An Old Friend
Challenge
Welcome to this second writeup dedicated to BreizhCTF 2026!
For this challenge, we need to find the city where Mr O lives, the deputy head of the BZH Mafia. An intercepted SMS excerpt is provided as a starting point:
- Free Mobile: data usage reminder, not relevant.
- Unknown number: "Hello paulifonta35! It's been a while since you left a new book review. The community can't wait for your next literary critiques!"
- Mémé (Granny): a clicked link that apparently infected her computer with ransomware, off-topic but amusing.
- Burger King: a promotional offer, not relevant.
The most interesting SMS mentions the username paulifonta35 and a book review platform.
Identifying the target
I put together a list of the main book review platforms: Babelio, Livraddict, Booknode, SensCritique, Goodreads, StoryGraph, LibraryThing. My reflex is to run a WhatsMyName scan on the username, without success. So I test the platforms one by one, and I end up finding this account on Goodreads:
goodreads.com/user/show/198943764-paulifonta35
Browsing through his book reviews, the one on Friday, or The Other Island (Vendredi ou la Vie Sauvage) by Michel Tournier catches my eye: it mentions "my friend Octave". We're looking for a "Mr O" for "Mr Octave" — that fits.
Paulifonta35 also mentions his school, the Collège des Horizons Lumineux. A Google dork on this information gets us more details about Octave:
I come across a Copains d'Avant account:
Its description holds a valuable clue: "I no longer use Twitter, I only post on a new decentralized network." I immediately think of Bluesky, and a search finds his profile:
bsky.app/profile/justoctave.bsky.social
The account only contains a few posts. Since we're looking for his city of residence, the most recent one seems to be the lead to follow, as it contains a photo of a package he just received.
Decoding the package
Before jumping into classic GEOINT, I first want to take a closer look at the package photo:
At first glance, I don't recognize this type of code, and my phone can't scan it. After a bit of research on different types of QR codes, I understand it's actually a MaxiCode, a format created and used by UPS.
I use an online tool to decode the MaxiCode:
I get the following string:
[)>~03001~0292645520~029250~029999~02948197Z7781~029UPSN~029R84M7
(reference structure found on neodynamic.com)
This documentation details the structure of MaxiCodes, but when trying to extract the different parts of the string (for example 02948197Z00007781), I get stuck: I can't make progress on decoding it more precisely.
I go back to the Bluesky post to look for other clues, and I notice that the image's alt text actually contains two links:
- A first piece of documentation: barcodefaq.com/2d/maxicode
- The second one, already found earlier: neodynamic.com
The barcodefaq.com documentation states that "MaxiCode Mode 2 and Mode 3 shall be reserved for use as a destination sortation symbol for use by carriers in the transport industry." So I conclude this is indeed a mode 2 or 3 MaxiCode:
The structure of the string for these modes uses GS separators. But our string doesn't contain "GS", it contains "~".
After searching online, I find out that ~029 represents the non-printable ASCII control character GS.
Replacing each separator:
[)>~03001~0292645520~029250~029999~02948197Z7781~029UPSN~029R84M7
becomes:
[)>RS01GS2645520GS250GS999GS48197Z7781GSUPSNGSR84M7
The decoding finally reveals the city we were looking for.
Flag
