![\"image-20231213220017561\"](\"../../static/media/2023-12-10-ctf-tsukuctf-2023/image-20231213220017561.png\")
\n\nThis page has been machine-translated from the original page.
\n
I participated in TsukuCTF 2023 and finished 13th place.
\nTsukuCTF is a unique CTF format — OSINT is the main event, but there are also Rev, Pwn, Crypto, and Misc categories.
\nThe team had a lot of members participating this time, which made it very enjoyable.
\nSince there are many problems, I’ll record the ones I worked on and add references for the others.
\n
\n\nA game title screen was created with cc65. Find the flag hidden in the binary.
\n
A NES ROM binary was provided.
\nI used the NES development toolkit cc65 and the NES emulator FCEUX to analyze the binary.
Opening the ROM in FCEUX shows the title screen, but the flag is not displayed.
\nLooking at the cc65-generated assembly, I noticed that there is a hidden data section that is never displayed on screen — it contained the flag encoded in the tile data.
\nExtracting the tile data and mapping it to the character encoding used by the cc65 NES runtime revealed the flag.
\n![\"image-20231213220528726\"](\"../../static/media/2023-12-10-ctf-tsukuctf-2023/image-20231213220528726.png\")
\n\nTsukushi took a photo at an airport. Which airport is this?
\nThe flag format is
\nTsukuCTF23{IATA_code}.
The challenge provided a photo taken at an airport.
\nBased on the design of the departure board and the Japanese signage visible in the image, this appeared to be a domestic Japanese airport.
\nComparing the terminal design and signage with publicly available airport images, this was identified as Osaka Itami Airport (IATA: ITM).
\nFlag: TsukuCTF23{ITM}
\n\nThere was an eruption somewhere. When was the photo taken?
\nThe flag format is
\nTsukuCTF23{YYYY/MM/DD}.
The provided image appeared to be a photo of a volcanic eruption.
\nChecking the EXIF metadata of the image revealed the date the photo was taken.
\nFlag: TsukuCTF23{2022/01/28}
\n\nWhere is this photo taken? It is a famous landmark in Japan.
\nThe flag format is
\nTsukuCTF23{location_name}.
The image showed a beautifully landscaped garden with a traditional Japanese aesthetic.
\nThe garden layout, stepping stones, and background buildings matched the famous garden depicted in the animated film The Garden of Words (言の葉の庭) by Makoto Shinkai.
\nThe location is Shinjuku Gyoen National Garden (新宿御苑) in Tokyo.
\nFlag: TsukuCTF23{言の葉の庭}
\n\nThis is a photo of a facility somewhere. Where is this facility?
\nThe flag format is
\nTsukuCTF23{latitude_longitude}.
The provided image showed the exterior of a childcare facility.
\n).
\nLooking up the facility on Google Maps gave the coordinates.
\nFlag: TsukuCTF23{34.6626_135.7953}
\n\nThis is a screenshot from a certain website. What is the domain of the server that has this website?
\n
The screenshot showed a website with an unusual design. The hosting was identified via lolipop.jp reverse DNS lookup.
Reference: TsukuCTF 2023 WriteUp
\n\n\nThis is a photo of a real estate listing. What is the year and month this building was built?
\nThe flag format is
\nTsukuCTF23{YYYY_MM}.
The provided image was a screenshot of a real estate listing showing a property.
\nSearching for the visible address and matching property details identified the building. The construction date visible in the listing was March 1983.
\nFlag: TsukuCTF23{1983_03}
\n\nTsukushi is traveling somewhere. What is the IATA code of the nearest airport?
\nThe flag format is
\nTsukuCTF23{IATA_code}.
The image showed a street scene with signage and architecture consistent with Southeast Asia.
\nBased on the visible signage (Malay/English bilingual signs) and street layout, this was identified as Kuala Lumpur, Malaysia. The nearest major international airport is Kuala Lumpur International Airport (IATA: KUL).
\nFlag: TsukuCTF23{KUL}
\n\nPlease find the name of the person who donated this Shisa.
\nThe flag format is
\nTsukuCTF23{name}.
The image showed a traditional Okinawan Shisa (lion-dog) statue with a dedication plaque.
\nExamining the plaque text and searching for Shisa donation records in Okinawa Prefecture identified the donor as 上原清善 (Uehara Kiyoyoshi).
\nFlag: TsukuCTF23{上原清善}
\n\nThis is a photo taken from a train window. Where is the building visible in the background?
\nThe flag format is
\nTsukuCTF23{latitude_longitude}.
The image was taken from a train and showed a distinctive building in the background.
\nBased on the train line and the visible landscape, this appeared to be in the Izu Peninsula area. Cross-referencing the building’s shape with satellite imagery identified it as the Izu TTC building at coordinates 35.064084, 139.0664.
Flag: TsukuCTF23{35.0640_139.0664}
\n\nThis is a screenshot. Find the original content.
\n
The provided image was a screenshot that appeared to show a YouTube video page.
\nAnalyzing the visible UI elements and partial text, I identified the video ID from the URL fragments visible in the screenshot and reconstructed the full YouTube URL.
\nFlag: TsukuCTF23{https://www.youtube.com/watch?v=...} (video ID recovered from visible fragments)
\n\nThis is a photo of a laser facility. Where is it?
\nThe flag format is
\nTsukuCTF23{latitude_longitude}.
The image showed an industrial facility. Searching for laser or ventilation tower facilities in Japan and comparing the architectural features, this was identified as the Umeda Suction Tower (梅田吸気塔) in Osaka.
\nThe coordinates are approximately 34.7016, 135.4991.
Flag: TsukuCTF23{34.7016_135.4991}
\n\nThis photo was taken somewhere in Hokkaido. Where exactly?
\nThe flag format is
\nTsukuCTF23{latitude_longitude}.
The image showed a snowy landscape with a building that appeared to be a café or restaurant.
\nBased on the snow volume, mountainous background, and architectural style, this was located in Hokkaido. Cross-referencing the building’s exterior with Google Street View in the Hokkaido area identified the location at approximately 42.968, 141.166.
Flag: TsukuCTF23{42.9680_141.1660}
\n\nWhat emperor established the country shown in this photo?
\nThe flag format is
\nTsukuCTF23{emperor_name}.
The image showed a historical map or artifact related to the ancient Japanese province of Tsukushi (筑紫), which corresponds to modern Kyushu.
\nHistorical records show that the administrative system organizing provinces including Tsukushi was established during the reign of Emperor Tenmu (天武天皇).
\nFlag: TsukuCTF23{天武}
\n\nThis video no longer exists, but it once existed on this platform. Find the original URL.
\nThe flag format is
\nTsukuCTF23{URL}.
The challenge involved finding a deleted YouTube video.
\nUsing the Wayback Machine (web.archive.org) to search for archived versions of the YouTube URL provided the original video URL.
\nFlag: TsukuCTF23{https://www.youtube.com/watch?v=...}
\n\nThis is a photo of a broken display sign. What shopping center is this?
\nThe flag format is
\nTsukuCTF23{facility_name}.
The image showed a partially visible or broken shopping center sign.
\nBased on the visible characters and the architectural style of the surrounding building, this was identified as NISHINOMIYA GARDENS (ららぽーと甲子園 / AEON MALL Nishinomiya Gardens).
\nFlag: TsukuCTF23{NISHINOMIYA_GARDENS}
\n\nThis is a photo of a sticker-covered surface. Where is this?
\nThe flag format is
\nTsukuCTF23{latitude_longitude}.
The image showed a surface covered with numerous stickers, typical of tourist spots in Japan.
\nBased on the style and content of the stickers and the background, this was identified as a location in the Atami area at approximately 35.0967, 139.0747.
Flag: TsukuCTF23{35.0967_139.0747}
\n\nThis is a photo of a flower bed in front of a historic building. What is the URL linked from the QR code on the sign?
\nThe flag format is
\nTsukuCTF23{URL}.
The image showed a flower bed with a sign containing a QR code in front of a historic building.
\nThe architectural style matched the Former Fukuoka Prefectural Public Hall Prestigious Hall (旧福岡県公会堂貴賓館).
\nScanning or reconstructing the QR code from the sign yielded the URL.
\nFlag: TsukuCTF23{http://www.fukuokaken-kihinkan.jp}
\n\nThis looks like an unused tennis court in Japan. Where is it?
\nThe flag format is
\nTsukuCTF23{latitude_longitude}. Truncate to 4 decimal places (5th decimal place truncated, not rounded).
The provided binary image showed a tennis court with what appeared to be a parabolic antenna in the background. The vegetation suggested a northern Japanese location.
\nSearching for “parabolic antenna tennis court side” quickly surfaced images of the Mizusawa VERA Observatory (水沢VERA観測所), the former International Latitude Observatory.
\nChecking Google Maps confirmed a tennis court next to a parabolic antenna at exactly the right relative positions.
\nFlag: TsukuCTF23{39.1349_141.1323}
\n\nSomeone’s Gmail address is partially unknown. Please help identify it.
\n\n
qeinijo#iby#@gmail.com(# = unknown characters)Note: Please avoid making many rapid requests to external services.
\n
According to other writeups, this challenge is solvable with the GHunt tool by brute-forcing the missing characters.
\nI avoided brute-forcing because I thought it was prohibited, but it seems GHunt-based enumeration is acceptable.
\nReference: TsukuCTF 2023 WriteUp #Security - Qiita
\nThis time, members who hadn’t participated in CTF for a while joined in, and almost the entire team competed together — it was a lot of fun.
\nThere were many problems and all of them were interesting.
\nThank you to the organizers!
","fields":{"slug":"/ctf-tsukuctf-2023-en","tagSlugs":["/tag/ctf-en/","/tag/rev-en/","/tag/osint-en/","/tag/english/"]},"frontmatter":{"date":"2023-12-10","description":"TsukuCTF 2023 Writeup — NES RE + 19 OSINT challenges","tags":["CTF (en)","Rev (en)","OSINT (en)","English"],"title":"TsukuCTF 2023 Writeup","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/ctf-tsukuctf-2023-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}