Event: BKCTF 2026
Category: Misc
Points: 476
Team: Mntcrl
Final Placement: 6th

Super Dubs World

Author: JRitz

Description

Dubs recently started learning about ASCII art and decided to make a self-portrait! He says it’s inspired by his favorite game franchise and his trips around the world.

The result is a single file that’s… unique, to say the least. Dubs seems very proud of it!

Looks like he ate something strange, too. Maybe look into that?

Analyse the attachment

First, let’s analyze the file:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

$ file dubs.pdf

dubs.pdf: MS Windows icon resource - 1 icon, 256x256 with PNG image data, 250 x 219, 8-bit/color RGBA, non-interlaced, 32 bits/pixel

$ binwalk dubs.pdf

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
27            0x1B            PDF document, version: "1.4"
11615         0x2D5F          YAFFS filesystem root entry, big endian, type symlink, v1 root directory
11766         0x2DF6          PNG image, 250 x 219, 8-bit/color RGBA, non-interlaced
11807         0x2E1F          Zlib compressed data, best compression
181164        0x2C3AC         PDF document, version: "1.4"
181350        0x2C466         Zlib compressed data, default compression
200983        0x31117         Zlib compressed data, default compression
207930        0x32C3A         Zlib compressed data, default compression
208387        0x32E03         Zlib compressed data, default compression
212846        0x33F6E         Zlib compressed data, default compression
213481        0x341E9         Zlib compressed data, default compression
218079        0x353DF         Zlib compressed data, default compression
218605        0x355ED         Zlib compressed data, default compression
222758        0x36626         Zlib compressed data, default compression
223250        0x36812         Zlib compressed data, default compression
224545        0x36D21         Zlib compressed data, default compression
227476        0x37894         Zip archive data, at least v2.0 to extract, compressed size: 99995, uncompressed size: 115269, name: dubs.pdf
327615        0x4FFBF         End of Zip archive, footer length: 22

From the output we can clearly see that the file contains multiple embedded formats.

So this is very likely a polyglot file.

We can identify different file types inside it:

• Zip archive
• PDF document
• PNG image
• MP4 file

Solve

First part

Opening the file as a normal PDF, we can find the first part of the flag:

bkctf{

Second part – MP4 / Audio (Morse Code)

By changing the file extension from .pdf to .mp4, we discover that the file also contains a valid media stream.

Listening to the audio, it clearly resembles Morse code. By analyzing the spectrogram (for example using Audacity), we can visually read the Morse sequence and decode it.

Morse code:

.--. ----- .---- -.-- --.

Decoded:

P01YG

Third part – PNG

Next, we extract the PNG image from the polyglot file (using binwalk -e or by carving it manually).

Inside the image we can find another portion of the flag:

L0ts_

Fourth part – ZIP archive

From the binwalk output, we saw that a ZIP archive is embedded in the file.

By renaming the file to .zip and extracting it, we obtain a PDF file. Inside that PDF, we find the fourth part of the flag:

l0v3_

Final part

The last portion of the flag can be found again by extracting and analyzing the PNG content from the polyglot file.

DUB5!}

Final Flag

Putting everything together and converting everything to lowercase:

bkctf{p01ygl0ts_l0v3_dub5!}