STORY DRIVEN OSINT CTF

easy
medium
hard
insane

The Sleeper Cell

Briefing

Greetings, Special Agent.

We have an urgent matter on our hands. For several months we’ve been investigating a group called “Androktasiai”. A radical organization who believes in cleansing the planet of what they call gluttony. Believing firmly that humans are a disease that needs to be exterminated, this radical group is well organized and is preparing to strike several targets. After breaching one of their email accounts, we were able to extract a sent item. The metadata didn’t prove to be of much help, as it was sent to a disposable 10minutemail address. The contents however are of great interesting. We believe it contains instructions sent from one of the groups’ leaders to a sleeper cell. This sleeper cell will now be activated and preparing to carry out an attack somewhere. It is your task to figure out what the text means and provide any intelligence about the plans of this organization.

As always, Special Agent, the Contract is yours, if you choose to accept

Materials

SSB1cmdzIG9rZSBscGlhIHR2cHYgbXluIGhzZGUgaWxlaHJyaSB5b212ZCB3dWcgZXAgaHJ4IHdnemRhIGF5dXZvbnIgc2h3a21uICh2aSBwY2UgdHJ3IHZvYiBtYnZrIHJlZWwsIGFvbndybnFrLCBveHcgZmd3bHFzdSkgd3lzIG14cmxpaXYgbW53a3NiIGhmIGxwZSB0ZW51ZXNuIEloYXRvYW9ja3ZmYyB1bHdhc21kIGZ3ZmJvLCBwaHd6ZXduIE5vdHZvZnkgb3dyc3MsIGprenpvIHBlIHd2ZG1haXJpIGh5IGllam5la3QgZ2t2IHd3aWVqbmVrdCwgbnF1IGhydHQgb3F0cCB0dWxldWMgZm9qbSB0cGVhIHN2ZnB4Y2wuIElubCBmYnUga3ZrbSBuc2J1emUgdWRqIHJvZWlubXJtZCBodiBrdm8gYm1obXJuZXB3IGZidnIgd2FiaCBiaHIgc3ZmcHhjbCwgcXQgcXMgYnhpIGRra3QgbHcgbWlrciB3eXMgd3R0bG1yIChxbiBna3YgdHlrbXd6IENwYWN3dmZjIHdldXRhemVxIHhlaHkgbnMpIGV3cm0gdHVoZSBkb2tmd2t0IGp5IGJ4aSBvYm1peHFjcWF5IG9ycHlrLiBBZmwgaW4gd3IgbmVjZyBnb2wgYmhtIG1ucWVzYiBoZiBvd3JzaWFqLCBudmttIGlrIGJobSBjbnhqcyBkYWFsIGVlIGxvIGFyayBnb3ggaGdlIG5pdGh1diAoa3JiY3ogd2YgdG9haiBrd3d4IGhzYSBwbXJzaHRob3cgbXdiYXRzKSBxcnZnIG1obmxxbmNheW9wIGt5a2shIFZ3IHdtIG5idyBqc28sIG1oc2IgaXYgdHVoIER3eHhzIGxwcnd1dGsga3ZvIHZvZmJpdnVubyB5c2ttIHR6aXQgcXMgdnEga3ZvIGZvbXZ0aWlhdiBrdm9rZWduLCB0cGUgdHVmZ2NnZWthIG9uIHdud3ZmIHNsIHNnIGxla29wd3ZyIGtnZCBscGlra3JxdnIsIGRhYWwgcW4ga29hd3piZXRudW0gb24gdHZwdiB3ZCB1ZXV3bW1zIE51eHN4bS12YWRlPyBJbnEgd3lvZCBoZiBscGUgbmFncXZnYyBoZiBscGUgbWFld3kgaHJrb21vaCBiaHIgdnJhbyBhZXNiIGF2ZCBxaHRjbW1pZ3YsIFNjbGNrbGYgc2wgZWZvZXZkcnV2ciEgS2dkIGxwYWIgdHV1ZmlxYSB0em0gc2ltciBrdm9kIHBpbHBvY3QgdnFrc2JmaWthaXduIHByZWhzZ3V3bCBpdiB0dWhkLCBvdmUgbXdiYXRzIG51diBzeHplZmxlemVxIHJ3IGhyeG0gc2tjd3JxbGV1IGRoIHR6bWl6IHBodXpoaSB0bnYgcW14dWVsa20/IGtnZCBscGFiIG5ud2xmbyB3b3dhIGJnIGRyZmZxZGJvZiBpbHduciBzdmZweGNsIHdyIHVheGggcnp2IGZlbGlsYSwgYWYgenZ6diBpZWpuZWt0IG52IHphenhyeG1jYj8gMCBla3dpc3d4IG1zbG5tc2YhIHp5b2QsIEIgcGppeSBnb2gsIGZmYmNtcnNxbmEgeWJ4IGtjIGN4ZWMgYm8geGVlaXZxZCBtaHcgbm96ZWZkenIgZGFpZm9zIGp5IGZ3aW94emUgZW1saW5wa2Z6c3ZhZCBpbmwgZm5xa29jbWl1aWwgemV0bGRzeG1zISBzYSBvdmUgZmRwZzogR2hlIGx3IHl3dSBna3JoIGdibGQgd3ZtcnByZHMgeHR0bXplLCBpbnEgcHJ5byBmZWxpbGEgbWJ1diBocnhuIGhtcm5lcHcgc20gayBnZW8gemVvaXpoZWgsIHlrIHdnemsgYXBleGV1IHBrb2UgZ29jciBiemUgZ29nc3d0ZWFzIG91cnd4bC4gR2dsIGhpcyB0bG1zeCBtbyBmaXRjcnIgZCBqaGJ0aXlwdCBlYWwsIHdmIGtzbSwgY2d2dHFuaGRjIHF5Z2Nna3Rxb2EsIGRlciBpaHUgZHFrbSBmYnJjZyBueHNocXNtIGlnLCByaSBzdmxlIGN2b2UgaWcgcWZoLiAoKENoRmEtQXRpZHZ4ZC0zMy45NTM0MTcsLTExOC4zMzg4NjMsMTgpKSBPcXRpZiwgbml6ZSBucXUgT2podCwgc3plIGF1c2l6cXN4bmwgbm96IHlieC4gUmJuIGJuIHN2b2JocnUgZ3prdmUsIFptYWIgcHJ1d3NtbXMgc3RsIGJodnF4Zy4gS2dkIHd0c213dWhpcywgY3hlLCBrbWUsIGFlciwgZGVyIGx4IG5nYiB3bWFlYi4gUmJuIGJuIHN2b2JocnUgZ3prdmUsIGRtdCBnb2h1IHd3YnggYncgb2V2dHloLCByYm4geGFrZywgd3BpcGsgc3NzZ2cgc3R3aXlmIGhoaWtlLCBtc2cgY3duZ2xlaW8gdXVqdml2ZzogbnF1IHpvbSBpbCB2b2IgaWFmaXNrbGUsIHh3ciBxZiB2dyB1Y29sLCB5Z2Mgc3BheW8gamlweWVqIG9ybWFnIG9mZ2MuIFRudiBxbiBpbmJ3eXNiIGlsc2tlLCBTbmJ6IHBjZSBtaHNiIGl2IG9haCBrdnNnZywgbHcgd3F0LCBna3YgZ2RobncsIGp5IHduciB6cm0sIGRoIHdhYiwgZG1jYmZrd3lnLCBhZmwgaXYgb2FoIG1zY2xlZCBiaG0gd3VyY3Mgd3RzbG1yZyBpZiBzdmZwaHJlbWQuIElucSBsZSBveGh0em1yIHhsbmZ2LCBka21pd3Z0dHksIG5xdSBxeWd0YXZ1aWx5YiwgcmJuIGJuIHN2b2JocnUgZ3prdmUsIHl6aXZkIHZ3IGpzZnhuIGxxbW1zLiBOcXUgd3ggdG5nYmhtciBjb3JxbywgQnQgYWEgZ3pvaHF1IGtzbWggeHFybSwgQWFnIHpiIGtnb2xwZXogcHlkdHMsIGRhaWsgZW96ayB2diBtc2JyIGxhc2UgYm8gZ2t2IHFieGFscW92IG9zIHByYjogcGhyIHNhIHRwZSBWcXdveG0gaWYgYmhtIGJyanpieGJueSBxcyB2b2h1emdyeGQgb3F0cCBsdmp5aCB3eGFsYSwgYmN0IGdrdiBweWdlayBqZXFudCB2a2ZvZ2dscGV2ZXEgenpociBsdGp3bm9lZTogdmYgaHJicyBlaXNiZWViIHJ6Y2gsIGZhenNiIGlnIHBsZ2QgYWFubSBhdiBlbnZwIHRza2UsIG9wZXplb2IgbnMgd25zbCBpbGVhbHYgbmNiZCBpZiBtdm1ybCBoamdvZ2N3IHdmIGxlcHJ0aHNobi4gU3ZkIGJoYnh4diBneCBhZGVhZ3MgZnN2b3UgaGYgcyBvZXZ0eWggd3dieCwgeXdiIGl2IHRleGt2LCBneCB0enFucyB0dWRrIHd4IHpvbm1ydmlhaiBrdm8gcG9qcywgdHBlIHNsaXMgd25zbCBpbGVhbHYgc20gdmJ0bHRlIGlucSBvemhkZWUgdG0gaXZjZWhyZ293IGFmbCBhY2d6aGVob3cgdWZibyBiaHIgaGVyLg==

Answer Instruction

Use the answer to unlock the flagfile, this will reward you with your badge.


The answer will be in the follow format: ((this-is-the-flag))

Flagfile

Be advised, the flagfile is an encrypted ZIP. Make sure your OS supports the ZIP format. Ensure the password contains no hidden characters or formatting, paste in Notepad first if the password doesn’t seem to work.

Download Flagfile here

PS: Don’t forget to claim your Coins and XP, by posting your card in the #card-brag channel in Discord.

Official Write-up

Provided here is the official write-up, it does contain the answer. Use this if you’re stuck, or want to verify if you got the answer correct.

The Sleeper Cell

The challenge involves decoding an intercepted email from the Androktasiai terrorist group that contains encoded target coordinates. The goal is to decrypt the message and find the hidden target location information.

Available Materials

  1. Base64 encoded text
  2. Email title: “Rise of Androktasiai”
  3. Context about the terrorist organization
  4. Information about a sleeper cell activation

Solution Path

Step 1: Initial Decoding

Start with the Base64 encoded text: (sample)

SSB1cmdzIG9rZSBscGlhIHR2cHYgbXluIGhzZGUgaWxlaHJyaSB5b212ZCB3dWcgZXAgaHJ4IHdnemRhIGF5dXZvbnIgc2h3a21u...

Step 2: Base64 to Decimal Conversion

  1. Decode the Base64 text
  2. Convert to decimal representation
  3. Prepare for Vigenere decryption

Step 3: Vigenere Decryption

Key elements:

  1. Use “Androktasiai” as the key
  2. Apply Vigenere decryption algorithm
  3. Process the full text

Step 4: Target Extraction

Look for the coordinates format:

SoFi-Stadium-33.953417,-118.338863,18

Elements to note:

  1. Location name (SoFi Stadium)
  2. Latitude (33.953417)
  3. Longitude (-118.338863)
  4. Zoom/height level (18)

Required Tools

  1. Base64 decoder
  2. Decimal converter
  3. Vigenere cipher decoder
  4. Text editor

Common Pitfalls to Avoid

  1. Wrong decoding order
  2. Incorrect Vigenere key spelling
  3. Missing coordinate components
  4. Overlooking hidden markers (double parentheses)
  5. Case sensitivity in final answer

Decoding Process

  1. Base64 Decoding:
  • Use standard Base64 decoder
  • Verify complete text conversion
  1. Decimal Conversion:
  • Convert decoded text to decimal
  • Maintain proper formatting
  1. Vigenere Decryption:
  • Use key: “Androktasiai”
  • Process entire text
  • Look for readable output

Verification Steps

  1. Confirm Base64 decoding
  2. Verify decimal conversion
  3. Check Vigenere decryption
  4. Locate coordinate markers
  5. Validate target location

Remember: The key to this challenge is methodical decryption and careful attention to the hidden location format within the decoded text.

Creator(s): Frank Diepmaat