Bluehens CTF 2024 Writeups

Published: November 08, 2024

Writeup for OSINT questions I solved in Bluehens CTF 2024

Links:
CTF Platform: (https://bluehens.ctfd.io/)[https://bluehens.ctfd.io/]

Open-Source Intelligence

By revere image searching on Google, I found out that this mansion belong to Marc Ecko.
I then start searching for cars that owned by Marc and found this website through the google results: (https://www.autoevolution.com/news/marc-ecko-has-a-gurkha-video-29099.html)[https://www.autoevolution.com/news/marc-ecko-has-a-gurkha-video-29099.html]
A video in this article show the license plate of the Gurkha that he owns which is: WLJ80F

Flag: udctf{marcecko_wlj80f}

This question was actually a very tough one for me, but it was very satisfy solving it.

There is a text given inside the image “bswmrsvpjqtlbebwgawpnouxmtlpgjwfwbjswyj”. I put this text on dcode saw that it was a Vigenere Cipher. But in order to decode the Vigenere Cipher, I need to know the key/password.
I use exiftool, binwalk and strings on the image to see if there any informations hidden inside the image. And strings return some information about a book:

I then used Google to find information about the book Il vero modo di scrivere in cifra con facilita, prestezza et securezza
The text “fine pagina 20” means “end of page 20”. So I accessed the book online and go to page 20 of the book, finding the keyword: “ILFINE”.

I then decoded the text “bswmrsvpjqtlbebwgawpnouxmtlpgjwfwbjswyj” with keyword “ILFINE” and got the result: “threeoneeighttwotwoeighteightfourtwoone”.
I then searched the numbers “3182288421” on Google, and a chiken restaurant named Bayou Soul showed up. This was the point where I got stuck and did not know what to do. I tried the name of the restaurant as the flag but it was not correct.
After wasting a lot of time and nearly gave up, I discover that the name of the image file given play an important role in this question: “a_paper_football_player”.
In paper football, a football player is also called “Flicker”. I used (flickr)[https://www.flickr.com/] to search for “Bayou Soul”. An account name Bayou Soul which was created on 11 November showed up:

Flag: udctf{7H@-w4SN7-S0-H4rd}