TryHackMe — Overheard at Breakfast Writeup
Category: OSINT
Difficulty: Easy
Points: 60
Author: TryHackMe
Challenge Description:
“The breakfast terrace is loud this morning, clinking cutlery, espresso machines, the usual chatter. One guest couldn’t help but linger at a nearby table, seeing more of a conversation than they were meant to.
When the table’s occupant stepped away for a refill, they seized the moment and grabbed a screenshot before it could disappear. Somewhere in that conversation is enough to track down an account nobody was supposed to find.”
In this challenge, you will be provided with a ZIP file. After downloading and extracting it, you will find an image.
When we open the downloaded image, we can see a conversation between two people, Ponzi and Lambo. At first glance, there seems to be nothing special about it. However, if we read the conversation carefully, we can spot some interesting parts that are worth investigating further.
Lambo mentioned a free tool that allows him to upload his profile and link his other social media accounts. He also mentioned that the tool’s name starts with the letter “G”.
Get Steve’s stories in your inbox
Join Medium for free to get updates from this writer.
Now, the question is: How can we retrieve the flag?
Step 1: We search for the keyword on Google. Based on the search results, we discover that the tool Lambo was referring to is Gravatar.
Step 2: We visit the Gravatar website. One of its features allows us to search for someone’s profile using their email address.
Step 3: The next question is: Where can we find the email address?
If you remember, in the conversation we highlighted earlier, we found an email address: lambobytelotushotel@gmail.com.
Step 4: Copy the email address and paste it into Gravatar’s search feature. After completing the process, we will get a result.
Step 5: Copy the prize and use it as the flag. But wait! When we submit it, we get an error indicating that the flag is incorrect. Why is that?
If you look closely, you’ll notice that the flag must follow the THM{...} format and the prize we retrieved also appears to be encoded. But what kind of encoding is it?
Step 6: To figure this out, I’m going to use Dencode. Simply copy the secret and paste it into the input field.
Step 7: It turns out that the secret is encoded in Base64! Decode it, copy the flag, and submit it in the challenge’s flag submission field and congratulations! You’ve successfully completed the challenge!
Thank you for taking the time to read my write-up! I hope you found it helpful. Happy hacking, and see you in the next challenge!
Tags: #ctf #osint #tryhackme
References:
https://tryhackme.com/
https://gravatar.com/
https://dencode.com/en/
https://www.ibm.com/think/topics/osint
