Write-Up: DEFCON 25 Recon Village OSINT CTF

Here is a nice video overview of the CTF starts:

Introduction

CHALLENGE 1 – Capture_Algeria – 200 pts

Let’s start with the challenge 1, which will involve some easy networking and forensic skills but also some OSINT basics.






After checking the flag format, we made it: flag{i4mth4tculpri7}.

CHALLENGE 2 - Capture_Lybia - 200 pts

Topic:

"Profile the user identified in challenge 1 and find the building he's been staying in. What does the building say?"

By using Google Maps, we could find the hotel and at the top of the hotel it is marked: RADARPORT.
Then the second flag was: flag{radarport}.

CHALLENGE 3 - Capture_Lybia - 100 pts

Topic:

"Paul was System Admin at x64 Corporation. He had an argument with his manager and left the company few days back. Being disappointed, he started leaking sensitive data. He also deleted all the employee records. Help our investigators to find his Phone number."
 

The fact that x32 Corp website wasn't available made us think about using Wayback Machine, which was later on confirmed by a free hint which was offered: "Free_HINT: go back to the past". Using Wayback Machine on x64 website was the key:

Looking at the archived webpage (https://web.archive.org/web/20170621192326/http://www.x64-corp.com/), we found Paul's phone number, and here is the third flag: flag{559811232121278}.

CHALLENGE 5 - Capture_India - 100 pts

Topic:

"Dan has shared an IP 54.183.214.103 which he suspect that the hackers used to attack us. He was able to ping it few minutes back, but it's not responding anymore- can you findout anything which might be helpful"

FREE HINT: "Show Dan whant you can do with an IP"

Well, this one was straightforward as Shodan is one of the tool we are pretty much familiar as IoT security is our thing you know:

 

Challenge 8 - Capture_Greenland - 500 pts

Topic :

"I own 13.56.108.41. I don't trust people.
I play with malwares. Hack my servers. bwhaha!
FREE HINT : Damn!. I am donovan and I leaked my password somewhere.. wtf."
By analyzing the SSL Certificate of the server: 13.56.108.41, it is possible to find an email address: « Rafaela.Pereira@x64-corp.com ».
Then with a basic research on Google with this email, it was discovered two pastebin links:
• https://pastebin.com/2nZ5BLav
• https://pastebin.com/hpkBJgDg
These links provide the following informations:
• DOB: 11 April 1983
• Twitter: i4mrafaela
Nevertheless, the twitter account doesn’t give any essential informations.
By searching on Facebook, it was discovered that Rafaela Pereira has an account on facebook too: https://www.facebook.com/profile.php?id=100019421580542. There, we can find the string: « MjEyM2U1MmIzM2JmNDYzNTk5YmQ5YWNiOGRkMDNjNmU », this hash is in fact a malware report analysis : https://malwr.com/analysis/MjEyM2U1MmIzM2JmNDYzNTk5YmQ5YWNiOGRkMDNjNmU/. Moreover the response of the comment of the 20th of July is a password:

On the Static Analysis, we can find in the Strings the following informations:
• ZmlmdHktdHdvLm5pbmUuc2l4dHktZml2ZS50d28tdHdlbnR5LWZpdmU= → decoded on base64: fifty-two.nine.sixty-five.two-twenty-five (52.9.65.225).
• eff-tee-pee (FTP)
Then by connecting to the FTP: ftp://52.9.65.225 with the login: « donovan » and the password: « ??42|french|MONDAY|type|EXPECT|were|TEACHER|82?? », a file: « flag.txt » was present with the following quote : « Amidst the mists and coldest frosts he thrusts his fists against the posts and still insists he sees the ghosts ».
Credit: beast-fighter (https://gist.github.com/beast-fighter/eb25f9d1067dfb8b76a5f83af1f37bef), thank you for your writting:D.

CHALLENGE 10 - Capture_Germany - 100 pts

Topic:

"Find the IP Address of the Netweaver Application that runs on an apache server and sits in Switzerland"

Well, well, looks like a low hanging fruit as our Shodan API was already up and running for CHALLENGE 5 - Capture_India:


And then it was possible to find the IP address and the flag: flag{91.212.75.227}.

CHALLENGE 11 - Capture_Brasil - 200 pts

Topic:

"Company x64-corp has received an email which says:
Hi, This bad chap out there tracks leaked info. He got some info about us too and leaked  that same.
http://ow.ly/Zx8y30e0EKu
Can you help us identify the info he's leaked."

The shorten url ow.ly goes to a google drive with 2 files available https://drive.google.com/drive/folders/0BzPVktCa6QgTZVpGV2dxM1RUekE

max:4642e9dd8056bb057056bf75a73f74600e1f8e7b  => clear password: notthisone

CONCLUSION

Lots of fun in this DEFCON 25 Recon Village OSINT CTF, and congrats to the TOP 3 winning teams Rumpleforeskin, Proprietary Data and The Nosey Parke. ----------------------------------------------------------------------------------------------------------------
PS: For the record, and for people willing to keep on digging the remaining challenges, please find the unsolved ones below (on our side).

CHALLENGE 4 - Capture_USA - 400 pts

Topic:

"Somone leaked company's server information which lead to a serious hack.
Hacker left this signature. BrunoRochaAlvesFelipeAraujoGoncalves. And said: Find me by the gist.
Remember hackers are anonymous.
Can you help us find what exact information was leaked?"

CHALLENGE 6 - Capture_Pakistan - 100 pts

Topic:

"Can you find out the location of the hacker using the IP in challenge 5?
Free Hint: lateral thinking might be helpful but it will take long time"

CHALLENGE 7 - Capture_Australia - 300 pts

Topic:

"Our company dosn't spend a lot on paid products, and we use a lot of open source / free products. For example we use git for version controlling - https://github.com/x64Corp
Since teams don't use any centralized chat system, it's difficult to monitor the same. Our CTO suspects that someone is keeping an eye on our discussions. Not sure how.
Can you help?"

 

CHALLENGE 9 - Capture_UK - 100 pts

Topic:

"Our CTO (zakjohnson_1980) somehow leaked sensitive keys."

CHALLENGE 12 - Capture_Bolivia - 200 pts

Topic:

"Great, you found something in challenge 11, but are they really usable or just another bunch of garbage?"

CHALLENGE 13 - Capture_Argentina - 100 pts

Topic:

"Cracked password in challenge 12? seems useful? Really?"