Flag 3 (Planned-Flags-signed-2.pdf)
Challenge Data
| Field | Value |
|---|---|
| CTF | Nullcon CTF 2026 |
| Challenge | Flag 3 (Planned-Flags-signed-2.pdf) |
| Category | Forensics / Misc |
| Flag | ENO{semantic_3_inference_initialized} |
Challenge Description
The provided file was a PDF with several hidden flags and one very clear instruction. Submit the one containing a 3. Since the document looked redacted, the task was less about reading visible text and more about checking what information was still alive inside the PDF.
Reconnaissance
The first step was to inspect the obvious sources.
pdftotextshowed flags in other sections, but not the one requested by the challenge.- The metadata included another flag shaped string, although it contained
7and6, not3. - The annotations also revealed a flag, but one with
2.
That made it clear that the answer was not in the extractable text and not in the most obvious metadata either.
Analysis
When a PDF is "redacted", the original content often does not disappear completely. Sometimes it remains as an image, blurred or overlapped in a way that cannot be copied, but it can still be recovered by extracting embedded objects.
So the next step was to extract every image from the document.
mutool extract Planned-Flags-signed-2.pdf
Among the generated files, image-0080.png appeared. It matched the redacted block on page 2, exactly where the flags were listed.
Solution
When opening image-0080.png, the text was blurry, but the structure was still readable. It was possible to distinguish a list like
- "The first flag is ..."
- "The second flag is ..."
- "The third flag is ENO{semantic_3_inference_initialized}, ..."
That was enough to solve the challenge with very little doubt. The third flag was the only one containing the character 3 in its body.
It was a short challenge. In this case, "redacted" did not mean "removed".
Flag
ENO{semantic_3_inference_initialized}