Wolvctf2023: WannaFlag Series 1–3
This week I participated in the CTF event organized by WolvSec. In this event, I only focused on the forensic and OSINT challenges.
In this article I will discuss the OSINT challenge. Challenge OSINT is a series tagged WannaFlag, with a starting question set of 3 and 2 more after completing all 3. Unfortunately as of this writing I can only work up to the third challenge.
WannaFlag I: An Introduction
Description: Welcome to WolvCTF’s OSINT Category! We have a bunch of great OSINT lined up, assuming nothing goes wrong hahahhahahhahah but why would it?
For this challenge, find where the image was taken, and look at the Google Maps reviews!
It attached with image.png
I tried to read the metadata but there was nothing. immediately I searched for google image search.
And google directed me to a cube monument at the university of michigan called The Cube. Try to look at the reviews and sort to newest. It looks like we are on the right track, there is a wolvsec account with a comment directing to do a netcat.
Try to did the intruction
nc wanna-flag-i.wolvctf.io 1337
== proof-of-work: disabled ==
Good job finding the Cube! It's a favorite destination among UofM students!
Anyways here is the flag:
wctf{sp1n
Huh???? Where did the rest of the flag g
______
.-" "-.
/ \
_ | | _
( \ |, .-. .-. ,| / )
> "=._ | )(__/ \__)( | _.=" <
(_/"=._"=._ |/ /\ \| _.="_.="\_)
"=._ (_ ^^ _)"_.="
"=\__|IIIIII|__/="")
_.="| \IIIIII/ |"=._
_ _.="_.="\ /"=._"=._ _
( \_.="_.=" `--------` "=._"=._/ )
> _.=" "=._ <
(_/ \_)
______
.-" "-.
/ \
_ | | _
( \ |, .-. .-. ,| / )
> "=._ | )(__/ \__)( | _.=" <
(_/"=._"=._ |/ /\ \| _.="_.="\_)
"=._ (_ ^^ _)"_.="
"=\__|IIIIII|__/="")
_.="| \IIIIII/ |"=._
_ _.="_.="\ /"=._"=._ _
( \_.="_.=" `--------` "=._"=._/ )
> _.=" "=._ <
(_/ \_)
______
.-" "-.
/ \
_ | | _
( \ |, .-. .-. ,| / )
> "=._ | )(__/ \__)( | _.=" <
(_/"=._"=._ |/ /\ \| _.="_.="\_)
"=._ (_ ^^ _)"_.="
"=\__|IIIIII|__/="")
_.="| \IIIIII/ |"=._
_ _.="_.="\ /"=._"=._ _
( \_.="_.=" `--------` "=._"=._/ )
> _.=" "=._ <
(_/ \_)
██╗ ██╗ █████╗ ███╗ ██╗███╗ ██╗ █████╗ ███████╗██╗ █████╗ ██████╗
██║ ██║██╔══██╗████╗ ██║████╗ ██║██╔══██╗██╔════╝██║ ██╔══██╗██╔════╝
██║ █╗ ██║███████║██╔██╗ ██║██╔██╗ ██║███████║█████╗ ██║ ███████║██║ ███╗
██║███╗██║██╔══██║██║╚██╗██║██║╚██╗██║██╔══██║██╔══╝ ██║ ██╔══██║██║ ██║
╚███╔███╔╝██║ ██║██║ ╚████║██║ ╚████║██║ ██║██║ ███████╗██║ ██║╚██████╔╝
╚══╝╚══╝ ╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝ ╚═══╝╚═╝ ╚═╝╚═╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝
HAHAHHAHAHHAHA Ohhhhh man what an easy CTF to pwn
And I mean also really?? At least make a geo-osint KIND of difficult
The CTF is HOSTED by UofM where else would that dumb cube be????
Oh man ok well organizers if you want your "challenge" back or flags or whatever send 500,000 Goerli here:
0x08f5AF98610aE4B93cD0A856682E6319bF1be8a6
Who knows maybe we'll take more flags if you don't pay in time >:)
#YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs
#YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs
#YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs #YourFlagsBelongToUs
______
.-" "-.
/ \
_ | | _
( \ |, .-. .-. ,| / )
> "=._ | )(__/ \__)( | _.=" <
(_/"=._"=._ |/ /\ \| _.="_.="\_)
"=._ (_ ^^ _)"_.="
"=\__|IIIIII|__/="")
_.="| \IIIIII/ |"=._
_ _.="_.="\ /"=._"=._ _
( \_.="_.=" `--------` "=._"=._/ )
> _.=" "=._ <
(_/ \_)
______
.-" "-.
/ \
_ | | _
( \ |, .-. .-. ,| / )
> "=._ | )(__/ \__)( | _.=" <
(_/"=._"=._ |/ /\ \| _.="_.="\_)
"=._ (_ ^^ _)"_.="
"=\__|IIIIII|__/="")
_.="| \IIIIII/ |"=._
_ _.="_.="\ /"=._"=._ _
( \_.="_.=" `--------` "=._"=._/ )
> _.=" "=._ <
(_/ \_)
______
.-" "-.
/ \
_ | | _
( \ |, .-. .-. ,| / )
> "=._ | )(__/ \__)( | _.=" <
(_/"=._"=._ |/ /\ \| _.="_.="\_)
"=._ (_ ^^ _)"_.="
"=\__|IIIIII|__/="")
_.="| \IIIIII/ |"=._
_ _.="_.="\ /"=._"=._ _
( \_.="_.=" `--------` "=._"=._/ )
> _.=" "=._ <
(_/ \_)
██╗ ██╗ █████╗ ███╗ ██╗███╗ ██╗ █████╗ ███████╗██╗ █████╗ ██████╗
██║ ██║██╔══██╗████╗ ██║████╗ ██║██╔══██╗██╔════╝██║ ██╔══██╗██╔════╝
██║ █╗ ██║███████║██╔██╗ ██║██╔██╗ ██║███████║█████╗ ██║ ███████║██║ ███╗
██║███╗██║██╔══██║██║╚██╗██║██║╚██╗██║██╔══██║██╔══╝ ██║ ██╔══██║██║ ██║
╚███╔███╔╝██║ ██║██║ ╚████║██║ ╚████║██║ ██║██║ ███████╗██║ ██║╚██████╔╝
╚══╝╚══╝ ╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝ ╚═══╝╚═╝ ╚═╝╚═╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝
██╗ ██╗ █████╗ ███╗ ██╗███╗ ██╗ █████╗ ███████╗██╗ █████╗ ██████╗
██║ ██║██╔══██╗████╗ ██║████╗ ██║██╔══██╗██╔════╝██║ ██╔══██╗██╔════╝
██║ █╗ ██║███████║██╔██╗ ██║██╔██╗ ██║███████║█████╗ ██║ ███████║██║ ███╗
██║███╗██║██╔══██║██║╚██╗██║██║╚██╗██║██╔══██║██╔══╝ ██║ ██╔══██║██║ ██║
╚███╔███╔╝██║ ██║██║ ╚████║██║ ╚████║██║ ██║██║ ███████╗██║ ██║╚██████╔╝
╚══╝╚══╝ ╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝ ╚═══╝╚═╝ ╚═╝╚═╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝
██╗ ██╗ █████╗ ███╗ ██╗███╗ ██╗ █████╗ ███████╗██╗ █████╗ ██████╗
██║ ██║██╔══██╗████╗ ██║████╗ ██║██╔══██╗██╔════╝██║ ██╔══██╗██╔════╝
██║ █╗ ██║███████║██╔██╗ ██║██╔██╗ ██║███████║█████╗ ██║ ███████║██║ ███╗
██║███╗██║██╔══██║██║╚██╗██║██║╚██╗██║██╔══██║██╔══╝ ██║ ██╔══██║██║ ██║
╚███╔███╔╝██║ ██║██║ ╚████║██║ ╚████║██║ ██║██║ ███████╗██║ ██║╚██████╔╝
╚══╝╚══╝ ╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝ ╚═══╝╚═╝ ╚═╝╚═╝ ╚══════╝╚═╝ ╚═╝ ╚═════╝
Also all of you John OSINTs on twitter need to leave us aloneI thought I would get the flag here, but there was some other information that made me a little confused about where to continue. Because there is a wallet address, a fragment of the flag, and also a suspicious last sentence I decided to look for it.
just described John OSINT on twitter. Looked up his name on twitter search and found an account
Yes, this seems to be a related account. some of his tweets indicate it. One of the tweets mentions flags and is base64 encoding.
elend@faisholhaka:~$ echo "d2N0Znt1aGhoX3doM3IzX2QxZF80bGxfMHVyX2ZsNGdzX2cwP30=" | base64 -d
wctf{uhhh_wh3r3_d1d_4ll_0ur_fl4gs_g0?}WannaFlag II: Payments
Description: Ok well…………………….something may have gone wrong
WannaFlag’s ransom demand is insane, there’s no way we are paying that. Can you figure out which address the money is being funneled to?
From the ransom note:
send 500,000 Goerli to 0x08f5AF98610aE4B93cD0A856682E6319bF1be8a6
While looking into the address while working on the first challenger, I found some pretty good information on etherscan.
It appears that there is no activity on the address, but there are multiple chain addresses. And while searching for this problem, there were 14 total transactions done with this address. I assume that this is a fake address to confuse the tracking process.
There are many incoming and outgoing transactions and it is quite tedious to search for each address and almost all of them eventually send back to the original address. But I try to mark each unique transaction that occurs such as at the beginning of this transaction, there is only one outgoing transaction to address 0xA01…032.
On this address there are also a number of outgoing, incoming transactions and there is a self transaction, but there is nothing in it. It can be seen that there are several transactions on the new address at address 0x807…8ad. Try to check it. In one of the transactions with address 0xA10…B2B, there is a self transfer with additional data input information. Try to find out
On the details transaction here is the input data.
Because this one, I try to focused on self transaction or the embeded input data on the transfer section. And it’s true, the other transaction from 0x807…8ad direct to new address 0x64E…999 — > 0x796…3d0. Because the other transaction direct back to first address, and in this transaction the input data is the flag
WannaFlag III: Infiltration
Description: We have some solid leads so far. However, we need our flags back. Find a way to locate their communication and infiltrate their private ransom service, and submit the stolen flag we wanted to use for the first OSINT!
From outside intelligence, we know the group sometimes goes by
w4nn4_fl4gCompletion of this Challenge Unlocks:
WannaFlag IV: Exfiltration
WannaFlag V: The Mastermind
Unfortunately, this challenge was not completed on time. In this challenge, a group called w4nn4_fl4g was mentioned. Just search for that name, and a subreddit appears as a result.
The first link only contains posts on that subreddit. And on the second link, there are deleted posts. Try to figure this out with the wayback machine.
There are 2 snapshots on March 12, 2023. Yups, that’s right, on one of the snapshots there is a deleted comment with further instructions, just try to execute it.
Open it on browser and got the flag there
It’s great that the OSINT challenge has story telling like this.
