Geoint

Les vacances au chateau

We were given a castle image and we need to find its name. No data are inside the exif:

$ exiftool FirstPart.png
ExifTool Version Number         : 11.88
File Name                       : FirstPart.png
Directory                       : .
File Size                       : 688 kB
File Modification Date/Time     : 2022:07:01 22:44:37+02:00
File Access Date/Time           : 2022:07:01 23:26:07+02:00
File Inode Change Date/Time     : 2022:07:01 23:28:22+02:00
File Permissions                : rwxrwxrwx
File Type                       : PNG
File Type Extension             : png
MIME Type                       : image/png
Image Width                     : 912
Image Height                    : 409
Bit Depth                       : 8
Gamma                           : 2.2
Pixels Per Unit X               : 4724
Pixels Per Unit Y               : 4724
Pixel Units                     : meters
Image Size                      : 912x409
Megapixels                      : 0.373

After submitting it to Yandex, we can find that the castle is named Chateau d’Ambroise:

Untitled

The flag is PWNME{ambroise}

Au bord de l’eau

We were given a second image where we need to find the name of the road:

Untitled

After submitting it to Google Lens, we can find a city named Saint-Jorioz.

Untitled

The city is near a lake, and after some researches, we can see the mountain on the given picture.

Now that we have the town, we need to find the exact road. Looking at the angle of the photography, we can say easily determine a zone where the photo has been taken:

Untitled

If we look on google maps, we can find “Le jardin de la plage”, with this picture:

Untitled

The road is Digue à panade.

Flag : PWNME{digue_à_panade}

La tête dans les nuages

We were given another image which has been taken on a mountain. We only know that the location is near the last one. I tried to identify the mountain pattern thanks to Google Earth (it wasn’t easy!):

Untitled

I also tried find the valley pattern, represented by the green line bellow:

Untitled

Thanks to those informations, I found out a mountain named Semnoz which was the flag!

Flag : PWNME{Semnoz}

Forensics

It’s not just a cat story

We were given a file named Acquisition.e01:

# file Acquisition.e01
Acquisition.e01: EWF/Expert Witness/EnCase image file format

After some researches on the web, we can find some tools that can be used for EWF files:

$ ewfinfo Acquisition.e01
ewfinfo 20140807

Acquiry information
        Case number:            2600
        Description:            We found this usb key during our search of the hacker's house
        Examiner name:          Monsieur Nouille
        Evidence number:        5200
        Acquisition date:       Tue Jun  7 14:11:48 2022
        System date:            Tue Jun  7 14:11:48 2022
        Password:               N/A

EWF information
        File format:            EnCase 1
        Sectors per chunk:      64
        Compression method:     deflate
        Compression level:      no compression

Media information
        Media type:             removable disk
        Is physical:            no
        Bytes per sector:       512
        Number of sectors:      81920
        Media size:             40 MiB (41943040 bytes)

Digest hash information
        MD5:                    f3e2d3ad77b3f580aca312b994319e04

Then we can try to mount it and gather some informations :

**$ mkdir tmpmnt 
$ ewfmount Acquisition.e01 tmpmnt
$ ls -l tmpmnt/**
total 0
-r--r--r-- 1 root root 41943040 Jul  2 14:03 ewf1
**$ file tmpmnt/ewf1**
tmpmnt/ewf1: DOS/MBR boot sector

**$ strings tmpmnt/ewf1**
3,4@
b0VIM 8.2
...
/media/usb-drive/Pain.txt
U3210
#"!
Why
Why are we still here? Just suffer ?

**$ binwalk tmpmnt/ewf1**
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
2269184       0x22A000        JPEG image data, JFIF standard 1.01
2269214       0x22A01E        TIFF image data, little-endian offset of first image directory: 8

We can see that there might be an image. After extracting it, we get a cat image, which is not giving us the flag:

Untitled

So I tried to open the original file, Acquisition.e01, with Autopsy. We can find 3 carved files:

Untitled

After extracting those files, we have this image with the flag:

Untitled