Introduction

Welcome to this second MidnightCTF writeup! This OSINT challenge is independent from the others.

The goal is to recover information published online by a murderer.

Methodology & Research

Since an image is provided, steganography seems like a good way to start the investigation. So I download the file, and I run a strings on it. We get:

IHDR
tEXtComment
Qv0101Ad
IDATx
+o~I
[...]
Rm@Lch
+R=^
mSmLX!
IEND

I first look at the tEXtComment field, since it's common to hide information in images. However Qv0101Ad isn't readable text.

I use my tool curiousSearch. In this case of a simple Google dork, curiousSearch is going to be useful to save time (no need to type the dorks into different browsers one by one).

Here are the filters chosen:

• Keyword: Qv0101Ad
• Search engines: Google, Bing, Yandex, DuckDuckGo, Yahoo
• Filter: exact results

We get results with Yandex, but nothing for the other search engines. However, Yandex shows us security position switches, which isn't necessarily related to the CTF.

So I go back and read the statement, because very often, it hides clues: "This image contains crucial information for an online note left by the killer."

An online note... What site lets you share notes or text online? I instantly think of Pastebin, widely used in cyber to anonymously share data. So I try typing: pastebin.com/Qv0101Ad

Good guess!

0xForSure, this looks like a username used by cybersecurity enthusiasts (especially thanks to the "0x").

So I decide to look for information on this username. I use a tool called Whatsmyname which will let me list the accounts with the username 0xForSure

I start by checking on Roblox whether a user with this name exists.

A user 0xForSure does indeed exist. I look at his profile to see if he has any created games or information in his bio.

He has a map named "Try it". I decide to join the map to see if there are any clues inside.

Once spawned in, I'm greeted by the flag.

Flag

Thanks for following this writeup!