header
Blog Advisories Writeups Tools Exploits Contact Search:  

Writeup: PCTF (10 – Chiptunes?… Crickets? – 300pts)
Here is the write-up for the CTF challenge #10 organized by the team PPP. This was an easy one if you have been into Ham Radio.

The challenge description was as follows:

Description

Category: forensics

We are trying to find the meeting place of two AED operatives, which we believe is encoded in this file.
Analysts tell us the meeting is at a farm, but we need more information than that.

Submit us the whole name of the farm (including the word farm).


Well I'm not a forensics guy, but I decided to give a try to this challenge just for curiosity. As soon as I heard the audio it reminded me my old Ham Radio days. It sounded similar to the NOAA satellite transmissions used to transfer weather images...

So I started the old computer which I have for radio shitz and started analyzing the audio signal searching for APT/HRPT/SSTV transmisions, and voila it was an SSTV transmission. Here is an screenshot for the audio file being processed.




And this is the full image after being processed:



Damn!!! I was expecting the farm name to be included at the end of the image... We have to keep searching for the farm name somewhere else... I remembered about one of those reverse image lookup services http://www.tineye.com/. After submitting the image to the service we get this result http://www.gettyimages.es/detail/88625196. Again it doesn't say nothing about the farm name... Just some vague description:

Título: Mountains outside Cape Town in Autumn
Leyenda: A berry farm set in the beautiful wineland mountains of the Western Cape, just out side Cape


So we kept searching for the farm name, even searching farms on google maps around Cape Town in South Africa without results. Then we decided to search for the name of the photo author and found his flickr photo stream and also the same photo!!!
http://www.flickr.com/photos/calico182/490559080/in/photostream


This time there was a good description including the farm name:

*****
EOCT2
Hillcrest Berry Farm, Cape Town
Nikon D70s with a Nikon 18-70mm
*****

Stopped off at the berry farm on the way back to Cape Town from the South African Cheese Festival.

Cape Town, South Africa


So the key was:

Hillcrest Berry Farm






Quite interesting detail which I missed (Thanks to Kachakil for the image and the notice). If you open the audio file with a spectrum analyser you get this:

Date: April 26th, 2011 | By: NighterMan


Comments:

NighterMan Says:

jajaja that photo is quite funny, we tried lot of farm names :P


Thanks for the tip Kachakil I have updated the post with your image.


Kachakil Says:

Seeing this photo (http://twitpic.com/4p4gj8), I think that the hardest phase was the last one, do you agree?. We also spent some minutes trying to find the name of the farm after finding it in tineye… ;-)


BTW, I’ve sent you an image of the spectrogram of the audio file. If you want to attach it to this post, it will be great, because is really curious!


Regards!





Leave us a Reply

Members

Painsec
0xroot

Painsec
Alone

Painsec
BatchDrake

Painsec
bNull

Painsec
Dade

Painsec
firl

Painsec
HockeyInJune

Painsec
knx

Painsec
kuzushi

Painsec
MFox

Painsec
NighterMan

Painsec
SakeBomb


Categories

  • No categories