Introduction

This challenge is an OSINT challenge from the PWNME CTF.

Background explanation

To understand the context of the challenge, look at the description of the introductory challenge.

Directive

John is French-English but lives in France, and his life is almost entirely available on the internet.

Find the city where he lives, the username of his current girlfriend, and the maiden name of his ex.

OSINT must remain passive, and any interaction is strongly prohibited.

There is no need to contact anyone to solve the challenge.

Flag format

PWNME{lille_elonmusk_halliday} All in lowercase with “_” to separate the information.

Solution

The city came first.

City

John has two relevant Instagram posts: one about a 10-euro bill he spent in Austria, and one about a post-vacation barbecue at his place. The barbecue post is a carousel of six photos, and one of them is useful:

It shows a receipt, but Instagram crops the top off. Refreshing the page to load the image at full size outside the carousel pop-up gives the whole thing:

The receipt names the city Lannemezan. Since the post is about a barbecue at his place, the meat was almost certainly from a local butcher, so that’s where he lives.

Maiden name of his ex

Still on Instagram, @dropkingjohn posted several highlighted stories, one of which invites support for the Tarbes women’s basketball club, the TGB.

On the side of the poster, we see the address where the match will take place, Quai de l’Adour in Tarbes.

A later story invites friends for a beer at “the best bar” after the match.

On Facebook, he’d posted about his favorite bar:

Two details line up oddly: in the Instagram story he says he’ll have to show up in disguise so he isn’t recognized, and the Facebook post says his ex owns the bar. So his ex owns the bar he’s heading to after the match.

That same story also carries a long encoded message:

3 444 777 33 222 8 444 666 66 0 66 666 777 3 0 555 33 0 555 666 66 4 0 3 33 0 555 2 0 777 444 888 444 33 777 33 0 7 777 33 6 444 33 777 0 22 2 777

The groups of repeated digits look like old phone-keypad (T9-style multi-tap) encoding, where 2=a, 22=b, and so on. A quick Python script decodes it:

telephone = {
    "2": "a",
    "22": "b",
    "222": "c",
    "3": "d",
    "33": "e",
    "333": "f",
    "4": "g",
    "44": "h",
    "444": "i",
    "5": "j",
    "55": "k",
    "555": "l",
    "6": "m",
    "66": "n",
    "666": "o",
    "7": "p",
    "77": "q",
    "777": "r",
    "7777": "s",
    "8": "t",
    "88": "u",
    "888": "v",
    "9": "w",
    "99": "x",
    "999": "y",
    "9999": "z",
    "0": " "
}

message_encode = "3 444 777 33 222 8 444 666 66 0 66 666 777 3 0 555 33 0 555 666 66 4 0 3 33 0 555 2 0 777 444 888 444 33 777 33 0 7 777 33 6 444 33 777 0 22 2 777"

chiffres = message_encode.split()

message_decode = ""
for chiffre in chiffres:
    message_decode += telephone[chiffre]

print(message_decode)

Decoded: direction north along the river first bar.

The Facebook bar sits on the Adour, so following the river north to the first bar lands on Bar Le Landais in Tarbes.

Searching the bar and city turns up a Yellow Pages listing with the owner’s name, P******* Caussade:

We want her maiden name, so on to her Facebook profile.

One profile fits: P******* Caussade Ghestem, a bar merchant in Tarbes. So the ex’s maiden name is Ghestem.

Current girlfriend’s username

I’d found his Twitter earlier but hadn’t followed up on it. Among his follows is @BlancheLoveJD, whose bio reads I Love JD I always wanted to make him forget his ex gf, clearly the girlfriend.

Flag

We now have all the information to find the flag:

• City: Lannemezan
• Current girlfriend’s username: BlancheLoveJD
• Ex’s maiden name: Ghestem

To recall, the flag format is PWNME{CITY_USERNAME_NAME}, all in lowercase with “_” separating the information.

So the flag is: PWNME{lannemezan_blanchelovejd_ghestem}

Tips & Tricks

• Instagram crops images, so it’s important to view the full images to find information. To do this, on desktop, simply refresh the page, and on mobile, tap on the image to enlarge it.
• Always cross-reference the gathered information.
• Don’t hesitate to use Google Maps to search for locations.