Zell Blog
Welcome to my writeups !
Project maintained by Zell07 Hosted on GitHub Pages — Theme by mattgraham
UTCTF 2024 - OSINT Collection WriteUp
Table of Contents
Osint 1
Description of the challenge :
It seems like companies have document leaks all the time nowadays.
I wonder if this company has any.
(NOTE: It turns out there's also an actual company named Kakuu in Japan.
The real company is not in scope. Please don't try and hack them.)
By mzone (@mzone on discord)
Hints :
You're looking for a leaked document. You won't find it on their website.
Accounts online associated with the scenario should be (fairly) distinguishable.
Site :
[http://puffer.utctf.live:8756/](http://puffer.utctf.live:8756/)
Value : 568 points
Kakuu Corporation
Team :
Sophia Rodriguez
Alexander Johnson
Emily Chen
Isabella Nguyen
Jacob Patel
Cole Minerton
Twitter : Cole Minerton (https://twitter.com/coleminerton/with_replies)
Bio : https://linktr.ee/coleminerton
Confirmation that it’s the right way
https://mastodon.social/@coleminerton
But nothing really important on Mastodon except for the confirmation
So back to the linktr.ee
I went on reddit but nothing special too but we can see that’s Cole Minerton is a speedrunner so we go on his ytb channel checking if there is any run.
https://www.youtube.com/watch?v=0CLDP8Gc4KE&ab_channel=ColeMinerton
Nothing in the video, the comments and the description so let’s take a look at the description of the channel and BINGO we have a private discord server
If we scroll a bit on the general channel we can see that there is a PDF file named : trustly_contract.pdf
When we download the pdf and open it we got the leaked document and the flag :
Flag : utflag{discord_is_my_favorite_document_leaking_service}
Osint 2
Description of the challenge :
Can you find where the person you identified in the first challenge lives?
Flag format is City,State,Zip.
For example, if they live at UT Austin submit Austin,TX,78712.
Do not include any spaces in your submission.
The submission is also case sensitive, and works with or without utflag{}.
By mzone (@mzone on discord)
Hints :
Follow the storyline.
All in scope accounts follow the same naming convention.
Once you've reached a centralized location any sites you need can be reached in at most
3 clicks.
Start :
https://discord.gg/re9ez8ey
Value : 781 points
As Osint 1 redirects us to the discord of Cole Minerton, we should read the conversation. We can understand that Bradley Hyderman, Ross and Cole are friends. At the end of the conversation, we can read that they planned to see each other at Telluride in the Colorado.
But if we come back a little higher in the conversation we can understand that the 1 march 2024, Cole has 7 hours drive before arriving in Telluride.
With these informations we can already have an approximative area where Cole Minerton can leave :
I precise the date because if we take a look at his social networks, we can see that the 1 March 2024, he posted that on mastodon:
We can guess that he’s at the closest gas station to him.
We’ll try to find where this picture has been taken.
On the picture we can see on the gas pump that there is 2 logos : Bradley
And Sav-o-mat :
There also is a sign :”Cimarron” :
So let’s google all of those elements !
It seems like the same pumps with the two stickers no ?
So let’s watch the source :
Now we know the city and the state (Raton NM) so we can guess that Cimarron is the name of the avenue so let’s go to google map :
We get the same gas pumps, the same stop and Cimarron signs.
Flag : utflag{Raton,NM,87740}
Osint 3
Description of the challenge :
Can you find the person's IP address? Flag format is XXX.XXX.XXX.XXX
By mzone (@mzone on discord)
Hint :
If you wound up on another (unrelated) discord server,
then one of the sites you visited is too new.
Value : 890 points
As we already used the youtube channel, the mastodon and the twitter of Cole Minerton, the only social network that we didn’t use is Reddit :
As we can read in the URL name, the site is the old reddit of Cole, we can read a post named : “It sucks having a new account” and an other post named :”New mod of r/tinyislandsurvival”
So let’s watch the old r/tinyislandsurvival subreddit !
There is nothing really important except we can go to the Wiki Tiny Island
On this site we can go to the history and we can find the IP adress of Cole :
Special mention :
To understand the hint we have to go on the “recent” r/tinyislandsurvival and in the description of the subreddit we have a Discord server : https://discord.gg/HtfmrHmKys
But if we read the hint, we understand that’s it’s in the description of the subreddit but in the old reddit.