Social Media on HitCat

Pivoting a bilingual target's social accounts - PwnMe 2023

Sun, 07 May 2023 00:00:00 +0000

Introduction

This challenge is an OSINT challenge from the PWNME CTF.

Context explanation

John Droper is a Franco-British individual who leaves an enormous digital footprint.

(Note: He speaks both English and French, and some information can only be found through one of these languages.)

Directive

You have to find one of his main social media

Solution

So here we only have one information about the person, his name. So we will have to search for it on the internet.

Since we have to find a social media, I first checked if he had a Facebook account. I searched for his name on Facebook and found a profile with the same name and a sketchy profile picture.

By looking under the about section, we can see in the details that there is the flag.

Flag : PWNME{TG9uZyBsaXZlIHRoZSB0cmFpbnMsIGxvbmcgbGl2}

Tracing a target's life across social media - PwnMe 2023

Sun, 07 May 2023 00:00:00 +0000

Introduction

This challenge is an OSINT challenge from the PWNME CTF.

Background explanation

To understand the context of the challenge, look at the description of the introductory challenge.

Directive

John is French-English but lives in France, and his life is almost entirely available on the internet.

Find the city where he lives, the username of his current girlfriend, and the maiden name of his ex.

OSINT must remain passive, and any interaction is strongly prohibited.

There is no need to contact anyone to solve the challenge.

Flag format

PWNME{lille_elonmusk_halliday} All in lowercase with “_” to separate the information.

Solution

The first piece of information I found was the city where he lives.

City

On Instagram, John Droper posted two posts. One where he talks about a 10 euro bill he used in Austria, and in the other post, John says it’s good to have a barbecue with friends at his place after returning from vacation.

The post consists of 6 photos, one of which seems to contain interesting information:

In this photo, we see an incomplete receipt because the top of the ticket is missing.

However, if we access the photo outside the post’s pop-up by refreshing the page, we can see the photos in their actual size:

On the receipt, we see a mention of the city of Lannemezan.

We can deduce that he lives in this city since the post talks about a barbecue at his place, and he probably bought meat from the local butcher.

Maiden name of his ex

Still on Instagram, @dropkingjohn posted several highlighted stories, one of which invites support for the Tarbes women’s basketball club, the TGB.

On the side of the poster, we see the address where the match will take place, Quai de l’Adour in Tarbes.

Then follows another story that suggests his friends join him for a beer in “the best bar” after the match.

On his Facebook profile, there was a post where John talked about his favorite bar:

In the Instagram story, John says he’ll have to come disguised so as not to get caught. Surprisingly, in the Facebook post, he says his ex is the owner of the bar.

By cross-referencing this information, we can deduce that his ex is the owner of the bar he will go to after the match.

In the Instagram story where he invites people to go to the bar after the match, we can see a large encrypted message:

3 444 777 33 222 8 444 666 66 0 66 666 777 3 0 555 33 0 555 666 66 4 0 3 33 0 555 2 0 777 444 888 444 33 777 33 0 7 777 33 6 444 33 777 0 22 2 777

The message looks like an encrypted message with a phone, so we can try to decrypt it by matching phone keys to letters.

There are probably online tools to do this, but I made this Python script to do it:

telephone = {
    "2": "a",
    "22": "b",
    "222": "c",
    "3": "d",
    "33": "e",
    "333": "f",
    "4": "g",
    "44": "h",
    "444": "i",
    "5": "j",
    "55": "k",
    "555": "l",
    "6": "m",
    "66": "n",
    "666": "o",
    "7": "p",
    "77": "q",
    "777": "r",
    "7777": "s",
    "8": "t",
    "88": "u",
    "888": "v",
    "9": "w",
    "99": "x",
    "999": "y",
    "9999": "z",
    "0": " "
}

message_encode = "3 444 777 33 222 8 444 666 66 0 66 666 777 3 0 555 33 0 555 666 66 4 0 3 33 0 555 2 0 777 444 888 444 33 777 33 0 7 777 33 6 444 33 777 0 22 2 777"

chiffres = message_encode.split()

message_decode = ""
for chiffre in chiffres:
    message_decode += telephone[chiffre]

print(message_decode)

This gives us the result: direction north along the river first bar

Looking at the bar’s location on Google Maps, we can see it is situated along the Adour River.

If we search for a bar in the area to the north of the bar, we find Bar Le Landais, which is located in Tarbes.

By searching the bar’s name and the city’s name, we find a link to the Yellow Pages, which gives us the owner’s name: P******* Caussade.

We know we are looking for a maiden name, so we can try to find the bar owner by looking for her Facebook profile.

Only one profile catches my attention, that of P******* Caussade Ghestem, who is a bar merchant in Tarbes.

We can deduce that his ex’s maiden name is Ghestem.

Current girlfriend’s username

Earlier, I had found his Twitter account but hadn’t yet explored the lead.

Looking at his followers, we can see that he follows @BlancheLoveJD, whose bio says I Love JD I always wanted to make him forget his ex gf

We are sure that she is his girlfriend.

Flag

We now have all the information to find the flag:

City: Lannemezan
Current girlfriend’s username: BlancheLoveJD
Ex’s maiden name: Ghestem

To recall, the flag format is PWNME{CITY_USERNAME_NAME}, all in lowercase with “_” separating the information.

So the flag is: PWNME{lannemezan_blanchelovejd_ghestem}

Tips & Tricks

Instagram crops images, so it’s important to view the full images to find information. To do this, on desktop, simply refresh the page, and on mobile, tap on the image to enlarge it.
Always cross-reference the gathered information.
Don’t hesitate to use Google Maps to search for locations.

Geolocating three cities from a target's social posts - PwnMe 2023

Sun, 07 May 2023 00:00:00 +0000

Introduction

This challenge is an OSINT challenge from the PWNME CTF.

Context explanation

To understand the context of the challenge, look at the description of the introduction challenge.

Directive

John loves adventure and travel. Can you give me the 3 cities he visited during his trip to Europe?

Flag format

PWNME{city1_city2_city3} Cities in lowercase and in alphabetical order, separated by an “_”.

Solution

On John Droper’s GitHub, droperkingjohn, on one of his commits, we can see that he removed part of his index.html.

<body>
	<h1>John Droper's website</h1>
	<p>I will edit my curriculum later but this is some information about me:</p> <br>
	<p>- I could be pro with my team, but you know... (cruciate ligament rupture...) => https://www.tgb-basket.com/<br>- If you've already met me, you know that I love traveling; this is one of my new favorite forums (I'm not really active, but recently I shared information about my trip to Europe) =>  https://www.forum-train.com/forum/index.php</p>

	<hr style = "border:none;margin-bottom:20%">
	<p class="semiSecret">You can contact me :<br>johndroperdroperjohn@gmail.com<br>(links are not up for the moment, sorry...)</p>
	<div class="logosRS">
		<img src="./twitter.png" sizes="30px"/>
		<img src="./facebook.png"/>
		<img src="./instagram.png"/>
    <!-- No copyright but => https://github.com/droperkingjohn -->
	</div>
</body>
</html>

This commit is interesting because it gives us several pieces of information:

An email address: johndroperdroperjohn@gmail.com
A forum where he shares information: https://www.forum-train.com/forum/index.php
The social networks he uses: Twitter, Facebook, and Instagram
A basketball site: https://www.tgb-basket.com/

I searched for John Droper’s two pseudonyms, jdthetraveller and droperkingjohn, on Twitter and Instagram, and I found these two profiles:

Twitter: https://twitter.com/droperkingjohn

Instagram: https://www.instagram.com/droperkingjohn/

After finding the social media accounts mentioned on John’s blog, I tried to find others by searching for his pseudonyms on Google and Bing.

First city: Kaunas

We find a link to a thread on the jeuxvideo.com forum where John posted a message.

The jeuxvideo.com post

Hi all,
I'm totally new to the site and a friend told me about the fact that you could help me,
I have to find another friend but he sent me 3 too weird messages the first was "investor",
the second "utopian" and the third "ligamentous".
I know it is mysterious but here I am completely lost.
I think losing that friend will be easier than solving the investigation.

If we search for the three words in French investisseur, utopique, and ligamenteux on https://what3words.com/, we find Kaunas in Lithuania.

The location with what3words

So we have the first city visited by John Droper: Kaunas.

Second city: Gols

On his Instagram posts, John posted a photo of a European banknote with the serial number visible.

The serial number is U50441715662.

From the description of the post, we can guess that John intends to do bill tracking to find his cherished banknote.

This lead takes us to the website https://www.eurobilltracker.com/ where we can track banknotes.

John on EuroBillTracker

By searching for his pseudonym jdthetraveller on the site, we find an account belonging to him, registered in Gols, Austria.

We are sure it’s his account because he mentioned the URL of his blog in his description.

So we have the second city visited by John Droper: Gols.

Third city:

Going back to the initial information obtained from John’s GitHub, we know he has an account on the forum https://www.forum-train.com/forum/index.php.

John on forum-train

By searching with a Google dork site:forum-train.com jdthetraveller, we find a presentation post by John on the forum.

This post tells us that John left Bratislava by train after traveling by car and that the train journey lasted exactly 10h58.

Hello everyone,

Let me introduce myself, John D.,
I've been a fan of travel for a very long time!
I recently took a trip to Europe and part of that trip was by train.
After going to Central Europe I decided to go to Eastern Europe.
I left Bratislava and traveled for 10h58 it was really very long... 

If you have any tips for discovering places in the United States, I'll be there soon

Further down, in another message, John says he didn’t have time to visit Bratislava, which allows us to confirm that Bratislava is not one of the cities visited by John.

I forgot to mention that I didn't even have time to visit Bratislava unlike the other cities of my trip to Europe...

Otherwise, first of all thank you for the welcome!

I'm going to try to visit all the coolest corners of the United States so I'll take all the advice!

The train journey

With the information we have, we can search for journeys starting from Bratislava and lasting 10h58 on the website https://direkt.bahn.guru/.

If we set the departure point as the Bratislava hl.st. station, the map indicates that the city Terespol is 10h58 from Bratislava by train.

The city Terespol is indeed 10h58 from Bratislava by train, but most importantly, it is also in Eastern Europe, which corresponds to what he said in his presentation.

So we have the third city visited by John Droper: Terespol.

The flag

The three cities visited by John Droper are:

Kaunas in Lithuania
Gols in Austria
Terespol in Poland

As a reminder, the flag format is PWNME{city1_city2_city3} Cities in lowercase and in alphabetical order, separated by an “_”.

The flag is therefore: PWNME{gols_kaunas_terespol}

Tips & Tricks

Google dork: site:forum-train.com jdthetraveller
Try searching with other search engines like Bing, DuckDuckGo, Qwant, or Yandex.
A location can be specified using GPS coordinates, address, postal code, city name, country name, etc. However, it is also possible to divide the globe into 3m² squares and specify a location using three words. This is the concept of what3words.
To track Euro bills, you can use the website https://www.eurobilltracker.com/.
All train departures/arrivals in Europe can be found on the website https://direkt.bahn.guru/.