Hacktoria offers Story Driven CTF Games, providing multiple discipline exercises woven together with a captivating story-line to sharpen OSINT, Cyber, and Logical skills. While the compelling story-line and character-building part is debatable, the rest seems true and Hacktoria deserves some kudos for style points.

Hacktoria offers “contracts” in various categories like popular, ciphers, forensics, geolocation, identification, log files, and research. To test them out, I started with geolocation, specifically The Cartel Connection, which provided a photo to identify Diego’s last known location. The proof of completion is a png file stored in a downloadable zip file where the password to unzip the file is the address in the format of streetname-number-neighborhood-city-district-country.

The contracts seem to always begin with a bit of back story. Agent Diego Alejandro finds himself in a bit of trouble, but good thing he’s got a host of Special Agent K’s looking to save him. You know, typical cover blown stuff. Just saying, don’t wear your red skin tones while trying to blend in with the crowd, Diego. You’ll stick out worse than Santa at this time of year. Happy Easter everybody!

Time to cut to the chase. We are given a single photo and told to identify Diego’s last know location. The first obvious question to ask was, “has this photo been seen anywhere else on the internet?” For that I turned to InVID’s trusty Fake News Dubunker chrome plugin to spin up several image reverse searches including Yandex, Google images, TinEye, and several others. Shot and a miss! Guess the old tongue needs a bit of warming up before exercise. I tweaked some of the search engines, cropping to certain portions of the image, but gave that up pretty quickly.

👇 Photo of Diego’s last known whereabouts

Next came the general observations about the actual photo itself. We know from the write up that the photo is somewhere along the coast of Columbia. There are no obvious landmarks: plenty of places in the world with palm trees, dirt roads, wooded landscapes, and rugged beach shacks. For textual analysis, we see a sign on the fence which is a bit too blurry to make out, something which possibly reads “navenco” on the side of a ship, and a blurred-out license plate. While not a smoking gun, the blurred-out license plate does suggest that this may be an image from google maps (that and the unlikelihood that our CTF creator, resqfoxtrot, just happened to take a trip to Columbia for this contract). We can use this information combined with the google maps street view filter to rule out almost the entire Pacific coast of Columbia.

A couple of other noticed features were: the railroad tracks in the foreground, the position of the sun indicating an East or Westerly orientation of the photo (and thus a North/South orientation of the water, coastline, and tracks), the forest across the channel, and the two ships. That’s right, two. If you’ll lock those eyes back together for a second, just behind the truck you will see what looks like two structures and a crane. Initially, I thought his might be towers or a port; however, upon closer inspection with the Fake News Debunker’s magnifying lens, one can barely make out the bow of the second ship emerging from behind the palm tree as well as a semi-visible stern beneath the superstructures.

So, what does this mean for our investigation? Well, the presence of the 2 ships clearly indicates we are near a major shipping location, and thanks to icontainers, we can narrow our search down to 5 ports. Given that we are on the coast and can see land across the channel means we must be seeing either a river or on an island or peninsula with (as mentioned earlier by the position of the sun) a North/South orientation. Additionally, the uninhabited area across the channel makes larger metropolitan areas like Cartegena unlikely. Reviewing some of the descriptions of the ports from the icontainers.com website as well as looking at topography satellite imagery, the port of Barranquilla along the coast of the Magdalena river seems like a good place to search.

Dropping out of the sky and into our google street view at the northern most end near Desembocadura Bocas De Ceniza, we are instantly greeted with a dirt road and some train tracks. This looks promising! So, this chameleon took a little “walk” south until a familiar image popped out. Who has time to call Columbian police? Time to snag Diego out of there and make like a tree, chameleon style of course.

*Sidenote: The exact formatting of Diego’s “vacation beach-house” took a little familiarization with Columbian address syntax in order to get the password for the zipped file. Shock! You mean the rest of the world doesn’t use street, city, state, ZIP?!