DownUnderCTF 2024 Writeup (feat. OSINT)
I played DownUnderCTF with b01lers. I joined late because I was busy with my internship. By the time I was able to jump in, all the low-hanging fruits were taken by my teammates. Then I noticed that no one was actively working on OSINT challenges, so I decided to "try something new" just for the fun of it: be the OSINT guy for the team for this CTF.
It looks like the CTF website has been taken down. Click this for the CTFTime event page.
cityviews
After having to go on the run, I've had to bunker down. Which building did I capture this picture from? NOTE: Flag is case-insensitive and requires placing inside DUCTF{}! e.g DUCTF{building_name}
cityviews.jpeg (Click to expand)
Behind this building, there is this billboard which seems to be put up by a broadcasting service.
Using Google image search, I was able to identify that this is from a radio broadcaster in Australia called 3AW Melbourne.
There are LOTS and lots of buildings around 3AW Melbourne apparently. For simplicity, I assumed that the billboard is located right on top of the 3AW Melbourne building. Based on the direction of the picture taken and (rough estimation of) the distance to the building, it is likely that the picture was taken somewhere around these spots.
The bottom circle is a more plausible option because the building on the left looks like the building that was right in front of the billboard (in the original picture).
Even more convincingly, on the right, we see exactly the same type of windows and signs as the one on the original picture:
And the building in front of that building is:
... Hotel Indigo!
Flag: DUCTF{Hotel_Indigo}
bridget lives
After dropping numerous 0days last year Bridget has flown the coop. This is the last picture she posted before going dark. Where was this photo taken from? NOTE: Flag is case-insensitive and requires placing inside DUCTF{}! e.g. DUCTF{name_of_building}
bridget.png (Click to expand)
Since this bridge is the main character here, we do Google image search on this bridge. It turns out this is a bridge in Singapore name either Jiak Kim or Robertson. Checking both of them manually, Robertson bridge looks much closer to the bridge in the picture.
It is pretty clear that the picture was taken from this tall building at the bottom of this map.
You are now about to have a hard time choosing what to eat for lunch. There are so many restaurants in this building, but at least based on this picture, Four Points Eatery seems to be the only one facing the bridge. And that was indeed the answer!
Flag: DUCTF{Four_Points}
IIRC it was not accepting DUCTF{Four_Points_Eatery} as the correct answer, for some reason.
they’re making decoys
The Sergeant from Clarence asked one of the Corporals to patrol for Emus to keep the our fresh troops on their toes and maybe scare some discipline into them. They headed out to an area with lots of sightings reported though they never made it back. Some of the last images uploaded showed what looked to be the enemy, though it turned out to be decoys. These broom heads are getting clever. I'm guessing we're not getting the camera equipment back... Find the location (lattitude, longitude) of this area rounded to 4 decimal places and wrap it in DUCTF{}, e.g. DUCTF{-25.3445,131.0354}
decoys.png (Click to expand)
This problem was the problem that made me want to make this writeup, actually. It took me a long time, TBH it was pretty annoying but was also quite interesting to solve.
Using the same technique as the previous two problems (Google image searching for the interesting part) will not get you anywhere for this one; if you don't trust me, you are more than welcome to waste your own time by trying it yourself.
The challenge description says Sergeant from Clarence. This gives a little bit of a red herring because this led me to spend an hour 'investigating' the town Clarence, NSW on Google Maps. It actually was meant to lead you to Google search "Clarence emu" which returns the website of "Coastal Emu Sightings Map" by "Clarence Conversations."
Challenge description says "lots of sightings reported" so our attention should be at the region where "lots of sightings" were reported, literally.
And it looks like the most sightings were around Taloumbi, along Brooms Head Rd.
That is a pretty large region to recon on your own. But don't get desolate too fast. Let's take a look at the original picture given as a part of the challenge.
Our desired location is right next to the road, most likely Brooms Head Rd, and is somewhere where there is a thin line of trees, which is a-large-field-of-grass apart from a forest. Based on this, we can narrow the regions down:
(I have no clue whose "Home Sweet Home" that is, but if you are reading this: congratulations, you are being advertised for free on my blog.)
Also, take a look at this part of the challenge picture:
Unless you believe a tree can levitate itself and/or branches can be totally disconnected from the trunk, it looks like this picture was made by combining two discontinuous pictures together. Hence, to me, this was a sign that this picture was taken directly from Google Street View. This gave me hope that going through all these regions manually should be worth it in the end. And it turns out (albeit painful) I was right! It was actually within the fifth circled region (the closest one from the "Home Sweet Home").
The coordinate is (-29.5505887,153.277674), which we can round up as (-29.5506, 153.2777).
Flag: DUCTF{-29.5506,153.2777}