Virtual Grail - Osint [INSANE]

— 496 Points

— bl0rph @ IrgaZEN CTF TEAM

We kick off with this, first thing to do is a classic sherlock scan:

1
❯ sherlock P4l4d1n_1mp3r14l_0f_L1ght
2
[*] Checking username P4l4d1n_1mp3r14l_0f_L1ght on:
3
[+] Star Citizen: https://robertsspaceindustries.com/citizens/P4l4d1n_1mp3r14l_0f_L1ght

We land on here :

You can see a bunch of stuff right here, a research paper (which is out of scope),

• morse code which translates to : “MYFRIENDSAREWATERANDFIRE.”
• and a username : P4l4d1n1mp3r14l0fF1r3

After running a sherlock scan :

1
❯ sherlock P4l4d1n1mp3r14l0fF1r3
2
[*] Checking username P4l4d1n1mp3r14l0fF1r3 on:
3
[+] GitHub: https://www.github.com/P4l4d1n1mp3r14l0fF1r3

We land on this github account with an interesting bio, a telegram link !

Let’s follow the link, We land here :

Translation:

1
The IMO number will be important for the future my paladin friends
2
Where is Ju5t1c3?
3
I am P4l4d1n_1mp3r14l_0f_R3d_D34th btw, and my brother is D34th ofc
4
We need to find Ju5t1c3 to infiltrate the Arcane Guardians' Discord

Upon investigation, an IMO number is what appears to be some kind of serial number for ships and boats. after checking the location we stumble upon the following :

a ship !! and we got it’s name !

MS World Discoverer, now we can go to any website online and check its IMO number and it is : 7349053 (we leave it for later),

Now let’s follow the rest of the clues, the telegram channel spoke about some kind of guy called Ju5t1c3 who will give us the access to the discord, after joining the discord we find this :

Lets run a sherlock scan on Ju5t1c3 (and his possible usernames). after alot of trial and error we stumble upon the right username which has returned a response :

⁨❯ sherlock P4l4d1n_1mp3r14l_0f_Ju5t1c3 [*] Checking username P4l4d1n_1mp3r14l_0f_Ju5t1c3 on: [+] Tenor: https://tenor.com/users/P4l4d1n_1mp3r14l_0f_Ju5t1c3

bingo ! let’s check the tenor account:

We can see alot of interesting stuff here :

• some Braille language, translates to : J’apporte la paix au sein des paladins.
• and another small detail in the profile picture :

we see a hash (an MD5 hash): 5254532a2088fd117dfc7671d85c37f9 There’s lot’s of websites out there to crack hashes, which is what we did, and we get a response, W@chtw00rd.

After submitting the password we are granted the rank of Guardian at the discord server :

and the following channel unlocks !!

now we can see lots of interesting characters, but after deep scanning and researching, this particular one stood out :

Once again, we run a sherlock scan on him XD:

1
❯ sherlock 0b1-w4n-K3n0b1
2
[*] Checking username 0b1-w4n-K3n0b1 on:
3
[+] GitHub: https://www.github.com/0b1-w4n-K3n0b1

We got a github ! Let’s check it out !

IT IS our guy, we find this interesting repo right here :

We have a zipped archive that might contain some good info, but the password for it is:

1
OMI/IMO + DC-3_AVION_REGISTRATION + DC-6_AVION_IMMATRICULATION

great ! we already have the IMO, Let’s investigate the crashes … Long story short (after using reverse image search tools like TinEye and some basic google dorking) we got results matching the two crashes! The first one :

• DC3 Plane Crash
• DC6 Plane Crash :

and the Registration and Immatriculation are publicly available!

-Registration: 17171

-Immatriculation: F-ZBBU

Now we can construct the password for the archive !

1
OMI/IMO + DC-3_AVION_REGISTRATION + DC-6_AVION_IMMATRICULATION

so the password is : 7349053+17171+F-ZBBU = 734905317171F-ZBBU

we extract the archive and …

EUREKA !

The Flag is JDHACK{CeluiQU!ATTRaP3cEgraalM3Ritelap1USGRandeDesBI3RES}.

What a challenge, special thanks to the IrgaZEN CTF Team (Specifically my teammates sp1n0zza and z3Ro whom I would’ve never solved the challenge without )

Check This out ! : IrgaZEN’s Discord Server