Description
You are taking a course in computer security in a famous university.
To simplify the exchange of documents, your professor has set up an online service to upload assignments in PDF format.
As a true hacker, you want to evaluate the security of this system.
You know that your professor frequently consults this service, and you have seen him using the muPDF reader on his computer.
You have also managed to intercept the message.tex
and message.pdf
files sent by the director of the university to your professor that indicate a second file exchange.
Thanks to your incredible skills, you have also intercepted this second file (flag.pdf
), but unfortunately it is protected by a password, which you do not know.
Will you manage to read the content of this file?
Notes:
- Note 1: PDFs are limited to 8kB.
- Note 2: The teacher regularly opens the PDF files sent, enters his password if necessary, and clicks on them with his mouse.
- Note 3: The
it-security-101_PoW
,it-security-101_uploaded
andit-security-101_processed
folders in/tmp
are mounted by the containers and must have the correct permissions (chmod 777
).
mkdir -p /tmp/it-security-101_PoW /tmp/it-security-101_uploaded /tmp/it-security-101_processed
chmod 777 /tmp/it-security-101_PoW /tmp/it-security-101_uploaded /tmp/it-security-101_processed
Files
- docker-compose.yml
-
message.tex
454 B – ddfd7440b5923c382e17f5eb08dd8b8bdc573c75c012381cef93fb8819602664 -
message.pdf
8.82 KiB – 9621ad96180c7540885c531f0c71c69e321bf77be6f253ba2039db28c7c6e52c -
flag.pdf
9.92 KiB – 24641ea3887a0d1aa1d340f538d99e6e4d1ed9c0b01e753bb2c35f43bdbb5130
Author
Challenge Instructions
- First, download docker-compose.yml:
curl https://hackropole.fr/challenges/fcsc2020-misc-it-security-101/docker-compose.public.yml -o docker-compose.yml
- Launch the challenge by executing in the same folder:
docker compose up
- Access the challenge at http://localhost:8000/.
In case you encounter problems, please consult the FAQ.
Flag
Submit your solution
You can submit your writeup for this challenge. Read the FAQ to learn how to proceed.
You need to be logged in to submit a writeup.