In the footsteps of cyberdetective

Hello to all habrovchan!

I happened to take part in a competition, quite rare of its kind, called Cyber Detective. The competition was held at the HackIT-2017 conference, in which he also actively participated. Jobs are based on finding open information online. I want to share experiences, raitaps and impressions.

In this kind of CTF participate for the first time. I usually participate in jeopardy CTF format, in which several categories are at once (Web, Reverse, Crypto, Stego, Pwn, etc.). In the same contest, the developers did almost all the tasks for the Recon category and one task for Forensic. But more on that below. Initially, he did not plan to participate in the competition, but he was interested in the task for social engineering, which later gave uniqueness to this competition and made him play seriously.
')
The tasks of the Recon direction, or as they are often called “OSINT tasks”, are solved by finding information from open sources. To solve such tasks, you need to be well able to use the features of search engines, such as Google , Duckduckgo , Shodan , Censys , be aware of various public databases, as a rule, public, well-versed in the features of social networks. Of course, nowhere without social engineering. And this is not all the skills that a qualified Internet intelligence officer should possess.

A total of 27 tasks were posted on Cyber Detective, which were divided into groups. These groups, “branches” had their own legend, history, around which tasks and solutions revolve. A visual graph of job dependencies taken from the platform is presented above. The story unfolds as the current branch resolves, which is much more interesting than reading the meager condition of a task on a typical CTF. For each story, an average of 3-4 tasks.

I want to note the high level of preparation and reasonableness of the platform. On many CTFs, tensions and disputes arise between some teams and organizers regarding the integrity of other teams regarding participation rules. Simply put - it is forbidden to exchange flags between teams / participants. And it so happens that the team, without taking the desired prize, tries to get it by searching for reasons and evidence of the fraud of the winning teams. This is rather low and most often causes nothing but contempt and no respect, since the organizers themselves try to catch and punish violators. However, in this platform, the flag delivery information is open to any participant, and allows anyone who wants to analyze the delivery history of the other participant’s decisions.

As the tasks are described, I will talk not only about the right decisions, but not the right ones, and how they led to the answer. Many interesting services, utilities, approaches were used. So you need to stock up on attention, tea \ coffee and read on.

Intro

From this category begins the solution of all other tasks. Without the delivery of this task alone it is impossible to solve all the others, but since it was solved quickly, no problems arose.

It was easy to find. Going into the chat telegram and opening the chat page, you could see the flag. I want to note that the flags do not have a typical template, like flag {...}, or md5. This makes it difficult to find him. On the other hand, this format can not be placed everywhere, so the developers decided to donate my nerves in favor of the diversity of tasks.
Flag: "Welcome on board!"

Internet profile

Then it was worth starting to solve this category, each of the tasks was estimated at 50 points. There were simple tasks on which you can warm up. The assignments are written in the order in which they were published on the site, but they were decided, of course, not in that order.

Start

Some social networks have the opportunity to find out information about the page, in particular, this is vk.com , knowing the user's email / phone, as well as his last name. This bug or feature is hard to say, but there is a flaw (you shouldn’t run a report on hackerone :)).

It would be logical to think that Mark is the name, but no, this is the last name. This put me in a dead end not for a long time and did not immediately introduce a “last name”. Then I went to the VC, clicking on "Forgot your password", entered the number, last name, and got a page that you can easily find through a search. Here is the profile: Orest Mark

Flag: Orest

Nick

It's all elementary, his nickname, this is the address on the VK site.
Flag: "0n1zz"

Work

After reviewing many of the groups to which he is subscribed, as well as a quick glance at the page on his github, the idea came that it was Microsoft.
Flag: Microsoft

Profession

I decided this task not immediately, continuing to look at the tasks below, and extracting as much information as possible from the page, entered values such as Programmer, Developer, and so on. Then he went to look for a guy in other soc. networks, found it Orest Mark . When searching, in the list of profiles or in the information about the page, it is written that he is a software engineer at Microsoft.
Flag: "Software Engineer"

Mail

It was very simple, I remembered that I saw soap on his github page.
Flag: "oreest1987@gmail.com"

Skype

The name of the task itself suggested what to look for, the answer on the Orest Mark page.
Flag: "orest_mark_87"

Place-1

I had to tinker a bit with this and the following tasks, as several options formally fit. On the page a geotag is attached to the post , which does not fit. After reviewing friends, it is immediately clear that Mark has a brother, Tenson Mark , who also has a geotag. Just looking at Facebook, it became clear where he was from.
Flag: Sinaia, Romania

Place-2

The answer is on the Facebook page, in the "About Me" column.
Flag: Kiel, Germany

Relatives

Taking into account that Mark has a brother, Tenson Mark , we hand over another flag.
Flag: Tenson Mark

Hoby

Having already studied this person enough, it is clear that he is interested in racing. The correct name of the flag can be found in the lists of groups on the VC page, or, if you look closely, you can see his T-shirt on the avatar, where this inscription was.
Flag: Speed racing

Recreation

Remembering that a geotag was attached to the post on the VK page of the guy, having run a place, we find the solution.
Flag: Sesena, Spain

The first branch is closed, the assignments are handed over, +550 points in literally 20 minutes. This gave a huge incentive to understand further, naively thinking that subsequent tasks will be just as easy. But let's see in the end what the file gathered on the guy. His name is Orest Mark, I know his pages on VK , Facebook , Github . I know mail, nickname, phone number. It is also the fact that he loves, by whom he works, where he works, where he lives, where he was born, who his relatives and loved ones are, where they live. This branch of tasks is an excellent illustration of how you can find information about many people through social networks. The collected information is enough to attack his email address, try to get access to accounts on social networks, apply social engineering and find out any other data. However, enough elementary things, go to the most interesting task of this competition.

Family dramas

Immediately googled the person by number, try to repeat the trick with the restoration of the page in VK. Google gave out something interesting, at first glance, on the request "0671710968", especially the first page . I did not understand what it means. In the absence of other options, I decided to dial the number. To my surprise, the girl replied, and immediately dropped. The task involved the use of social engineering skills, as I understood later, which would help to find out the address. It was necessary to do this not intrusively, inquiring a person. Somewhere for 20-30 minutes I thought about the legend, and it took about 15 minutes to practice reading in such a way that it was not very noticeable that I was reading the text, speaking not intrusive and not monotonous. Many subtleties that tried to take into account. Here is the text that made up.

Good evening!

My name is Andrey.

I represent the student movement called World Frendship. We are committed to bringing people together based on mutual assistance. Helping in various life and domestic issues, we make new acquaintances, friends, and also want to give at least a little good mood to people. Want to participate?

- (answer)

Then I will talk a little bit about our movement and what we actually do.

Our movement organizes many projects. For example, not so long ago we launched one project, the essence of which was to help foreigners find housing for free. The idea is to make new acquaintances, foreign friends, to have the opportunity to learn a little about the culture of other people, to practice a foreign language, and so on. Perhaps you have heard of similar projects like these being carried out in England and the USA. Here it is.

To you, I want to offer to participate in another project called “Warm Dinner”.
The bottom line is that we cook together with you and spend time in a fun atmosphere. How do you offer?

- (answer)

See it. You cook food as well as recipes that you would like to try. Two of our students, usually a boy and a girl, come to you and prepare. Then you can play some board games, or go for a walk. Well, do you agree?

- (answer)

Then you need to clarify a couple of points. Tell me, what is your name?

- ...

And tell me your address

Address found failed. But then I had to call back, because I didn’t understand the address a bit, and now I’m allegedly checking the address on the map to compile the route. Already in the course of the conversation I realized that I was submitting a bit of information, I needed more communication. However, as the developers later admitted, it was the best attempt of all who received and did not receive the address. Of course, I’m far from Kevin Mitnick, and I don’t do carding, but for the first time, it’s fine. I want to note that it was from this task that the CTF began to solve, it attracted an unusual and very interesting format for receiving an answer. I think admins have not slept for days, as there are many participants, and they decide 24 hours a day. As it was later suggested to me, I could write this number in a telegram, and I would have answered the same way, I think, this is done for foreigners. Although of course there is not the drive, risk, emotion. By phone, you need to answer quickly questions that you could not foresee, and the quality of the answers depended on the literacy and forethought of the legend. Having received a cool experience, the new impressions wanted to continue to decide even more. However, such an interesting task was estimated at 100 points, which was not pleased, and it was not fair to allocate points for this task in my opinion. The players in the top of the scorbord were far away, but two sleepless nights fixed it.
Flag: "Odessa, Palubnaya, 7"

Retribution

Then he took on this category, since judging by the number of solutions of tasks from it, it should not have been difficult.

Step # 1

At the time of writing, Google did not give out absolutely no information on this strange address. This is not base64, or any other kind of cipher text, as I first thought. It was logical then to assume that this is an onion resource. After downloading Tor, the browser saw this site in a few minutes. At the time of this writing, the search engine has already cached something and this greatly facilitated the process of solving this task.

Here is a site opened, and received the first flag.

Flag: "HACK IN DARK"

Step # 2

This task was not easy and hung on it for a long time. On the page below, there were offers to hack various mails, accounts on social networks, breaking sim cards, and even learning to hack. Here is a small part of the list of services.

Clicking on one of the services I get a QR code.

Decryption: DRYcucyK5Hfc3A4hit9KqsKm5FwxHJYSdk

During the CTF, these QR codes changed, which complicated the decision, slightly confusing. One of these codes was successfully decrypted through the base64 decoder , and having received a rather incomprehensible text, went the wrong way, deciding what it is. Then I inspected that at the bottom of the page there was a mention of such a thing as dogecoin, and it immediately became clear that this was a cryptocurrency. Now, when I write this description, in principle, it seems obvious, but at that time it did not seem so. Googling found out that dogecoin is altcoin based on the blockchain. Going to the site Dogecoin registered wallet, trying to figure it out. But everything turned out to be simpler, it was necessary to review the transaction history for the current wallet . Here is a list of translations for this wallet.

I came across cryptocurrencies, but I didn’t have to track operations, and this turned out to be a problem for me. Here, the transfer of coins is carried out through intermediate wallets that send these coins through other wallets and so on. All this scheme can be traced through the Maltego program, which is part of KaliLinux and Parrot OS, and you can also use online services that could be done automatically. In the process of solving, I did it in a rather simple way - I clicked on the transaction with the leaving coins from the wallet, choosing the largest amount. As a result of several transitions, I found a purse where coins flowed. Of course, various mixers would greatly complicate the work, but the developers did not complicate the already hard life of the participants.
Flag: "DMqh6vFJ5LpdEbJnW5NYhwRmW5tAC69UmG"

Step # 3

This task turned out to be very simple, made it in a few minutes. It was necessary to google your wallet, it was mentioned in several forums, this is the forum that caught my attention thanks to one positive review.
Flag: "w3bg00dua"

Step # 4

Here the task developers won back the ease of the previous task. I had to google this nickname a lot, finding nothing. Small changes in the nickname did not help either. Facebook, VK also did not give results, as well as telegrams. But in the process of searching I found a wonderful service on probiunicums in many social networks. It works on the basis of the fact that many social networks allow you to assign a shortened url address to your account, which is often the nickname of a person. This is what the service issued.

I was interested in a Github account, in which there was one repository, and at the bottom of the description there was an email for feedbacks or offers.

With email, too, fooling around for a long time, he did not fit anywhere. After a while, I guessed to enter google + in the search, where I received a link to the account of a certain GlebReed .
Flag: "Gleb Reed"

What is the result of this thread? +1000 points, many hours spent on the elaboration of erroneous solutions. What is the result of the analysis of this legend? Even if a person has a website in Tor and he is not attentive to the information about him on the network, it can be tracked. There is a wallet, a nickname, an email, some posts, and so on, and this is done solely through searching for information from open sources, not to mention the various closed bases or other features owned by special services.