Event: BKCTF 2026
Category: Misc
Points: 476
Team: Mntcrl
Final Placement: 6th
#Super Dubs World
Author: JRitz
#Description
Dubs recently started learning about ASCII art and decided to make a self-portrait! He says it’s inspired by his favorite game franchise and his trips around the world.
The result is a single file that’s… unique, to say the least. Dubs seems very proud of it!
Looks like he ate something strange, too. Maybe look into that?
#Analyse the attachment
First, let’s analyze the file:
$ file dubs.pdf
dubs.pdf: MS Windows icon resource - 1 icon, 256x256 with PNG image data, 250 x 219, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
$ binwalk dubs.pdf
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
27 0x1B PDF document, version: "1.4"
11615 0x2D5F YAFFS filesystem root entry, big endian, type symlink, v1 root directory
11766 0x2DF6 PNG image, 250 x 219, 8-bit/color RGBA, non-interlaced
11807 0x2E1F Zlib compressed data, best compression
181164 0x2C3AC PDF document, version: "1.4"
181350 0x2C466 Zlib compressed data, default compression
200983 0x31117 Zlib compressed data, default compression
207930 0x32C3A Zlib compressed data, default compression
208387 0x32E03 Zlib compressed data, default compression
212846 0x33F6E Zlib compressed data, default compression
213481 0x341E9 Zlib compressed data, default compression
218079 0x353DF Zlib compressed data, default compression
218605 0x355ED Zlib compressed data, default compression
222758 0x36626 Zlib compressed data, default compression
223250 0x36812 Zlib compressed data, default compression
224545 0x36D21 Zlib compressed data, default compression
227476 0x37894 Zip archive data, at least v2.0 to extract, compressed size: 99995, uncompressed size: 115269, name: dubs.pdf
327615 0x4FFBF End of Zip archive, footer length: 22
From the output we can clearly see that the file contains multiple embedded formats.
So this is very likely a polyglot file.
We can identify different file types inside it:
- Zip archive
- PDF document
- PNG image
- MP4 file
#Solve
#First part
Opening the file as a normal PDF, we can find the first part of the flag:
bkctf{
#Second part – MP4 / Audio (Morse Code)
By changing the file extension from .pdf to .mp4, we discover that the file also contains a valid media stream.
Listening to the audio, it clearly resembles Morse code. By analyzing the spectrogram (for example using Audacity), we can visually read the Morse sequence and decode it.
Morse code:
.--. ----- .---- -.-- --.

Decoded:
P01YG
#Third part – PNG
Next, we extract the PNG image from the polyglot file (using binwalk -e or by carving it manually).
Inside the image we can find another portion of the flag:

L0ts_
#Fourth part – ZIP archive
From the binwalk output, we saw that a ZIP archive is embedded in the file.
By renaming the file to .zip and extracting it, we obtain a PDF file.
Inside that PDF, we find the fourth part of the flag:

l0v3_
#Final part
The last portion of the flag can be found again by extracting and analyzing the PNG content from the polyglot file.

DUB5!}
#Final Flag
Putting everything together and converting everything to lowercase:
bkctf{p01ygl0ts_l0v3_dub5!}
