Write Up - Raptor Reserve

This write-up is based on the information at the start of the CTF, not with the added hint that gives the website away. The write-up is made by Frank, the creator of the challenge.

So the first things that stand out, are the lack of starting points and the indication from Klumgongyn that you're allowed to interact with people to get information. Since nobody is listed by name, we can only start with the name, Raptor Reserve.

A search gives us no results, although results may vary depending on the search engine you used. For me, it gives just the Hacktoria pages and someone else's Instagram.

The Instagram account is a page selling weed, so I'm guessing that's not what we're looking for, I don't think Hacktoria is one giant front for getting people to buy illegal substances from an Instagram account.

Moving on from there, with no obvious social media accounts, there might be a website? For anyone who kept an eye on the chatroom channel in the Hacktoria Discord, you will notice that Frank (me) did mention a website being made for the challenge. But, disregarding that additional information, lets quickly see if any relevant domains are registered.

For this, I will use my favorite "tech-bro has an idea and needs a domain name" website, instantdomainsearch.com the absolute goats of quickly finding your domain.

Okay, nothing on raptorreserve, now let's try raptor-reserve... And badabing-badaboom eat the gabagool, there is a website registered with the .com and basically no other domains registered with any relevant domain names except this one.

Yeetus deletes defetus let's visit the website after putting on a digital condom (VPN), and see what we get...

Amazing, there's an actual website here, scrolling all the way through all the obvious parody text, all the way in the footer we see this:

Okay, we definitely found the website. Now let's scroll back up a little bit...

It mentions a Lewis Catson (obviously a reference to Lewis Dogson from Jurassic Park). And thinking back to the briefing, we were allowed to interact with people operationally involved with the park. And I guess the Operational Director is pretty damn operational. So, let's send this dodgy malaka an email and see what we get.

A note here, there's an out-of-office reply active on the mailbox, so it does not matter what you send, the reply is always the same.

So we get the following email back from Lewis. Important note here! If you use Gmail, the web version will probably clip the email and you won't see the images. So use either a local client, or something like Proton or most other email providers.

I've tested with Gmail and it didn't work, but Proton and Hostinger worked just fine. Also a good lesson to not do OSINT things from your main Gmail account.

Hi,

Here's a status update as per your request.

The settlement has been renovated and we've installed a perimeter wall, right under the canopy. This will keep it hidden from satellite imagery, as you can see below.

We've plotted the boat rides, and now are getting our staff familiar with them. There are certain spots where we're more likely to see action than others. The helicopter rides were removed from the program, as the jungle is too dense and it would arouse suspicion.

Cameras have been installed all over the island, connected to motion sensors. Guests can view them from their cabins and the lounge area in the main lodge. It will automatically switch to the camera that shows movement. We're using AI to recognize humans and dinosaurs, to make sure the cameras always show the most relevant views to our guests.

For example here you see one of the cave exits. It's now connected to our underground tunnels and holding pens for the poor we've captured. They're released through the cave exits. As discussed, guests can pay extra to release a poor themselves at the exact time an animal is waiting at the exit.

In summary: we're ready for launch in a matter of days. We currently have about 80 poors from all over the world in the holding pens underground.

Best Regards,

Lewis Catson
Operational Director
Raptor Reserve Resorts
raptor-reserve.com

So I initially had 2 more images, but RIS found those really quickly. These probably don't show up on Reverse Image Search. At least not when I tested it.

Now... At this point, I'm sure a lot of Geoguessr players and other Geolocation experts will dig deep into their meat sponge folds, and start triangulating specific plants. Or maybe figure out that this is a tropical looking island, narrowing it down to Central and South America, plus most of Asia. Okay GG now we just bruteforce Google Maps.

No wait a second... This whole CTF is themed after Jurassic Park. To the point of being on an island, that looks tropical, with a guy named Lewis Catson. So let's start with the location of the Jurassic Park movies. Let me ask Le Chat.

Okay, lets see what there is to find a couple hundred kilometers west of Costa Rica.

Initially, there is nothing much at exactly this distance. Unfortunately I couldn't spawn a whole new island for the CTF, but lets have a small look around. I scroll down by about one inch on my screen, and hey look at that.. A national park in the middle of the ocean, on the west coast of Costa Rica, where Jurassic Park was supposedly taking place.

It gets even better from here. A protected rainforest on a remote volcanic island, with scuba diving in the surrounding marine park. Okay great, but there's too much cloud coverage to see that little settlement we saw in the email from Lewis.

Now there was this little red cross in the middle of that image, which is only used by Satellites Pro. Of course not everyone can know this niche knowledge, but looking around online for sat images you'll find it quick enough.

And boom, right under that cloud coverage from Google Maps, we find the same settlement as in the email from Lewis!

So now all we have to do, is format our flag: cocos_island_costa_rica