neven@dimitri-dev:~$
cd ../hacknite-2021

$cat journey.mdOSINTHacknite 2.0

Journey

GPS coordinates hidden in a photo lead to a Google Maps review, a profile with a Twitter link written on a picture, and a flag tweeted from Lea's own account.

  • #exif
  • #geolocation
  • #google-maps
  • #twitter
  • #pivoting

$man journey

What this one teaches:

  • Photos can carry EXIF metadata, including GPS coordinates, which you can read with an online viewer or exiftool.
  • A Google Maps review leads to the reviewer's public contributor profile, with their other reviews and photos.
  • Following a trail from one account to the next through links and replies.

Task description

Lea loves to travel and to capture every place she visits. If she likes a place, she always leaves a review on Google Maps. She also keeps all of her online profiles public, which lets strangers get at her private information. Find the location where this photo was taken. It will help you solve the task.

The original was in Croatian; this is my translation.

Where the photo was taken

The task hands out a single photo. We uploaded it to an EXIF viewer at tool.geoimgr.com, which read GPS coordinates out of the file’s metadata (exiftool shows the same fields if you’d rather not upload anything):

45.800353882095, 15.9713481112861

Pasted into Google Maps, the coordinates drop a pin on FER, the Faculty of Electrical Engineering and Computing in Zagreb.

Lea’s review

The task says Lea always reviews the places she likes, so we went through FER’s reviews on Google Maps. One of them is a five-star review from Lea Leovac: “Predivan fakultet (pogotovo za rješavanje CTF natjecanja ;))”, which means “A wonderful faculty (especially for solving CTF competitions ;))”.

Lea Leovac’s five-star Google Maps review of FER, with Google’s English translation underneath

Clicking her name opens her Google Maps contributor profile. Among her photos is one she added to SS. Annunziata di Firenze, a basilica in Florence. It shows the city at dusk, and a URL is typed across the sky:

https://twitter.com/regentcruises/status/1411671316185464836/photo/1

The link opens a tweet from the regentcruises account. Lea Leovac had replied to it, so we went to her own profile, @lea_leovac. One of her tweets, posted on 6 July 2021, is nothing but the flag.

Lea’s accounts were made for the competition, and Twitter has since become X, so some of the trail may be gone by now.

$cat flag.txt revealCTF2021[487251655525]

Written by Neven Marić. This writeup was written with the help of Claude Code (Anthropic).