Introduction
I created this challenge for the InterIUT 2026 CTF. All the challenges of this edition were entirely designed by ENSIBS students, around a shared cyberpunk universe.
The plot takes place in 2087, as the megalopolis is under the absolute control of MilSec Industries, a corporation that has privatized the Internet and conducts illegal neural experiments in the utmost secrecy.
On behalf of the resistance group Null-Syndicate, the participants' goal was to infiltrate the firm's cyberspace in order to trace one of their engineers who had gone missing.
Challenge
As MilSec Industries extended its influence across the Asian continent, an AI engineer working on surveillance algorithms began to doubt his employer's real intentions.
After voicing his concerns during a formal interview, he "disappeared" from the company's staff. Internal rumors say he was forcibly expatriated to a particularly opaque neighboring jurisdiction, in order to be "re-educated".
The government took care to erase all information about this person, but according to an unknown source, an association specializing in human rights defense managed to archive information about the host prison and the missing man.
Here is a photo of the employee that was leaked, present in company documents that were transmitted to the government of the country where he is imprisoned:
The goal of this challenge is to find out in which prison this engineer is being held.
Research Methodology
The first step is to analyze the downloaded image. To do this, we can inspect the raw data or use the strings command:
Looking through the output, we quickly notice the string A2318 surrounded by underscores. This text strongly resembles an identifier or a clue left in the file.
If we do a raw search for this term on Google, the results we get are extremely generic and don't seem related to a person or an Asian geopolitical context.
So we need to think more carefully to build a more targeted query and cross-reference our clues. In a prison environment, inmates are often identified by a registration number or a sequence of digits. Additionally, the elements of the statement point us towards Asia.
Looking at the physical traits of the man in the photo, of East Asian descent, we can narrow down the list of potential countries where his company or place of detention was located:
- South Korea
- Japan
- North Korea
- Mongolia
- Vietnam
- China...
When we think of a particularly opaque jurisdiction in East Asia associated with "re-education" camps or prisons, China or North Korea become the priority leads. Here are various search syntaxes to isolate the database containing our target:
Or alternatively:
The result leads us to the page https://nkpd.io/en/entity/b59n9fqj73b, which perfectly matches the contextual elements. The North Korean Prison Database is managed by Korea Future, an organization that documents and archives human rights violations in North Korea.
Looking at the profile of the prisoner matching the registration number A2318, we discover exactly his current place of detention: Ryanggang Provincial MSS Holding Centre.
Flag
