Introduction

CTF had some nice OSINT challenges. No regrets solving at 4 am.


Misc (OSINT)

Do Stars Spin 1?

Challenge description says one of the CTF admins mentioned something about stars somewhere. First place to search for hints was the CTF discord. Searching for “Do stars spin”, returns a message with dostarsevenspin weirdly without any spacing in between. Performing a quick google search of this phrase gives us only 2 results. How nice to narrow down so quickly..

Both results are on reddit which is in-line with what the discord message was saying so we know we’re on the right track. Opening the reddit post, I realised that everything was deleted… In order to view these deleted messages, we turn to wayback timemachine which is an archive of the internet. Searching for the reddit posts gives us nothing… the earliest snapshot was already too late. However, if we search for a snapshot of the user profile page, there is indeed one.

flag1

Flag: flag{7t3rE_i5_n0_wAy_a_be3_sh0u1d_BEE_ab13_t0_f1Y_89a89fe1}

Do Stars Spin 2?

Getting started on this challenge was slightly harder because the challenge description was exactly the same so you don’t really know where to look. But going over what we already know and have (discord and reddit), we find something useful on the reddit.

clue

This looks like an instagram handle. Performing a search for the user dostarsevenspin returns a single profile. From the biography of the user, we also know their twitter handle starsdonotspin. Searching for the same user on twitter, we do indeed find this user. It was also at this point when I realise what this guy ws talking about… Majority of his tweets were nonsense on Flat Earth Society, however one of them stood out. A link to Wikipedia

wikilink

On Wikipedia, anyone can edit the page. Furthermore, you can also view the edit history of the page. The Wikipedia on Star doesn’t give anything useful. However, on the page on Spin Star, shows that the latest revision was by the user Dostarsspin. Hmm.. suspicious. When we diff the versions, we see that his edit isn’t anything useful. However, we can also view all user contributions gives us a history of which pages he has edited. From this we also find that he has editted the Flag wikipedia.

wikiclue

Note that I solved the challenge before Do Stars Spin 3 was created. That was on 1st or 2nd June. The edits from 3rd June were not there when I was working on this challenge. If we diff the Flag wiki page we find the flag

wikiflag

Flag: flag{te3_6ov3rnM3n7_i5_h1d1ng_1nf0!}

Do stars spin 3?

This problem didn’t even have a challenge description, so back to looking at what we have.. The first place I looked at was twitter. I realiesd the user had tweeted something new that wasn’t there before when I was solving problem 2. They mentioned something abuot getting banned on tfes forums. Doing a quick google on “tfes”, first result is The Flat Earth Society… and there goes my search history… Looking on the forum doesn’t give us much to work with. It took me sometime browsing and searching before I found a clue. Searching stars spin and sorting by most recent first, I see

forum clue

There is a user spinningstars. Viewing their profile we see only 2 of their posts. This is weird cause the forum tells us they have posted 18 times. It took me a while before I read this:

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

It then occured to me that I had to be a member of the forum to view the posts. And sure enough after creating an account, We have a lot more information. We even have a members list which would have been super helpful since we wouldn’t need to dig endlessly through the forums and pollute my search history.. On the banlist, we do see user spinningstars. This is inline with the tweet. Now we just need to find the other forum… Browsing carefully through his 18 posts, there’s 1 of them which is on the topic the other stie got hacked yet again. Hmm… what is this other site…

Scrolling through the 200 responses on this topic and finally one of them has a link to the site. On page 2, I found

forum page2

Visiting the site, it is indeed another flat earth forum. This time learning from mistakes, I created an account first and this gave me a members list. This forum is misleading perhaps because people that have gotten to these points registered usernames such as spinningstars, seekingspinning and dostarsspin. I was staring at user spinningstars for a while wondering what the heck I was suppose to do since the user has 0 posts… But after looking through the members list and sorting by date registered (Somewhere in the discord the challenge creator said they were working on the 3rd iteration of the challenge, meaning that this was created very recently hence we don’t need to look too far back), we find a user with 10 posts.

otherforum

View this user’s posts, we see that in one of them they revealed their email…

email

Emailing this address, we receive an automated reply. Which gives us a google hangouts link. Joining this link, the group title was the flag.

reply

Flag: flag{fuuuhhhh1Illlla@gggg}



Takeways

It was only after creating a legit account on the first forum that I realised I could use those 10 min guerilla mail services…

Another thing I realised after looking at writeups from others. I had spent a lot of time seraching for the correct TFES forum. I had found 2 of them but did not know which one to start. One of them allowed me to serach without creating an account so I decided to go with that. I didn’t bother to check the user wiki contributions again. That would’ve have been a more direct solution to finding the forum pages. Overall quite fun.