HelloWorld 2026: Box 1

WRITEUP OSINT SOCMINT

Context

HelloWorld is a CTF organized by the GCC club of ENSIBS. I had the chance to take part in creating a box with two friends, mathx and SpiizN. I built the first two challenges of the box.

The goal of the challenge was to drown participants in a 4chan conversation, training them to extract information in a noisy, complex environment.

Obtaining the URL le-grand-silence.gcc

The first step is to analyze the provided 4chan archive. Many posts and replies are present. After a quick read, one user stands out from the rest: "M0eM0eKyun".

spotify exploit

The posts mention a Spotify exploit, the name John Woodman, and a Spotify playlist created by the user M0eM0eKyun. A simple web search gives us more information:

search for the spotify john exploit

post about the spotify john exploit

We also notice a username and part of a password belonging to M0eM0eKyun on an unknown site:

The article describes a method for setting up a C2 on Spotify. The screenshot shows a "get passwd" playlist where the first letter of each track title spells out a message — the same technique used in the playlist created by M0eM0eKyun.

search for the spotify john exploit

By opening the "firefox" playlist and reading the first letter of each track title, we get the following URL:

firefox playlist

le-grand-silence.gcc

HW{le-grand-silence.gcc}

Finding the editor account's login and password

The URL leads to a page listing the members of the VENDRAQ protocol.

members

We recognize the username "noyau_dur", which appeared in the photo posted by M0eM0eKyun:

His profile description reads:

Found and transcribed the register of the Kernazec relay

And in the photo posted on 4chan, we can see the password starts with "ker". We can guess the password is something like "kernazecXX98".

From there, two options: either rely on how old the account looks and guess that 98 refers to a birth year, or bruteforce the two remaining characters with ffuf:

[Sep 06, 2026 - 23:33:22 (CEST)] exegol-sandbox /workspace # seq 0 9 > numbers
[Sep 06, 2026 - 23:34:01 (CEST)] exegol-sandbox /workspace # ffuf -u http://forum.le-grand-silence.gcc:8000/login -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'suite=&username=noyau_dur&password=kernazecFIRSTLAST98' -w numbers:FIRST -w numbers:LAST -fs 1939

This gives us the login and password:

noyau_dur:kernazec1998

We can then log in on the forum page:

We're now logged in as an editor:

HW{noyau_dur:kernazec1998}