Writeup of DIVER OSINT CTF 2024

8 min readJun 9, 2024

In 8 June 2024, I have joined “DIVER OSINT CTF 2024” in the team “La Casa de Papel”. Here isthe final results of La Casa de Papel:

Results of **La Casa de Papel** in the CTF

We have got 5th place and I have solve 3 questions in the CTF. I will focus on the three questions that I have solved:

Please click the link below and refresh the page to the question you have just clicked.

1. Championships
2. Power
3. Protest

Championships

2010年10月、この場所には大会の広告が貼られていた。その大会の優勝者のニックネームを答えよ。
Flag形式: Diver24{優勝者のニックネーム}
In October 2010, an advertisement for a competition was placed at this location. Give the nickname of the winner of that tournament.
Flag format: Diver24{winner's nickname}.

The flag of this question is to find who is the winner of the competition which an advertisement was placed at this location.

When I first saw this image. I am very happy. Why? Because I can read Chinese and I have some knowledge about the PC industry.

I recognize “光華商場” as in my knowledge this mall is famous of selling PC products in Taipei.

I went to Google Map and “walk around” the mall (by Google Street View). But sadly, no luck :(

I tried to RIS the image and I found there were a job advertisement which shows the exact same place but more detail.

I looked around the mall again and I noticed a part of the wall which look similar with the image.

I went to the street view in the same place but taken in 2010 and found an advertisement.

Thanks to Gen2 street view (IIRC). I can’t see the poster clearly. But I can see a keyword. “Gigabyte” (which is an company which sells PC products like motherboard/graphic card etc…)

I tried to google with using
gigabyte 2010 電競比賽
as my keywords as I thought that they were sponsoring an e-sports race
(which makes sense right?)

and the first few results is about a overclocking competition which Gigabyte is involved in it. Lets see who wins the race:
https://www.gigabyte.com/tw/Press/News/937

…… 技嘉科技很榮幸地宣佈由來自羅馬尼亞的選手Matose贏得本屆技嘉GO OC 2010世界冠軍頭銜。…..

Which translate into English:

…… GIGABYTE is proud to announce that Matose from Romania has won the GIGABYTE GO OC 2010 World Championship. …..

Looks like the flag has appeared:

Diver24{Matose}

Power

写真右側に写っている送電線の運用容量値（単位: MW）はいくつだろうか。整数で答えよ。
なお、この写真は2024年に撮影されたものである。
Flag形式: Diver24{100}
What is the operational transmission capacity value (unit: MW) of the transmission line on the right-hand side of the picture? Answer in whole numbers.
Note that this photo was taken in 2024.
Flag Format: Diver24{100}
https://drive.google.com/file/d/1we5kOjHYHL4dFV0ca5_8mBlEm069ngSM/view?usp=drive_link
Hint:
“operational transmission capacity value” is “運用容量値” in Japanese

The flag is to find the operational transmission capacity value (unit: MW) of the transmission line on the right-hand side of the picture.

I thinkI need to find the film location. So I started to find the location by RIS the train and it gave me the model of the train.

I have edit the photo and upload the photo to RIS thanks for the high quality camera :)

From the first few results I can confirm that the train will appears using as a “Thunderbird” express. Simple Googling will found the model of the trains used in “Thunderbird” express. “683–4000”

Source:https://en.wikipedia.org/wiki/Thunderbird_(train) which looks like the same

Then I went to 683系電車’s wikipedia page and found that 4000番台 which looks exact the same with the train in the photo will only appears at 東海道本線・湖西線・北陸本線.

I went to Bellingcat’s Overpass Turbo tool and find electric poles which is within 50m radius of 東海道本線/湖西線/北陸本線. First I tried to search poles around 東海道本線.

I looked at the results one by one and I found this:

One of the results which look like the location where the image was filmed

I clicked into the street view and I move a bit and… Bingo!

Then I went to OSM and check for queries of that place:

From OSM I know the name of the electric line “西院線”.

And I checked who is responsible for supply electricity in Kyoto by simple googling.

Looks like Kansai Electric is responsible for supply electricity in Kyoto.

I found their Japanese website: https://www.kansai-td.co.jp/

After that, I do some google dork to see if I can get any luck:

Lets look at the PDF to see if there are any useful infos:

Mhhh…. The flag is in the PDF isn’t it? As hint wrote:
“operational transmission capacity value” is “運用容量値” in Japanese.” Although you can guess this is the flag by it is using the same unit.

Diver24{84}

Protest

23歳の環境保全運動家の殺害場所となった道路の現在の路線番号は何か。
フラグ形式：Diver24{路線番号}
注意：殺害に関わる直接的な画像が表示される場合があります。
What is the current road ID of the road where the 23-year-old ecologist was killed?
Flag Format:Diver24{road ID}
Warning: Graphic content related to the killing would be appeared in this challenge.

The flag is to find the current route number where the 23-year-old ecologist was killed.

As the question isn’t too specific that means we need to find who match the situation which the question mentioned (An ecologist which was killed at the age 23.)

I use google dork to help me to filter the possibilities.

I looked one by one (in my Virtual Machine) and the 4th result matches the situation which the question mentioned.

Work made in memory of Gladys del Estal Ferreño, a young ecologist from San Sebastián who was 23 years old when she was killed by the Civil Guard in Tudela on 3rd June 1979 during an anti-nuclear demonstration. During the International Day of Action Against Nuclear Energy, the anti-nuclear committees of the southern Basque Country organised a day of action in Tudela (Navarre) to bring Lemoiz to a halt in response to the National Energy Plan and against the Bardenas firing range. Just over two months earlier, on 28th March 1979, Unit 2 of the Three Mile Island nuclear power station, near Harrisburg, had suffered the most serious accident in the nuclear history of the USA.

After reading the passage, I went to Google to search her name and found a Wikipeida page which is about her.

In the Wikipedia page, it mentioned where she was killed by analyzing the passage below which extract from the Wikipeida page:

… el guardia civil José Martínez Salas, junto a otros compañeros, recibió la orden de dispersar a las personas que se encontraban sentadas en una carretera que conduce a Tudela. Cuando la joven Gladys del Estal procedía a levantarse del suelo, a José Martínez se le disparó el subfusil, originándose un disparo que causó la muerte inmediata de la joven. La sentencia considera que el guardia civil es autor responsable de un delito de imprudencia temeraria, con resultado de muerte…10
El camionero Ángel Hernández, que estuvo retenido por las protestas justo en el puente del Ebro, dijo
unos 50 jóvenes que estaban parando la circulación y unas 7 u 8 chicas sentadas. El subteniente dijo ‘os doy cinco minutos para desalojar’, prácticamente antes de terminar de hablar empezaron a dar culatazos. Por el costado izquierdo de una de las chicas un guardia civil le pegó por detrás con el arma, cayó hacia delante e inmediatamente después dio un tiro por detrás, cayendo sobre el hombro derecho.

Which translating to English is:

… the civil guard José Martínez Salas, together with other colleagues, was ordered to disperse the people who were sitting on a road leading to Tudela. When the young Gladys del Estal proceeded to get up from the ground, José Martínez fired his submachine gun at her, causing her immediate death. The judgement considers the civil guard to be responsible for the crime of recklessness, resulting in death…10
Truck driver Angel Hernandez, who was held up by the protests right on the Ebro bridge, said
about 50 young people who were stopping the traffic and about 7 or 8 girls sitting down. The sub-lieutenant said ‘I’ll give you five minutes to leave’, and before he had finished speaking, they started banging their heads together. On the left side of one of the girls a civil guard hit her from behind with his gun, she fell forward and immediately afterwards he shot her from behind, landing on her right shoulder.

From these paragraphs, we can assume that the incident was happened on Ebro bridge in Tudela.

Simple googling will led you to the bridge in Google Maps.

As I found there are no limits of submitting answer. An evil idea appears in my mind.

Why not bruteforce?

At first I tried Diver24{NA-126} but it is incorrect. Then I tried Diver24{NA-8703} and the system tell me that I have solved the question…

Which means the flag is:

Diver24{NA-8703}

Conclusion

Diver OSINT CTF 2024 is a fun and interesting CTF as there are many interesting question across different categories and places. (For example Protest which is related to history and Championships which is about PC.)

I have gained a lot of experience and knowledge with my team: La Casa de Papel and also the most important thing in my opinion: Fun

It is a fun experience and I want to say お疲れ様でした to the admin team for held such a great CTF and also answering my questions (We even played about anime meme 🤫).

Thank you for reading my WriteUp on Diver OSINT CTF 2024. Hope to see you soon on another CTF :)

Feel free to clap or share my write to others if you like it. :)

Writeup of DIVER OSINT CTF 2024

Championships

Power

Protest

Written by PretendNotToBe