Cyber Investigator CTF - Crime Scene Investigation Writeup

Cardiff University's Cyber Security Society organized Cyber Investigator CTF, a jeopardy-style competition for OSINT (Open-Source Intelligence), threat intelligence, and digital forensics enthusiasts. This writeup covers the Crime Scene Investigation challenges.

oink

The image contains ciphertext, so we first need to identify the cipher. Google image search reveals a Pigpen cipher.

Uploading the image to an online Pigpen decoder reveals the hidden flag.

spintowin

The ciphertext is "Yheehp max fhgxr" with the key "45". I suspected a Caesar cipher, and decrypting it with the given key revealed the hidden text.

gonemissing

The case asks for the brand of a person's jacket when he was last seen. Its reference is "15-007500". Searching "missing persons search uk" leads to the UK Missing Persons Unit website (opens in a new tab), where the reference number returns one result.

restinpeace

The target is the presumed date of death for Ms. Doris Ellen Smith, who was found dead in Glasgow, Scotland. Searching her name on Ancestry (opens in a new tab) leads to a Surrey County Council library card associated with her. That record narrows the search to Surrey, England. Searching local death, burial, cemetery, and obituary records produces the correct result.

urbanplanners

A suspect threw a petrol bomb at a construction site at "40 Heol-Y-Deri, Rhiwbina, Cardiff, CF14 6HH". We start tracking the suspect through the site's planning applications. The first website isn't useful by itself, but it provides the planning application data.

Searching "cardiff planning" leads to the Cardiff Council planning page (opens in a new tab), which redirects to its public access portal (opens in a new tab). Searching the target address there returns one planning application.

The property's history includes a refused planning application.

The "comments" tab on that application contains the information we need.

There it is, the flag!

discharged

The challenge image contains two pieces of evidence.

The first clue is a piece of text. ChatGPT identified its source:

The second piece of evidence is a picture of a broken thumb. Searching for "macbeth broken thumb" leads to several articles that name the witness, which is the flag.

burningrubber

The calculation asks how much a car was overweight during an accident caused by a tire blowout. I collected these figures:

Car weight: 2200 kg
Driver weight: 85 kg
Cargo weight: 160 kg per cargo
Number of cargo units: 3 units
Tire profile: 205/55 R16 91V

First, we need the maximum load capacity of the car's tires. Searching for "tire profile load calculator" leads to a calculator (opens in a new tab) where we can enter the load index, which is 91.

The maximum load capacity for all four tires is 4 * 615kg = 2460kg. The car, driver, and cargo weigh 2200kg + 85kg + 160kg * 3 = 2765kg. Subtracting the tire capacity from the total weight gives the answer.

jigsaw

The challenge supplies 100 scrambled image fragments. Since the goal is to identify the person, reconstructing the face is enough.

Google Lens identifies the person from the reconstructed face.