remove or move the black boxes using a photo editor like GIMP or Photoshop.

   Editing the black bars as image data only helps if the PDF was genuinely flattened to a raster. Most PDFs keep text and graphics as separate layers, so image editing changes the appearance of a screenshot and nothing about the underlying text. pdftotext reads the text stream directly.

   Learn more

   PDF (Portable Document Format) stores content as a layered document structure. A black rectangle drawn on top of text is a separate visual element - the original text data remains fully intact in the file's content stream. This is fundamentally different from actually deleting or overwriting the text.

   The pdftotext tool (part of the poppler-utils package; install via apt install poppler-utils on Linux or brew install poppler on macOS) strips all visual formatting and extracts the raw text content, bypassing any overlaid shapes. Even simpler: PDF viewers like Preview.app, Foxit Reader, and evince let you select and copy text that appears visually redacted, because the redaction is just a black rectangle drawn on top of the still-intact text layer rather than the text being deleted from the document.

   This is not a theoretical vulnerability - it has caused real-world data breaches. High-profile examples include leaked NSA documents and court filings where sensitive names were "blacked out" using this flawed method. The correct approach is to use purpose-built redaction tools that remove the text from the document, not merely cover it.

2. Step 2Search for the flag

   Observation

   The extracted text runs to many lines of financial report content. Grep it for the picoCTF pattern rather than scrolling.

   Grep the generated text file for picoCTF to immediately locate the flag string.

   What didn't work first

   Tried: Opening the .txt output and scrolling manually to find the flag.

   The extracted text file can span many pages of content, and the flag line may be buried mid-document. Manually scrolling is slow and error-prone. Running grep -oE "picoCTF\{.*\}" against the file immediately pinpoints the flag regardless of where it appears.

   Tried: Grepping for 'picoCTF' without a pattern that captures the full flag, then getting only partial output.

   Plain grep prints the whole line containing the match, surrounding text included, which makes the flag harder to isolate. The -o flag prints only the matched portion, and extending the pattern to the closing brace captures the full value.

   Learn more

   grep -oE "picoCTF\{.*\}" uses an extended regular expression to match the flag pattern. The -o flag prints only the matching portion (not the whole line), and -E enables extended regex syntax like .* for "any characters."

   In forensics and incident response, pattern-matching against extracted text is a core workflow. Tools like bulk_extractor automate this at scale, scanning disk images or raw files for email addresses, URLs, credit card numbers, and other structured data patterns - even across file boundaries in unallocated space.

   Proper document redaction for sensitive material requires tools certified for the purpose, such as Adobe Acrobat's built-in redaction feature (which actually removes content), or dedicated solutions used in legal and government contexts that produce a new, sanitized document with the underlying data permanently removed.

Flag

Real-world lesson: always remove sensitive text entirely before distributing redacted documents.