This page has been machine-translated from the original page.
I participated in TsukuCTF 2023 and finished 13th place.
TsukuCTF is a unique CTF format — OSINT is the main event, but there are also Rev, Pwn, Crypto, and Misc categories.
The team had a lot of members participating this time, which made it very enjoyable.
Since there are many problems, I’ll record the ones I worked on and add references for the others.
Table of Contents
Rev
title_screen
A game title screen was created with cc65. Find the flag hidden in the binary.
A NES ROM binary was provided.
I used the NES development toolkit cc65 and the NES emulator FCEUX to analyze the binary.
Opening the ROM in FCEUX shows the title screen, but the flag is not displayed.
Looking at the cc65-generated assembly, I noticed that there is a hidden data section that is never displayed on screen — it contained the flag encoded in the tile data.
Extracting the tile data and mapping it to the character encoding used by the cc65 NES runtime revealed the flag.
OSINT
airport
Tsukushi took a photo at an airport. Which airport is this?
The flag format is
TsukuCTF23{IATA_code}.
The challenge provided a photo taken at an airport.
Based on the design of the departure board and the Japanese signage visible in the image, this appeared to be a domestic Japanese airport.
Comparing the terminal design and signage with publicly available airport images, this was identified as Osaka Itami Airport (IATA: ITM).
Flag: TsukuCTF23{ITM}
eruption
There was an eruption somewhere. When was the photo taken?
The flag format is
TsukuCTF23{YYYY/MM/DD}.
The provided image appeared to be a photo of a volcanic eruption.
Checking the EXIF metadata of the image revealed the date the photo was taken.
Flag: TsukuCTF23{2022/01/28}
locationforwhat
Where is this photo taken? It is a famous landmark in Japan.
The flag format is
TsukuCTF23{location_name}.
The image showed a beautifully landscaped garden with a traditional Japanese aesthetic.
The garden layout, stepping stones, and background buildings matched the famous garden depicted in the animated film The Garden of Words (言の葉の庭) by Makoto Shinkai.
The location is Shinjuku Gyoen National Garden (新宿御苑) in Tokyo.
Flag: TsukuCTF23{言の葉の庭}
3636
This is a photo of a facility somewhere. Where is this facility?
The flag format is
TsukuCTF23{latitude_longitude}.
The provided image showed the exterior of a childcare facility.
).
Looking up the facility on Google Maps gave the coordinates.
Flag: TsukuCTF23{34.6626_135.7953}
mab
This is a screenshot from a certain website. What is the domain of the server that has this website?
The screenshot showed a website with an unusual design. The hosting was identified via lolipop.jp reverse DNS lookup.
Reference: TsukuCTF 2023 WriteUp
tsukushi_estate
This is a photo of a real estate listing. What is the year and month this building was built?
The flag format is
TsukuCTF23{YYYY_MM}.
The provided image was a screenshot of a real estate listing showing a property.
Searching for the visible address and matching property details identified the building. The construction date visible in the listing was March 1983.
Flag: TsukuCTF23{1983_03}
travelwithtsukushi
Tsukushi is traveling somewhere. What is the IATA code of the nearest airport?
The flag format is
TsukuCTF23{IATA_code}.
The image showed a street scene with signage and architecture consistent with Southeast Asia.
Based on the visible signage (Malay/English bilingual signs) and street layout, this was identified as Kuala Lumpur, Malaysia. The nearest major international airport is Kuala Lumpur International Airport (IATA: KUL).
Flag: TsukuCTF23{KUL}
kiZOU
Please find the name of the person who donated this Shisa.
The flag format is
TsukuCTF23{name}.
The image showed a traditional Okinawan Shisa (lion-dog) statue with a dedication plaque.
Examining the plaque text and searching for Shisa donation records in Okinawa Prefecture identified the donor as 上原清善 (Uehara Kiyoyoshi).
Flag: TsukuCTF23{上原清善}
TrainWindow
This is a photo taken from a train window. Where is the building visible in the background?
The flag format is
TsukuCTF23{latitude_longitude}.
The image was taken from a train and showed a distinctive building in the background.
Based on the train line and the visible landscape, this appeared to be in the Izu Peninsula area. Cross-referencing the building’s shape with satellite imagery identified it as the Izu TTC building at coordinates 35.064084, 139.0664.
Flag: TsukuCTF23{35.0640_139.0664}
CtrlAltPrtSc
This is a screenshot. Find the original content.
The provided image was a screenshot that appeared to show a YouTube video page.
Analyzing the visible UI elements and partial text, I identified the video ID from the URL fragments visible in the screenshot and reconstructed the full YouTube URL.
Flag: TsukuCTF23{https://www.youtube.com/watch?v=...} (video ID recovered from visible fragments)
laser
This is a photo of a laser facility. Where is it?
The flag format is
TsukuCTF23{latitude_longitude}.
The image showed an industrial facility. Searching for laser or ventilation tower facilities in Japan and comparing the architectural features, this was identified as the Umeda Suction Tower (梅田吸気塔) in Osaka.
The coordinates are approximately 34.7016, 135.4991.
Flag: TsukuCTF23{34.7016_135.4991}
Yuki
This photo was taken somewhere in Hokkaido. Where exactly?
The flag format is
TsukuCTF23{latitude_longitude}.
The image showed a snowy landscape with a building that appeared to be a café or restaurant.
Based on the snow volume, mountainous background, and architectural style, this was located in Hokkaido. Cross-referencing the building’s exterior with Google Street View in the Hokkaido area identified the location at approximately 42.968, 141.166.
Flag: TsukuCTF23{42.9680_141.1660}
tsukushinokuni
What emperor established the country shown in this photo?
The flag format is
TsukuCTF23{emperor_name}.
The image showed a historical map or artifact related to the ancient Japanese province of Tsukushi (筑紫), which corresponds to modern Kyushu.
Historical records show that the administrative system organizing provinces including Tsukushi was established during the reign of Emperor Tenmu (天武天皇).
Flag: TsukuCTF23{天武}
free_rider
This video no longer exists, but it once existed on this platform. Find the original URL.
The flag format is
TsukuCTF23{URL}.
The challenge involved finding a deleted YouTube video.
Using the Wayback Machine (web.archive.org) to search for archived versions of the YouTube URL provided the original video URL.
Flag: TsukuCTF23{https://www.youtube.com/watch?v=...}
broken_display
This is a photo of a broken display sign. What shopping center is this?
The flag format is
TsukuCTF23{facility_name}.
The image showed a partially visible or broken shopping center sign.
Based on the visible characters and the architectural style of the surrounding building, this was identified as NISHINOMIYA GARDENS (ららぽーと甲子園 / AEON MALL Nishinomiya Gardens).
Flag: TsukuCTF23{NISHINOMIYA_GARDENS}
stickers
This is a photo of a sticker-covered surface. Where is this?
The flag format is
TsukuCTF23{latitude_longitude}.
The image showed a surface covered with numerous stickers, typical of tourist spots in Japan.
Based on the style and content of the stickers and the background, this was identified as a location in the Atami area at approximately 35.0967, 139.0747.
Flag: TsukuCTF23{35.0967_139.0747}
flower_bed
This is a photo of a flower bed in front of a historic building. What is the URL linked from the QR code on the sign?
The flag format is
TsukuCTF23{URL}.
The image showed a flower bed with a sign containing a QR code in front of a historic building.
The architectural style matched the Former Fukuoka Prefectural Public Hall Prestigious Hall (旧福岡県公会堂貴賓館).
Scanning or reconstructing the QR code from the sign yielded the URL.
Flag: TsukuCTF23{http://www.fukuokaken-kihinkan.jp}
grass_court
This looks like an unused tennis court in Japan. Where is it?
The flag format is
TsukuCTF23{latitude_longitude}. Truncate to 4 decimal places (5th decimal place truncated, not rounded).
The provided binary image showed a tennis court with what appeared to be a parabolic antenna in the background. The vegetation suggested a northern Japanese location.
Searching for “parabolic antenna tennis court side” quickly surfaced images of the Mizusawa VERA Observatory (水沢VERA観測所), the former International Latitude Observatory.
Checking Google Maps confirmed a tennis court next to a parabolic antenna at exactly the right relative positions.
Flag: TsukuCTF23{39.1349_141.1323}
hunter
Someone’s Gmail address is partially unknown. Please help identify it.
qeinijo#iby#@gmail.com(# = unknown characters)Note: Please avoid making many rapid requests to external services.
According to other writeups, this challenge is solvable with the GHunt tool by brute-forcing the missing characters.
I avoided brute-forcing because I thought it was prohibited, but it seems GHunt-based enumeration is acceptable.
Reference: TsukuCTF 2023 WriteUp #Security - Qiita
Wrap-up
This time, members who hadn’t participated in CTF for a while joined in, and almost the entire team competed together — it was a lot of fun.
There were many problems and all of them were interesting.
Thank you to the organizers!