n00bzCTF
The_gang_3 [486 pts]
Writeup author: lolmenow
Provided files: N/A
Description:
Can you find out where the OG meetup point is? The flag is in the format n00bz{lat,long} with upto 3 decimal places, rounded. Continue where you left off… Note: Wikipedia can be wrong sometimes ;) Author: NoobMaster
Reading the tweets from the twitter account we found previous, we see several tweets. Here they are:
Wanna join us? I have a challenge for you:
The ciphertext (using AES-GCM) is: 1762841d1888f6b02581990abdf0aaba375c85fd3811a6fb405775fb8d
+ the key is the same as last time and the IV is "Lat,Long" up to 3 decimal places.
Use the city where we met in 2022. Also, use Cyberchef.
I forgot, you will also need this: d5e749da6b02c75cb4c763939632503a
Since when was their crypto in osint?!
Anyways, we open cyberchef and change the AES-decrypt function to AES-GCM.
We input the CT, IV (discussed more below) and the GCM tag.
The GCM tag is the “you will also need this part” string.
We also need a key
IV
Now, for the IV, it discusses a city and key that was used last time.
This is when I was confused for a while. After more searching, I realized that maybe the “last time” was referring to the 2022 version of n00bzCTF.
Sure enough, going to their writeup repo, we see a challenge called “John doe” with some coordinates. This is the IV!
IV: 46.720,33.154
Key:
With the knowledge of finding the IV, I assumed their would be a 2023 challenge that was similar to john doe which had the key.
Going to the 2023 repo, we see a challenge that references John doe!
And we see the key! Being: YouCanNeverCatchJohnDoe!
Inputting this into cyberchef, we decrypt the ciphertext into a discord message!
Discord server
Joining the discord server, we see a conversation in the general chat.
Using the discord search feature for “OG” we get messages that relate to the “OG” place:
Hey @John Doe , How's the weather in Delhi? I heard it's super hot
Censored1375 — 07/03/2024 6:11 AM
It's always raining in Bengaluru LOL
John Doe — 07/03/2024 6:11 AM
At least it does rain lol, Delhi is soo hoot dude. Just started raining recently so hopefully gets better
NoobHacker — 07/03/2024 6:13 AM
Bro Bengaluru is a literal paradise compared to Delhi
Censored1375 — 07/03/2024 6:13 AM
😆
John Doe — 07/03/2024 6:13 AM
Can't wait to get there bro...
NoobHacker — 07/03/2024 6:14 AM
At least you get to sleep before your flight. Mine was at 4 am in the morning 💀
Censored1375 — 07/03/2024 6:14 AM
Unlucky 😂 What time is yours @John Doe ?
John Doe — 07/03/2024 6:14 AM
9:40 am in the morning is the scheduled time, but nowadays flights are always getting delayed
NoobHacker — 07/03/2024 6:15 AM
We meeting near the statue right?
Googling for Bengaluru popular statues, I see a statue called Statue of Prosperity
Inputting this into google maps, we get this result
There are our coordinates!
Final flag: n00bz{12.976,77.572}