STORY DRIVEN OSINT CTF

easy
medium
hard
insane

Lost Down Under

Briefing

Greetings, Special Agent.

We need your assistance in an urgent matter. Our client, the Australian Secret Intelligence Agency, ASIS for short, has requested our help to uncover a terrorist organization. This group, who’s name is yet to be uncovered, has shown intent on bombing several locations around Australia. Their origins are confirmed to be domestic, with money coming in from Chinese non-government actors. Several hours ago, one of our Red Teams was able to breach one of the terrorist groups’ email accounts. There was a single email, containing a cryptic looking text and a total of seven images. We need you to figure out what these seven images and text mean. Are they connected? Is this a rabbit hole? With our current information, we have reason to believe these images are directly related to the suspected plans for bombings.

As always, Special Agent, the contract is yours, if you choose to accept.

Materials

Starting Text

GEYTMIBRGE2CAOJXEAYTCMBAGEYTKIBRGA4SAMJQGUQDCMJVEAYTCNJAGEYDKIBRGEYSAMJRGAQDGMRAGEYTAIBRGE3SAMJQHEQDSOBAGEYDCIBRGE2CAMZSEA2TEIBVGMQDKNRAGU3SANJUEA2TEIBVG4QDKNRAGUYSAMZSEAYTCMBAGEYDCIBRGAYSAMJQGAQDCMJVEAZTEIBRGA4SAMJRG4QDCMBYEAYTCNRAGEYDKIBRGEZCAMJQHAQDCMBVEA4TSIBZG4QDCMJWEAYTANJAGEYTCIBRGEYCAMZSEAYTCOJAGEYDKIBRGE3CAMJQGQQDGMRAGEYTMIBRGA2CAMJQGEQDGMRAGEYDGIBRGAYSAMJRGEQDCMBYEAYTCMJAHE4SAOJXEAYTCNRAGEYDKIBRGEYSAMJRGAQDGMRAHE3SAMJRGAQDCMJVEAYTCOJAGEYDCIBRGE2CAMZSEAYTCNRAGEYTCIBTGIQDCMJXEAYTCMBAGEYDQIBRGEYSAOJZEAYTANZAGMZCAMJRGYQDCMBUEAYTAMJAGMZCAMJQGIQDCMBVEAYTAOBAGEYDCIBUGYQDGMRAHE3SAMJQGAQDCMBQEAZTEIBRGE3CAMJQGQQDCMBREAZTEIBRGAZCAMJQGUQDCMJUEAYTCNJAGEYTMIBTGIQDCMJWEAYTANBAGEYTIIBRGAYSAMJQGEQDGMRAGEYDQIBRGAYSAMJRGYQDCMJWEAYTAMJAGEYTIIBRGE2SAMZSEAYTCMJAGEYDEIBTGIQDSNZAGEYDQIBRGA4CAMZSEAYTCNJAGEYTMIBRGE2CAMJQGEQDCMBREAYTCNRAGEYTAIBZG4QDCMBZEAYTAMJAGEYTKIBTGIQDCMBVEAYTCMBAGMZCAMJRGEQDCMJUEAYTAMBAGEYDCIBRGE2CAMZSEA4TOIBRGE3CAMZSEAYTCNRAGEYDIIBRGAYSAMZSEAYTAMJAGEYTAIBRGAYCAMZSEAYTCMJAGEYDEIBTGIQDCMJWEAYTANBAGEYDCIBTGIQDCMJQEAYTCNZAGEYDSIBZHAQDCMBREAYTCNBAGEYTKIBUGYQDGMRAGEYTSIBRGAYSAMZSEAYTCOJAGEYDKIBRGA4CAMJQHAQDGMRAGEYTKIBRGE3CAOJXEAYTCNBAGEYTMIBTGIQDCMJREAYTCMRAGEYDCIBRGE2CAOJXEAYTCNRAGEYDKIBRGEYSAMJRGAQDGMRAGEYDOIBZG4QDCMJQEAYTAMZAHE3SAMJRGQQDCMJREAYTCMJAGMZCAMJRGEQDCMJQEA4TSIBRGAYSAMZSEA4TOIBRGA4CAMJQHAQDGMRAHE4CAMJRGEQDCMBZEA4TQIBRGE2SAMZSEA4TOIBRGE2CAMJQGEQDGMRAGEYDKIBRGEYCAMZSEAYTCMRAGEYDQIBZG4QDSOJAGEYDCIBUGY======
image 01
image 02
image 03
image 04
image 05
image 06
image 07

Answer Instruction

Use the answer to unlock the flagfile, this will reward you with your badge.

You will know it when you have it, it’s a long code.

Flagfile

Be advised, the flagfile is an encrypted ZIP. Make sure your OS supports the ZIP format. Ensure the password contains no hidden characters or formatting, paste in Notepad first if the password doesn’t seem to work.

Download Flagfile here

PS: Don’t forget to claim your Coins and XP, by posting your card in the #card-brag channel in Discord.

Official Write-up

Provided here is the official write-up, it does contain the answer. Use this if you’re stuck, or want to verify if you got the answer correct.

Lost Down Under

This contract involves a group of domestic terrorists in Australia who are planning to use camels to transport explosives and carry out attacks. The Tiberian Order has intercepted an encoded message and a set of images that they believe are related to the terrorists’ plans.

Challenge Objectives

  • Decode the encoded message
  • Geolocate the locations shown in the provided images
  • Connect the locations on a map to reveal a numerical code
  • Use the numerical code to unlock the final solution

Solution Steps

Step 1: Decode the Encoded Message

The briefing states that the intercepted communication contains a “cryptic looking text” that needs to be decoded. By analyzing the message, the player should be able to determine that it is an encoded text.

Step 2: Geolocate the Provided Images

The briefing also mentions that there are 7 images attached, which the player needs to use to geolocate specific locations. By analyzing the details in each image and using Google Maps, the player can identify the following locations:

  1. -37.757894, 144.791905
  2. -37.758979, 144.860682
  3. -37.786785, 144.833678
  4. -37.834939, 144.784095
  5. -37.757887, 144.925639
  6. -37.835410, 144.922919
  7. -37.759520, 145.000051

Step 3: Connect the Locations

By connecting the locations on a map, the player should be able to form the number “711”.

Step 4: Multiply and Add

The briefing states that the number “711” should be multiplied by 458964983, and then the first 3 letters of each street name in the numbered order should be added to the end.

The final answer format is:

326324102913furmildicfitbucwilnorlen

Additional Context

The prologue provides background on the two terrorist characters, Dan and Kyle, and their plans to use camels to transport explosives and carry out attacks in Australia.

The briefing explains that the Tiberian Order has intercepted communications and images related to the terrorists’ plans, and they need the player’s help to decipher the information and prevent the attacks.

Tips for Players

  • Carefully analyze the encoded message to uncover the hidden meaning
  • Pay close attention to the details in the provided images and use them to identify the specific locations
  • Connect the locations on a map to reveal the numerical code
  • Ensure the final answer is formatted correctly, including the street name abbreviations

Creator(s): Frank Diepmaat