2022

The link to the challenge is: https://github.com/seintpl/osintquiz/tree/main/2022

If you are on Linux, and want to get the hash for the next step, run the following command: echo -n "string" | md5sum.

Step 1

This summer, I got a message from my friend. I knew she was planning to visit Europe, but didn't have any clue where she was going. The message said: "I came to a city that welcomed me with a puzzle. While sightseeing I was tricked to go to the train station an hour earlier. And that's all because of the cathedral bells ringing noon not at the time you'd expect them to. While I ran down from the hill along a little street named after a president, just behind that cathedral I noticed a skull painted by a gate. Just behing that gate somebody left a piece of cloth. Its color is the password that will let you find my next exact location."

Make a hash of the color name to uncover the next step.

After reading this, I looked for a list of cathedrals in Europe. This ended up being a big list: https://en.wikipedia.org/wiki/List_of_Gothic_cathedrals_in_Europe. While researching, I came across this article:

I also ended up finding out that there were streets in Paris named after U.S. presidents: https://www.plug-inn.fr/en/5-streets-in-paris-named-after-us-presidents/. I also read about the Siege of Belgrade, which led to churches having to ring the bells at 12 PM. After searching for a while, I was a bit lost, so I checked out hint 1: Look for a city and a cathedral in Europe that rings its bell at 11 AM instead of noon.

This was a bit contradictory to be compared to what I had just read in the step1.txt file: While sightseeing I was tricked to go to the train station an hour earlier. And that's all because of the cathedral bells ringing noon not at the time you'd expect them to. It could have just been my interpretation of the sentence was incorrect.

This led me to find the following:

I now had two posts indicating that Brno might be the location I am looking for. At first, I thought it was going to be an American President, but looking into it, it seemed to be of the 9th and last President of Czechoslovakia named Václav Havel (Source: https://blog.foreigners.cz/brno-has-a-narrow-street-of-vaclav-havel/).

There I found the just behind that cathedral I noticed a skull painted by a gate part:

Going one "step" further, I was able to see the cloth:

This seems like it is purple maybe or magenta. It ended up being purple.

Step 2

The next message I got from my friend was strange. I think there was something wrong with her phone. The message I got was just "Going to 727774447777". Did she want to type a phone number or something was wrong with her phone? Could that be the hint to find the clue to her next location? 

The place she was travelling to (lowercase -> hash) is the password.

By looking at the value, I was able to tell it was a T9 cipher. This cipher works by assigning numbers to alphabet values. These were used on older phones to text others. Here is a great example:

If you wanted to type "A", that would be one press of the "2" button. If you wanted "B", that would be two presses of the 2 button. I found this code on GitHub (https://raw.githubusercontent.com/espilya/T9-Cipher-Decoder/master/prog.py), that made it easy for me to answer this question. I entered 727774447777 into a file called pass.txt. I then ran the following command: python3 T9.py pass.txt. The output was paris.

Step 3

The next message came on the first day of August. It said: "I know you found the cloth in Brno. The colour reminded me of a song and a movie from 1984 that had the same title. I remembered there was a place named just like the song and wanted to find it while being in Paris. I found the place on the map, but the shop wasn't there. People said it moved some time ago. I came to the nearest intersection and tried to look left first, but the sun was shining right into my eyes, just along the street. What was the time?"

The exact time in HH:MM format turned into a hash is the password to the next message. The time must be in that place's timezone.

The color of the cloth was purple. Looking online, I see that this could be referring to the album and the movie of Purple Rain by Prince.

Looking for purple rain paris on Google Maps, I see the store is not there anymore as well:

It seems to have been replaced by another store. I was now thinking the answer has to be based off of the sunlight. I found this article by bellingcat: https://www.bellingcat.com/resources/2020/12/03/using-the-sun-and-the-shadows-for-geolocation/. This led me to another post by Sector035: https://medium.com/quiztime/lining-up-shadows-2351ae106cec.

In the image above, the circle indicates where the store was. The closest intersection seems to be where the square was indicated. The step mentions: I came to the nearest intersection and tried to look left first, but the sun was shining right into my eyes, just along the street. On Google Maps, the sun does not seem to shine right in a persons eyes from that angle. Maybe the Google Camera operator was just taking the pictures at times that did not work in our favor. After plugging the location into https://www.suncalc.org/#/48.8731,2.3451,19/2023.08.17/14:15/1/2, we see the following. If the sun was right in her eyes, it would be 14:15 UTC+2 time.

I am not sure how day-light savings time plays into this. The step does say: The exact time in HH:MM format turned into a hash is the password to the next message. The time must be in that place's timezone. The time already seems to be Paris time:

14:15 did not work for me. Maybe the minutes are off? I was off by a couple of minutes. Trying out the numbers around it, I ended up getting the answer with 14:17.

Step 4

A whole week passed and I got another message from my friend: "I know you like puzzles, so I'm going to give you a clue about my next location, but first I have to tell you where I am right now. I moved to a country where I can really get The Sun. I am standing on a bridge between two towers and have a glass floor below me. It's incredible that I can actually see a ship sailing below me. I think someone said they're going to post it on Twitter today. The name of the place I'm travelling to next is where the ship is from."

Make a hash of the ship's country name (remmeber to make it lowercase first) to get the password for this step.

I wanted to work off of I moved to a country where I can really get The Sun. After looking a little bit online, I notice that this might be a News Outlet:

This might limit the area down to just U.K., but I am not sure about this just yet. I still followed this thread, and found that there might be a bridge with a glass floor:

I came across the following while doing research:

The prompt states: Make a hash of the ship's country name (remmeber to make it lowercase first) to get the password for this step. I will try Sweden or sweden. That was the correct answer.

Step 5

The next message arrived 10 days later and it surpirsed me: "I'm both in Sweden and in the USA right now. How is it possible? Well, there's a town with that name in the north of the US. It has a nice website, but fifteen years ago this town and website looked a little different. On the main page there was a picture of a building I am standing in front of right now. There's someone in a car parked right here, talking on the phone and another car with some strange gear just passed by. Can you tell the parked car's make and model?"

The make and model of the parked car mentioned in the message (in the pattern: xxxxxxxx xxx), turned to lowercase and into a hash, is the password to the next step.

I found the Wikipedia page listing the places in the US that have Swedish names: https://en.wikipedia.org/wiki/List_of_Swedish_place_names_in_the_United_States. From there, I searched for Maine first, but New York is the State that ended up getting me a lead: https://www.townofsweden.org/. I then used the wayback machine to see the image they had on the site 15 years ago (https://web.archive.org/web/20071004222022/https://www.townofsweden.org/):

I used Google Maps to see the location recently, and saw a person talking on the phone in a car:

I uploaded this image to https://carnet.ai/, and it gave the following results:

Make/Model**Infiniti/G**
Generation**IV (V36) (2006-2013)**
Probability**99.98%**
Color**Gray/Silver**
Angle**Left**

I will try the password infinity g. That did not work. I then looked at the back of the car, and it seems it might be a G35X (maybe?):

It ended up being infinity g35.

Step 6

The last message I got was: "This trip is over. I'm glad you accomapnied me virtually. Can you figure out just one more thing? Last year I found a nice cafe. It was just beside one of the places I visited last year. I will give you a clue of where I was - look at the attached files. The last one is from there. I remember I had to head north for about 10 minutes, under some green bridges and by a sign telling that the maximum height beneath that bridge is 4.2 m. The name of the cafe was something something cafe and one more word after that. Will you be able to find it?".
Unfortunetely one of the files got corrupted. There must be another way to find out the last, fourth location.

The answer is that unknown "something something" before the word "cafe" in its name, written in lowercase and turned into a hash.

We have files where the strings in them start with $GP***. I then learned that these were NMEA sentences. I used https://www.nmeagen.org/, to try to see where these files decoded to the following.

step6_1.txt:

step6_2.txt:

step6_3.txt:

The fourth file seems to be corrupted. Based on the images above, we can assume the place is a sport stadium. These are all in different countries. I was trying to decode the last portion, and realized that some of the information might not have been accurate, either due to corruption or being strategically made to be as such. This was the hint: What do these places have in common? The order of the clues is important.

Let's see where these are located at:

Location #1

GPS frequency computed: 1Hz.
Start date obtained: 2022-12-18.
Start time obtained: 11:18:38.238.
Valid GGA sentences read: 8.
Valid RMC sentences read: 8.
Other/invalid sentences read: 8.
The NMEA file contains 8 points.

Nationalstadion by the Beijng Olympic Museum
Beijing, China

Location #2

GPS frequency computed: 1Hz.
Start date obtained: 2022-12-18.
Start time obtained: 11:18:38.238.
Valid GGA sentences read: 4.
Valid RMC sentences read: 4.
Other/invalid sentences read: 4.
The NMEA file contains 4 points.

Olympia Stadion by the London Marathon Community Track
London, UK

Location #3

GPS frequency computed: 1Hz.
Start date obtained: 2022-12-18.
Start time obtained: 11:18:38.238.
Valid GGA sentences read: 6.
Valid RMC sentences read: 6.
Other/invalid sentences read: 6.
The NMEA file contains 6 points.

Sportkomplex von Maracana
Rio De Janeiro, South America

All of these seem to be Olympic stadiums. I looked online to the list of host cities and I saw the following pattern:

I then searched on Google Maps for the stadium. After searching, I feel like I had found the answer:

The part of the prompt that comes into play now is: I remember I had to head north for about 10 minutes, under some green bridges and by a sign telling that the maximum height beneath that bridge is 4.2 m. The name of the cafe was something something cafe and one more word after that. I searched for cafe around Japan National Stadium on Google maps, and saw the following:

I then dropped the Google Maps "yellow person" on the street in front of the place. I went one block down the road and saw the 4.2 m marking:

Good Morning Cafe Nowadays has to be the location. The format for this answer is that unknown "something something" before the word "cafe" in its name, written in lowercase and turned into a hash. With that in mind, I think it should be good morning.

That was the end of the challenge. I truly did enjoy this challenge.