{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-xintctf-2021-en","result":{"data":{"markdownRemark":{"id":"a0346797-e146-56da-8d3f-f19dc3ce9d5a","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in xINT CTF 2021, held at AVTOKYO 2021 on October 23, 2021!

\n

I ended up in 7th place with 2550 points, which was unfortunately not good enough to reach the top tier, but I had a great time solving problems with two friends as a team for the first time in a while.

\n

\n \n \n \n \n \n \n \n \n

\n

From the problems I tackled, I wrote up the ones that were interesting and solved, as well as the ones I was frustrated not to solve.

\n\n

Table of Contents

\n\n

Solved

\n

TOKYO2020 (150)

\n

This was the first BUS challenge.

\n

\n \n \n \n \n \n \n \n \n

\n

Downloading the image yielded this:

\n

\n \n \n \n \n \n \n \n \n

\n

Here is the downloadable image:

\n

\n \n \n \n \n \n \n \n \n

\n

Carefully reading the sign in the direction the bus is traveling reveals Cold Spring Valley.

\n

Searching for schools in Cold Spring Valley turned up a school officially named Michael Inskeep Elementary School that was scheduled to open in Cold Springs in the summer of 2021.

\n

Reference: Building / School Naming

\n

Searching by this person’s name led to the following page, where the alt text of an embedded image revealed his wife’s name:

\n

Reference: Inskeep Elementary / Namesake: Michael Inskeep

\n

Unsolved

\n

DISK

\n

Here is the problem:

\n

\n \n \n \n \n \n \n \n \n

\n

And the downloaded image:

\n

\n \n \n \n \n \n \n \n \n

\n

Googling the corporate motto visible in the background of this image reveals that it belongs to Pioneer Corporation.

\n

The image shows a statue and a music box, so I searched for things like “Pioneer statue” and “Pioneer music box.”

\n

A search for “Pioneer statue” returned this blog near the top.

\n

\n \n \n \n \n \n \n \n \n

\n

It turns out the image shows Pioneer’s Kawagoe plant main entrance.

\n

However, entering the coordinates of the Kawagoe plant from Google Maps did not lead to the correct answer.

\n

Solution

\n

According to the Open xINT CTF 2021 write-up, the EXIF data of the image on the blog above contained location information, and the correct answer was a point slightly offset from it. (Who could possibly solve that…?)

\n

That said, what I genuinely felt I lacked was the immediate awareness that resized images have their EXIF data rewritten.

\n

The image in the article was served in a resized form like [h]ttps://xxxxx/xxx/img_7433.jpg?w=460&h=345, so I needed to download the original unresized image at [h]ttps://xxxxx/xxx/img_7433.jpg to extract location data from the EXIF.

\n

In hindsight it is obvious, but going forward I need to remember to obtain the original image before reading EXIF data.

\n

past certificate

\n

Here is the challenge.\nThe task was to identify the serial number of the last certificate for a domain that had already been closed (ccc.go.jp).

\n

\n \n \n \n \n \n \n \n \n

\n

I searched around OCSP-related data since the certificate seemed to be expired, but could not find useful information and gave up.

\n

Solution

\n

It turns out this was a problem about understanding Certificate Transparency (CT), a mechanism for certificate issuance and monitoring.

\n

Reference: Let’s learn about Certificate Transparency

\n

Certificate Transparency is defined in RFC 6962; it is a system for recording all certificates issued by certificate authorities as open-source logs so that incorrect or malicious certificates can be monitored by everyone.

\n

Certificate logs are recorded on public servers called CT log servers.

\n

If a certificate supports CT, the CT log server returns a valid SCT (Signed Certificate Timestamp).

\n

CT log servers exist around the world; well-known ones include Google’s servers as well as those from DigiCert and Symantec.

\n

You can search CT server logs at sites like crt.sh. In this problem, searching for the certificate through this site would have led to the Flag. Interesting.

\n

pilgrimage

\n

The challenge was as follows:

\n

\n \n \n \n \n \n \n \n \n

\n

I quickly found the address of the house from the TV drama by Googling, but I could not figure out how to identify the Cell ID of the nearby base station, so I gave up.

\n

I was so stuck that I seriously considered driving out to Yamanashi to check in person (laughs).

\n

Solution

\n

Looking at writeups, it turned out the answer could be found using OpenCelliD, an open-source cellular base station database.

\n

Reference: Open xINT CTF 2021 write-up

\n

I wonder why I didn’t find this site despite searching for so long…

\n

Summary

\n

OSINT CTFs are not something I usually tackle, so it was a refreshing and very enjoyable experience.

\n

It reminded me how fun it is to participate as a team, so I would like to team up with someone more often for CTFs going forward.

\n

In any case, many thanks to the AVTOKYO organizers and the team members who participated with me!

","fields":{"slug":"/ctf-xintctf-2021-en","tagSlugs":["/tag/ctf-en/","/tag/osint-en/","/tag/english/"]},"frontmatter":{"date":"2021-10-24","description":"A writeup covering the interesting problems and the ones I learned the most from at xINT CTF 2021.","tags":["CTF (en)","OSINT (en)","English"],"title":"[OSINT CTF] xINT CTF 2021 Writeup (AVTOKYO 2021)","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/ctf-xintctf-2021-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}