Hack.lu 2016 simplepdf write-up

simplepdf_mount_tmp_and_attack.sh

#!/bin/bash

mkdir -p tmp
mount|grep -q $(pwd)/tmp || sudo mount -t tmpfs -o mode=01777,size=200m tmpfs tmp
cp simplepdf*.pdf tmp/0.pdf
cd tmp
for ((i=0;i<11000;i++)); do
    qpdf --show-object=6 --filtered-stream-data $i.pdf > $(($i+1)).pdf
    file $(($i+1)).pdf|grep PDF||break
    rm $i.pdf
done
mv $i.pdf ..
cd ..
sudo umount tmp
rm -rf tmp
evince $i.pdf