STORY DRIVEN OSINT CTF

easy
medium
hard
insane

The Butcher

Briefing

Greetings, Special Agent.

As you might have heard in the news over the past few months. The city of Berlin in Germany is being plagued by a serial killer, nicknamed “The Butcher”. As the name implies, this individual butchers his victims and disposes their body parts all over the city. Autopsy reports conclude that the weapon for disposal is most likely a meat cleaver.

The total body count currently sits at 18 people, mostly women and younger men. All victims were traveling alone at night, mostly through quiet areas, when they were last seen.

Fortunately, yesterday the German police raided an apartment in the city center of Berlin. Neighbors had complained about a stale, metal like smell coming from the apartment. Upon closer inspection, the police found large quantities of plastic sheets, blood traces of several victims and an assortment of meat cleavers.

Since the apartment was rented out to an individual who had used a fake ID, the police has hit a dead end in trying to find the killer. They did however retrieve several files from a personal laptop, including a large, encrypted archive.

In the same location as the archive was stored, a file named “password” was found. However, this just contained a bunch of HEX values. We need you to make sense of this file, perhaps it leads to the password for the archive.

As always, Special Agent, the contract is yours, if you choose to accept.

Materials

Download the starting materials

Answer Instruction

Use the answer to unlock the flagfile, this will reward you with your badge.


You will need to listen carefully.

Flagfile

Be advised, the flagfile is an encrypted ZIP. Make sure your OS supports the ZIP format. Ensure the password contains no hidden characters or formatting, paste in Notepad first if the password doesn’t seem to work.

Download Flagfile here

PS: Don’t forget to claim your Coins and XP, by posting your card in the #card-brag channel in Discord.

Official Write-up

Provided here is the official write-up, it does contain the answer. Use this if you’re stuck, or want to verify if you got the answer correct.

The Butcher

This Hacktoria Contract revolves around a serial killer investigation in Berlin. The challenge involves decrypting a hex-encoded file to reveal a password for an encrypted archive.

Challenge Objectives

  • Decode a hex-encoded file
  • Retrieve the password for an encrypted archive

Step-by-Step Solution

Step 1: Hex Decoding

  1. Take the hex text from the “password” file
  2. Use CyberChef to decode the hex values
  3. Set the output to be saved as an MP3 file

Step 2: Audio Decoding

  1. Play the decoded MP3 file
  2. Listen for the spoken password

The Actual Solution

When you decode the hex text in CyberChef, it will generate an MP3 file.
Upon playing the MP3, you’ll hear the password spoken:

Password: fgjkaergnadrmgkhngadrgle

Solving the Challenge

  • Open CyberChef
  • Paste the hex text
  • Use the “From Hex” operation
  • Save the output as an MP3
  • Play the MP3 to hear the password
  • Use the password fgjkaergnadrmgkhngadrgle to decrypt the archive

Additional Context

The contract is themed around a fictional serial killer case in Berlin, with 18 victims. The CTF simulates a cyber investigation to decode a critical piece of evidence.

Tips

  • Ensure you’re using a tool like CyberChef that can handle hex decoding
  • Listen carefully to the audio to capture the exact password
  • Be precise when entering the password for decryption

Creator(s): Frank Diepmaat