CyberSOC | Cyber Investigator CTF

An OSINT-themed CTF! Run by Cyber Society at Cardiff University, anyone can register and solve the challenges at any time and your own pace. Try it yourself at https://ctf.cybersoc.wales before scrolling below for how I solved my answers. (WIP)

1. Signals Intelligence

a. foreigntransmission

Our signals intelligence team has captured a transmission originating from Western China and we have reason to believe that it may provide us with some kind of code that might be meant for a field operative of theirs. We'd like to know what it is.

The translation team is not available for us to utilise at the moment, so I'm wondering if you can use any of your digital tricks to work out what the code in the recording I've attached is?

• Download the challenge and play the media file. The recording is in Mandarin, which fortunately I can decode the digits being called out.

• Flag: 415364214564383

b. personal banker

We've been granted authorisation for a wiretap on a phone belonging to a kidnapping victim; no calls have been made since they disappeared however just recently, there was a call made to a bank where the caller inputted a debit card number.

Can you find out the 16 digit card number so that we can trace the spending activity associated with this card? This will be very helpful in our effort to locate who may be a potential suspect in this case.

• Download the challenge file and play the recording. After hearing the caller dial the number pad, the next thing would be to find a tool that can decipher the numbers dialled.

• Quick search brought me to http://dialabc.com/sound/detect/index.html, upload the file and you get the flag.

• Flag: 4562659845852366

c. faultycassette

As part of an investigation into an individual we believe is responsible for a slew of email threats directed at senior politicians, we have been digging up boxes of evidence from various forests around the UK.

From a few feet beneath Grizedale forest, we've recovered a cassette tape that when played, has what sounds like some unrecognisable speech. We don't know who it is or what they're saying.

It isn't clear what the suspect was doing with this, or whether they intended for us to find it.

Are you able to identify who is in the recording for us? I've attached a digital copy of the tape.

Note: you've only got 3 attempts so refrain from just guessing!

2. Covert Operations

a. thermalentry

One of our undercover officers has been following a suspected financial crime kingpin and they keep visiting a lockup in a secluded area of London - we have no idea what is in there.

A couple of nights ago, the officer noticed that there is a digital PIN pad used to open the lockup door, and shortly after the suspect entered and closed the door behind them, our officer promtly approached the PIN pad and took a photograph of the keys with a thermal camera.

Research into the PIN pad reveals that it only accepts four digit codes, so that should make things easier.

What is the PIN code for the lockup? It will be much easier for us to make a subdued entry to find out what is in there without compromising our investigation through forcing our way in.

• the heatmap shows some number pad with heat. Digits with a smaller heatmap means the digit was entered earlier than those with a larger heatmap on it.

• Flag: 4185

3. Cyber Crime

4. Crime Scene Investigation

5. Financial Crime