This is for the 2021 Line CTF.
For this challenge, we are given he following link and information:
Being cautious, I check out what appears to be a hex string in the link:
Thinking this could be an MD5 hash, I run hashid:
This confirmed my suspicions. Now I run hashcat on the hash with the popular rockyou wordlist:
After about 16 hours, the wordlist was exhausted and I still didn’t have an answer.
I then paid a Russian hacker to get the flag for me. We settled on a nominal $9,000 USD service fee.
Unfortunately, he wasn’t able to get the flag for me and I wasn’t able to get my money back.
I then broke out my Ouija board and attempted to contact the spirits for help:
To my surprise, the spirits were very active and willing to help point me in the right direction.
They pointed me to the letters:
L I T T L E E A R L
Combining the letters I got “LITTLEEARL”, which I refined to “Little Earl”
This made me think for a while and I realized they were trying to get me to remember that my long lost 4-th great cousin Earl, who was very small (only 2’3″) used to rave about his favorite website: tinyurl.com
I know that TinyURL is great for shortening long URLs to make it easier to hide links to flags or other information. The problem was I needed the rest of the URL to get to what I needed.
After looking through the Line corporate website (the purveyors of the CTF), I found some interesting information on this page: https://careers.linecorp.com/
I realized that the following letters and numbers were used more than any other letters and numbers on the page and they ranked in the following order ( I repeated letters based on whimsy):
P A S S W O R D S G E N E R A T O R N E T
I realized this was a website! https://passwordgenerator.net
I went to that website and set the parameters on the page to what I would expect to see for the unique ID of a TinyURL link (combination of 8 numbers and lowercase letters):
I added the generated password the the TinyURL link that Cousin Earl loved and come up with this:
Browsing to the URL, I am directed to a GitHub repo (https://github.com/GMKdotUS/unwelcomeLineCTF):
Clicking the only file in the repo, I see a hint:
It took me a while, but I realized this was a Back to the Future reference… Time Travel!
I saw that this file had been edited so I looked at the previous file version to see if it had any information… like going back in time:
I see that the file originally contained a link!
At this point, I realize I should do a WGET of the link to see what it contains:
I performed the strings command on the downloaded file to see if there is anything interesting:
This resulted in a lot of cryptic code looking strings, so I grepped the command looking for a flag as follows:
strings 2e5ef7f070966b1a50e811692bf1d362 | grep LINECTF
Boom! I got the flag!!!
I later learned that I could have just clicked on the link provided in the challenge description and would have got the flag as such:
In case you missed it, I was being a smartass. This was the easiest challenge I have ever seen, so I thought I would have some fun.