iTranslated by AI
Open xINT CTF 2022 Writeup (Team 40548F)
We are ryo-a, blackwasan, and kn1cht from Team 40548F, who participated in the Open xINT CTF 2022 held on October 29, 2022. We solved 14 out of 17 problems, scored 2800 points, and took 1st place. We would like to thank everyone at pinja for organizing the event.
This article summarizes our individual write-ups for the problems solved by Team 40548F.
Please note that this contains spoilers. The FLAG strings themselves are not included.
The problem statements and images are quoted from the competition system.
Problem List
| Challenge | Category | Points | Solved by |
|---|---|---|---|
| saitaku | HUMAN | 200 | kn1cht |
| ho ho ho | HUMAN | 300 | ryo-a |
| kura | HUMAN | 400 | - (unsolved) |
| Yokohama | HUMAN | 500 | - (unsolved) |
| spacious | PLACE | 100 | blackwasan |
| VIDEO | PLACE | 100 | kn1cht |
| BUS | PLACE | 200 | blackwasan |
| BUS2 | PLACE | 200 | ryo-a |
| 3month | PLACE | 300 | ryo-a |
| tank | PLACE | 300 | ryo-a |
| nice view | PLACE | 300 | blackwasan |
| BRIDGE | PUBLIC | 200 | kn1cht |
| happy birthday, yall | FOOD | 200 | ryo-a |
| whois | NET | 100 | kn1cht |
| SSID | NET | 100 | ryo-a |
| BB | NET | 200 | kn1cht |
| Altai | CLOUD | 200 | - (unsolved) |
Looking at the Solve Percentages, you can see the trail of destruction...
saitaku (200pt)
(Solved by: kn1cht)
この商品を販売している会社の社長の名前をフルネームで答えよ。
Who is the president of the company that sells these products? Answer his full name.
I was given a photo of a "SUSHI KIT" from a company called Saitaku. It seems to be a company that sells Japanese food in Europe. A quick Google search led to their website, and the Contact page lists a person's name as the contact point.
However, this person seems to be the Sales Manager and not the President. Since a company should have a registration record at its registered address, I investigated using the company name and location information.
- Company Name: Ethnic Distribution GmbH (Saitaku Ltd didn't yield results)
- Location: Rotkreuz, Switzerland (A town in the Canton of Zug, Switzerland)
I searched Google for "commercial register switzerland," found the database for the Canton of Zug, and searched for Ethnic Distribution GmbH to find the registration record. The name of the president was the FLAG.
hohoho (300pt)
(Solved by: ryo-a)
This company exhibits and sells items you'll want for the coming season.
The company, which also does [redacted] to [redacted], even has a cheese expert who is a member of a certain guild.
Answer that person's full name in Kanji.
Managers of this company that sells seasonal products actively engage in many fields.
Some have *** to an ***, and one of them is an expert & a member of a cheese guild.
What is the name of the expert?
Answer in the full name in Kanji.
An image showing firewood stoves was attached. Is it a stove shop?
Searching for "Stove [redacted]" hit a video from a local newspaper, revealing the company name. To narrow down the employee, I searched for "company name + guild" and found a PDF newsletter introducing a guild event.
Searching within the page for the company name hit a person with a profile that seemed right. This person's name was the FLAG.
spacious (100pt)
（Solved by: blackwasan）
写真に写っている場所の名前を答えよ。
What is the name of this place in the photo?
Two photos were provided. It looks like a plaza between buildings. In the photo with the fence, there is a red "T" logo and the characters "Mobility Pa...", "TOYOTA".
Searching for "Mobility TOYOTA" revealed a Toyota group company called "Toyota Mobility Parts". Searching on Google Maps showed multiple candidates in major cities nationwide. First, I used aerial photos to look for candidates in Tokyo that looked like a plaza adjacent to the site.
I found a candidate, "Toyota Mobility Parts Co., Ltd. Tokyo/Yamanashi Regional Branch" near Shiba Park in Tokyo, which matched the atmosphere of the photo. Fortunately, I could see Street View inside the park, so I checked it.
There is a fence.
Going to the other side of the fence, I found it. Since the shapes of the adjacent buildings also matched, I tried submitting "Shiba Park", but it was rejected. It turned out the plaza at the shooting location had a name like "[Name] Plaza", and submitting that was correct. I think I was able to solve this relatively smoothly by searching for what was visible.
VIDEO (100pt)
（Solved by: kn1cht）
動画の開始地点の座標を答えよ
フラグ形式: Nxx.xxxx Exxx.xxxx
Answer the coordinates of the start of the video.
FlagFormat: Nxx.xxxx Exxx.xxxx
(OneDrive video URL)
A dashcam video of about 20 seconds driving on a road in Japan was provided. Looking until the end, a sign for "XX PA ETC-only entrance" appeared, and the video ended.
The characters for the PA name were blurry, but I thought maybe "Kimitsu PA"? Searching Google for "Kimitsu PA ETC" showed a sign with a similar design. It seems to be the Smart IC for the Tateyama Expressway Kimitsu PA. It's a structure where you can enter the parking area from ordinary roads.
Looking at the entrance to Kimitsu PA on Google Street View, although the sign display was different (possibly due to the timing of the shooting), the exact same location appeared.
Then, I just needed to go back to the starting point while comparing with Street View to get the coordinates. It was fun as the solving process felt like Geoguessr.
BUS (200pt)
(Solved by: blackwasan / Assist: ryo-a)
このバスの位置を求めよ
フラグ形式: Nxx.xxx Exxx.xxx
Answer the coordinates of this bus.
FlagFormat: Nxx.xxx Exxx.xxx
This is a photo showing a bus prominently. It is clearly a Nippon Rent-A-Car shuttle bus. Since "AIRPORT⇔NR..." is written on the rear side of the vehicle, it can be inferred that it is a bus connecting an airport and somewhere (perhaps the rental car pickup location?).
I mistakenly thought the "NR" string stood for Narita. Relying on the characters printed on the road, which were likely "レンタカー" (Rent-a-car), I searched for the area around the airport's boarding and alighting points using aerial photos. However, no matter how much I searched, I couldn't find a matching spot. Thinking this might not be Narita... I decided to explore other airports.
Looking closely at the vehicle model, I realized it was a HINO Liesse (Thanks, ryo-a!).
Carefully reviewing the image search results for "Nippon Rent-A-Car shuttle bus," I found that a base operating matching vehicle types exists at Asahikawa Airport. A blog post by a travel enthusiast shows a similar bus at the end. It says "AIRPORT⇔NR Station." Does NR stand for Nippon Rent-a-car? I was fooled by the NR initials.
Looking around Asahikawa Airport again for roads with "Rent-a-car" (レンタカー) printed on them...
Found it. There is a "レンタカー" marking in what looks like a parking lot.
I checked with Street View just to be sure. There was a structure that matched the shape of the building visible through the windows of the bus in the problem photo.
I estimated the approximate location from the angle of the photo and submitted it. It was correct. It was a dangerous problem where getting stuck in a preconception could lead to a dead end.
Reference: An otaku suddenly declaring the vehicle model name upon seeing the photo.
BUS2 (200pt)
(Solved by: ryo-a)
このバスの位置を求めよ。
フラグ形式: Nxx.xxx Exxx.xxx
Answer the coordinates of this bus.
FlagFormat: Nxx.xxx Exxx.xxx
A bus problem, a staple of xINT. Nothing starts without looking at the bus first. Let's zoom in.
The name "Family Kanko" (ファミリー観光) is visible on the front of a Mitsubishi Fuso Aero Midi. A straightforward search leads to the company's website.
The model is different, but the paint job matches.
I found out that the company is located in Iwate Prefecture.
Considering the location of the bus company, it is highly likely that this sign indicates an Iwate Prefectural Road. (Though the possibility of a neighboring prefecture cannot be ruled out.)
Searching for "Iwate Prefectural Road Route 25" (岩手県道25号) hits the following sign.
The attachment at the bottom is also similar, so we can be almost certain.
Near the starting point of Iwate Prefectural Road Route 25 (Undokoen-guchi Intersection) by Gameshopaki CC BY-SA 4.0
Next, let's identify where on Route 25 this is.
While I could use Street View to brute-force this distance, it's a bit inefficient.
An image search hits a road with a similar atmosphere. It might be a famous road for motorcycling or touring.
From the image search, I jumped to a site for searching touring spots. I found an article written by a rider.
That's it! Let's go to the Super Forest Road. | Touring report by rider Nezuchu
Doesn't the atmosphere look very similar?
"Hayachine-san Odagoe trailhead" (早池峰山小田越え登山口) looks suspicious. Searching for it shows the following spot, so I take a look with Street View.
Bingo. This is a photo taken from the trailhead looking towards the back (west side) of the image.
Finally, I input the coordinates to answer.
Since manually typed coordinates can sometimes deviate from the FLAG, trying a few times while slightly adjusting the position will get it through.
I was braced for a difficult bus problem as they are known to be tough in the past, but I was saved by a relatively simple one this time.
3month (300pt)
(Solved by: ryo-a / Assist: kn1cht)
この建物の座標を求めよ。
フラグ形式: Nxx.xxx Exx.xxx
Answer the coordinates of this building.
FlagFormat: Nxx.xxx Exx.xxx
In Russian, it says "Russian Army Mariupol Residents."
In our team, ryo-a and kn1cht can read some Cyrillic (Russian and Ukrainian), so being able to read it helped save time during the investigation.
Mariupol is a city in southern Ukraine, famous for being invaded and occupied by the Russian army.
An image search led to an article with the title "В Мариуполе открыт построенный Минобороны новый многофункциональный медицинский центр" (New multifunctional medical center built by the Ministry of Defense opened in Mariupol), presumably published by the Russian Ministry of Defense. However, the article returned a 403 error and was inaccessible. Given the current situation, Russia is likely restricting access from abroad.
However, knowing from the title that "a medical center was built in Mariupol by the Ministry of Defense" was sufficient.
So, I searched for "медицинский центр Мариуполь."
(Since it was expected that the Russian side would post propaganda articles about building a medical center, I used the Russian spelling instead of the Ukrainian Маріуполь to search.)
This led to the following article:
В Мариуполе и Луганске открыли медцентры, построенные российскими военными в рекордные сроки
There is a 4-minute video, but the important part is only the first 20 seconds. The latter half just introduces the hospital.
The building appearing at the start of the video matches the one in the problem.
Now that I knew it was in Mariupol, I thought about brute-forcing the search in the city center, but aerial photos on Google Maps might not reflect the latest state.
Particularly in this case, the article saying it was "built" came out very recently (September 2022), so it was highly likely not yet reflected in aerial imagery.
However, a characteristic building is visible in the background of the video.
It's an Orthodox church frequently seen in Eastern Europe. Since it's unlikely such a facility was built suddenly, I decided to search for it.
However, despite it being a characteristic building, I couldn't find it easily by myself.
If Google Maps supported 3D, it would have been easier, but since there is only 2D data, I had to stare at the aerial photos.
In desperation, I tried to launch FS2020 to view it from the air, but I had neglected the updates and had to give up. Waiting for a 78GB download would certainly be slower than looking at aerial photos.
(I don't know if it would have been practical since I gave up, but I plan to keep FS updated for future CTFs.)
There's no way I'd make it in time...
When I requested help on voice chat, kn1cht found it immediately.
(kn1cht's supplement) I did a Google image search for "mariupol church" and found on a travel guide site that it was the Cathedral Of St. Nicholas. Searching for "Nicholas Cathedral" near Mariupol on Google Maps was enough.
Based on the direction in the video, I clicked on the empty spot on Google Maps (around the road labeled Levatiana St) and entered the coordinates. Of course, it didn't hit perfectly, so I tried a few times while slightly changing the third decimal place and successfully got the correct answer.
By the way, the problem name "3 month" seems to come from the fact that the Russian side advertised that "this hospital was built in 3 months" to showcase their governance capabilities. If you can't read Cyrillic, you might have reached the Mariupol hospital through this approach.
This is a current events problem following last year's Kabul. The team had anticipated questions related to the situation in Ukraine, so we are relieved to have solved it.
On the other hand, solving this problem forced us to confront the realities of the war and imagine the situation on the other side of the screen. I sincerely hope that peace and sovereignty will be restored to Ukraine swiftly, and the day will come when residents and travelers can visit this church in peace.
tank (300pt)
(Solved by: ryo-a / Assist: kn1cht)
この場所の戦車の位置を求めよ。
フラグ形式: Nxx.xxxx Exx.xxxx
Answer the coordinates of this tank.
FlagFormat: Nxx.xxxx Exx.xxxx
https://twitter.com/huruank/status/1352248366143574020
(kn1cht) This is another Russia-related problem following 3month. However, as you can see if you translate the text of the tweet, this is not from this year but is a photo from the South Ossetia conflict that occurred in August 2008. Putting this image into Google Image Search brings up articles like the following:
What is shown is a Georgian army tank (T-72?) destroyed by the Russian army, and the shooting location is stated to be Tskhinvali (ცხინვალი), the "capital" of South Ossetia.
So I opened Tskhinvali on Google Maps to start the search, but this city has no Street View and only a few 360-degree photos. Even though I tried to find the building with the red roof shown in the photo, the whole city is full of similar red roofs, making it impossible to narrow down. The photographed tank seems famous, and photos from various angles appear in searches, but detailed locations cannot be determined from descriptions or Exif information.
Left with no choice, I looked at the few 360-degree photos and found a large building with a red roof similar to the photo. It looked like the view from a park where a monument stands.
Based on this, I submitted coordinates for the southeast vicinity of the red-roofed building, but it was incorrect (actually, the correct point was very close, and I would have been correct then if I had answered based on the building on the road crossing at right angles! I should have tried it...).
Since I got stuck, I swapped problems with ryo-a's 3month at this point.
(ryo-a) From here, ryo-a takes over the problem. Let me briefly recap how kn1cht reached this point.
I figured the key would likely be the aerial photos of Tskhinvali and braced myself for a brute-force search. I looked through red-roofed buildings one by one, but couldn't find anything that looked like it.
I moved to other problems a few times, but even after spending a lot of time, the situation remained at a standstill. Since this was 14 years ago during the 2008 South Ossetia conflict, I considered that rebuilding or renovation was quite possible, so I decided to look for information other than the roof.
First, the building in the background. It looks to be about two stories tall. There is a part protruding from the main section of the building. Also, there seems to be an open space between this building and the one on the right.
The building on the right is a building with at least 4 floors.
The ground floor entrance section protrudes, which should be distinguishable even in aerial photos.
It seems this tank is treated as a famous scene symbolizing the conflict, and multiple media outlets have photographed the same thing from different spots.
Stock photos and YouTube videos also appear. Links are listed below:
- https://www.upi.com/News_Photos/view/upi/297c0cbd9fec5c2568ad511ae8f4ee79/Russian-soldier-passes-a-destroyed-Georgian-tank-in-Tskhinvali/
- https://www.alamy.com/a-destroyed-georgian-tank-is-seen-in-the-center-of-the-south-ossetian-capital-of-tskhinvali-on-august-14-2008-upi-photoanatoli-zhdanov-image258396533.html
- https://www.alamy.com/russian-soldier-passes-a-destroyed-georgian-tank-in-the-south-ossetian-capital-of-tskhinvali-on-august-11-2008-upi-photoanatoli-ivanov-image258396524.html
- https://www.youtube.com/watch?v=rdXw-F-xxoo
To the right rear of the road where the tank is, there seems to be a wide road with street trees.
From the stock photo above, we also know that there is an apartment complex of about 5 floors on the left side of the road where the tank is located.
Organizing the information other than roof color, it looks like this:
I searched for this diligently. Really, just brute-force searching.
Then, I found an intersection like the following.
Since the FLAG format requires coordinates up to 4 decimal places, I struggled with adjusting the deviation, but the FLAG coordinates are here.
nice view (300pt)
(Solved by: blackwasan)
この写真を撮影したポイントのplus code（7桁）を答えよ。
Where did I take this photo? Answer the plus code (7 digits).
A photo of a beautiful ("nice view") sea and mountains taken from what appears to be a mountain peak.
Looking closely, you can see a small island separated from the land in the sea. Despite this, a large white structure and several tower-like objects can be seen on the island. Geographically, the terrain shows mountains pressing right up to the coastline. Additionally, a relatively developed urban area (likely not just a fishing village) with apartment complexes can be seen in the lowlands.
Relying on these clues, and praying that the answer was in Japan, I searched the coastlines of the Japanese mainland on aerial photos to see if there was a matching area. Coastlines are finite. Since areas with wide coastal plains can be excluded based on the terrain, the search target was somewhat limited.
I proceeded without knowing what the building was, but I couldn't find any suspicious spots like an island loaded with these artificial objects. I searched the coasts of the Tohoku region, Hokkaido, Izu, the Kii Peninsula, and Shikoku, but nothing came up.
(Toba City, Mie Prefecture, which I passed through. It had a similar vibe, but wasn't it.)
Thinking it looked like a scenery one might see in Setouchi, I went on a "Great Voyage" through the Seto Inland Sea like Columbus, but no new islands were discovered. I took a break, thinking, "It doesn't really feel like a sea of many islands; there's a vast open ocean..."
I thought I might be misjudging the distance to the island, so I decided to carefully observe even areas more than 5km away from the coastline and searched again.
Then, Hatsushima in Atami, famous as a resort, emerged as a candidate. Comparing it with the photo, it felt quite far from the land, but for caution, I used Google Earth to examine the view from around the Izu Skyline and realized it didn't look that far away.
Zooming in on the Hatsushima in question, I found a large hotel built on the southern tip of the island, which did not contradict the problem. Searching for parking spots along the Izu Skyline that would be easy to photograph from, I found it.
The Plus Code required for the answer is Google's unique address code. It's a string like "25R38+V" that appears when you select a point on Google Maps, acting as a substitute for coordinates. I submitted the corresponding Plus Code and it was correct.
bridge (200pt)
(Solved by: kn1cht / Assist: ryo-a)
問題15(VIDEO)の動画で渡った橋の取得金額はいくらだった？ 数字で答えよ。
What is the purchase price of the bridge in the Challenge 15 video? Answer the numbers.
This is a continuation of VIDEO. When did we cross a bridge in the footage? It was right at the beginning—crossing a small bridge over the Miyashita River.
First, ryo-a found the bridge in question on a site called Zenkoku Q Chizu (National Q Map). It has a data map called "2018 National Bridge Map," where you can find bridge names and completion dates.
(ryo-a's supplement: This is a famous site in civil engineering circles, and you can identify the names of even small bridges that don't have nameplates.)
Please note that while this material is useful, there are positional deviations due to differences in geodetic systems or input errors in the original source materials.
From Q Chizu tiles and GSI tiles
Two bridges, "Ohashi" and "Shinryujibashi," appear overlapping at the target location. We couldn't narrow it down during the competition, so I searched for the one that seemed easier to find, "Shinryujibashi," with "Kimitsu City "Shinryujibashi"" (results differ with/without double quotes). This led to an Excel file titled Fixed Asset List - Kimitsu City.
It has about 7,800 rows, but searching for "Shinryujibashi" makes it easy to find, and "Ohashi" is right above it. Then I just had to determine which bridge it was and answer the purchase price (setting aside that you could find out by submitting both).
Looking at the video, it was a narrow road, so I thought it couldn't be called "Ohashi" (Great Bridge). I submitted the price for Shinryujibashi and it was correct.
happy birthday (200pt)
(Solved by: ryo-a / Assist: kn1cht)
今年、54歳の誕生日をラスベガスで祝ったシェフ。
そのとき同行した新人カメラマンの青年も、それから数ヶ月後に25歳の誕生日を迎えた。
素敵なバースデーケーキのプレゼントに喜ぶ青年だったが、もしかして当日撮影用に作った料理の方がお気に入りだったかも？
その料理の名前を正確に答えよ。
A chef made a trip to Las Vegas to celebrate his 54th birthday this year.
A few months later, when a newly-joined camera crew had his 25th birthday, the chef surprised him with a beautiful birthday cake.
He also seemed to be happy with the dish they filmed that day.
What is the name of the dish?
Answer in the exact phrase.
Early on, kn1cht had found the following video:
(kn1cht's supplement) Searching Google for "Las Vegas 54th birthday" brings up a YouTube video near the top. Since the poster is called "Chef" in the comments, I thought it was a strong candidate.
I identified the 54-year-old chef, but I had no idea who the "newly-joined camera crew" youth was. For now, I'll search for videos posted on the channel after this Las Vegas trip.
There are three videos containing "BIRTHDAY" in the title:
- https://www.youtube.com/watch?v=fHncTmM_n7s
- https://www.youtube.com/watch?v=PExkuzGdkiY
- https://www.youtube.com/watch?v=8Hf8QneoY4k
Since each video is fairly long, watching them all would be a huge time loss. I'll skip checking the "happy with the dish they filmed that day" part and just try brute-forcing likely-looking dish names.
Fortunately, the dish name was at the beginning of the description of the first video, and I got it right immediately.
whois (100pt)
(Solved by: kn1cht)
194.146.200.33 のAS番号を答えよ.
Answer the AS number for 194.146.200.33.
This is the annual (?) whois question. An AS (Autonomous System) number is a number assigned to each group of networks that make up the internet.
First, I tried running $ whois 194.146.200.33, and although a number in the format "AS{number}" was written in the origin field, this was incorrect.
So, I visited several sites that provide IP address information and found that I could confirm the AS number on urlscan.io (ipinfo.io etc. are also OK). I entered that and got it right.
SSID (100pt)
(Solved by: ryo-a)
SSID:YKAMEのBSSIDを答えよ
Answer the BSSID of SSID:YKAME.
Simply open View → Map on WiGLE, a site where SSIDs from all over the world are recorded, and filter by "YKAME" in the SSID field. Be aware that you cannot see detailed information unless you register an account and log in.
By default, the US West Coast is displayed. Given the nature of the problem, I considered the possibility of it being an overseas SSID, but searching for "YKAME" hit a Japanese security engineer's Twitter account. Based on that, I guessed it might be a Japanese SSID and aligned the map to Tokyo before filtering.
BB (200pt)
(Solved by: kn1cht)
バルバドスの仮想通貨に関するドメインで、使われていない登録済みドメインのRegistry Domain IDを示せ。
What is the Registry Domain ID for an unused registered domain of Barbados cryptocurrency?
Barbados's country-code top-level domain is .bb. I wondered what "related to cryptocurrency" meant, but I decided to take a guess and check crypto.bb with the whois command.
While the whois information didn't appear directly, it informed me, "This TLD has no whois server, but you can access the whois database at http://whois.telecoms.gov.bb/search_domain.php," so I went to that URL. It was a whois search service operated by the Barbados Telecommunications Unit.
This service is quite excellent and allows searching with even a part of a domain name. Searching for "bitcoin," which seemed related to cryptocurrency, brought up bitcoin.bb and bitcoins.bb. Since the former was actively being used, I answered the Registry Domain ID of the latter and got it right.
As a side note unrelated to the solution, a site called "Domain Island Tour" (ドメイン島巡り) has very interesting local travelogues and interviews with registry personnel. It mentions things like how it temporarily became popular due to the influence of the BlackBerry smartphone and that the registration requirements are strict (which is also evident from the small number of domains that appear when searching in this problem).
Participation Notes
ryo-a
I am ryo-a, the one who planned this participation and served as the Captain. Although I say Captain, my only job was really just registering the team.
My background is in Economics, my work involves building and operating UX simulation environments, and my hobby is being a geography and transit nerd.
I solved 6 problems and scored 1400 points. That said, there were various problems where I received assistance, so this is strictly the score based on the FLAGs I personally entered for the team. We were able to win thanks to it being a team effort! 💪
This result was only possible thanks to kn1cht's expertise in Web and Eastern Europe-related problems, and blackwasan's strength in domestic geography. I am truly grateful to them.
Since we are members who usually casually challenge each other with "Place" problems using Street View and our own photos, I participated with the goal of at least solving all the Place problems correctly.
I achieved the goal of correctly answering all the Place problems, and to my surprise, we even took 1st place. While there are many points for reflection—such as inefficient searching and having no clue how to solve the cloud problem—I want to simply celebrate the result.
The only problems I solved elegantly were probably BUS2 and hohoho; for everything else, I feel like I spent about 60% of my time on brute-force searching. I realized that this "brute-force searching without giving up" is also an important element of OSINT.
I am a beginner who knows nothing about other fields like HUMINT or SIGINT, so I hope to continue improving and participate again next year and beyond.
The person who, at the time of forming the team, never expected to take 1st place and was calling for everyone to "just take it easy and not get too worked up."
blackwasan
I am blackwasan, a member of this team. My background is in Computer Science, and I currently work in a weather-related field as a certified weather forecaster. I love everything that exists on the Earth's surface.
I solved 3 problems, mainly in the PLACE category, for 600 points. I joined after being invited by my peer ryo-a, with whom I frequently exchange location-identification problems. Being a natural geography nerd who spends an abnormal amount of time on Google Maps, Japanese terrain, road networks, and landscapes have been gradually imprinted into my mind as mental models.
Normally, I act like a mysterious contractor, receiving photo problems from ryo-a with extremely few clues and providing answers within a few days. I was a bit apprehensive since this was my first formal CTF competition, but by steadily working through the problems I could solve, I think I was able to contribute to the team at least a little.
Since I specialize in maps, my goal for the day was to complete all the PLACE problems.
I finished the first one, spacious, without much trouble, and for the second one, BUS, I was able to identify it using familiar aerial photos with help from ryo-a. For the third one, nice view, although clues were scarce, I managed to finish it despite it taking some time due to its characteristic elements. (Don't tell anyone that I peeked at Taiwan along the way.)
By that point, I had completed the PLACE problems, and finally, difficult ones like Yokohama and kura remained. The three of us thought about them for a while, but the sun went down without finding a decisive key, and the competition ended.
While I solved only a few problems, seeing the other two members—who are experts on overseas situations like Russia—clear problems like tank so calmly was very reassuring. They are powerhouses who can easily pull up things like a local government's fixed asset list (.xls) that make you wonder where they even find them, so I expect they will continue to perform remarkably in the future.
As a result, I am proud that we achieved the best possible outcome—1st place—in our first appearance. I'm grateful to my teammates.
Specific images that ryo-a had previously given to blackwasan for identification.
kn1cht
I am kn1cht. I also joined the team after being invited by ryo-a. My background is in Engineering, and I am currently researching virtual reality at graduate school.
My CTF experience was limited to participating in SECCON CTF a few years ago, where I struggled to solve anything (my assigned fields were Web and Forensics). Since this was my first OSINT CTF, I prepared by reading last year's Writeups to understand the flow of solving and the necessary tools to be at least somewhat useful.
In the actual competition, I solved 5 problems for 800 points.
- 12:00–12:30: Everyone quickly grasped the problem content. We started dividing and solving the easier-looking PLACE problems. Solved
whoisandVIDEO. - 12:30–13:30: Identified the target region for
tankquickly, but found it difficult because there was no Google Street View and all the buildings looked the same. It was tough. - 13:30–14:30: Got stuck and started looking at other problems but couldn't solve them. Meanwhile, ryo-a and blackwasan were knocking down two BUS problems.
- 14:30–15:30: Had a sudden flash of inspiration and solved
saitakuandBB. Following a suggestion from ryo-a, we swapped the two Russia-related problems the other two were working on. As a result, I assisted in solving3month. - 15:30–16:30: Took over and solved
BRIDGE, which ryo-a was stuck on. ryo-a finally solvedtank. - 16:30–18:00: Only
kura,Yokohama, andAltairemained unsolved. The three of us took turns investigating, but in the end, we couldn't solve any of them before the match ended.
I am satisfied that I could contribute in a balanced way to location identification and Web problems. On the other hand, it was quite a waste that I spent more than half of the total time struggling with tank... After hearing the impressions of other participants later, I realized there were many shortcuts I hadn't noticed, so I feel like I need to keep improving.
As a team, the close information sharing via Discord voice chat and shared notes in Google Docs made it easy to exchange or take over problems being solved. There were quite a few problems where I reached the correct answer by having the other two solve parts or give me hints, so I really felt the benefits of being in a team.
Discussion