OhSINT Hints, Writeup, Walkthrough & Notes

[sub] OhSINT walkthrough // TryHackMe Writeup // THM Guide – powered by Happy Scribe

Welcome back to the channel.

This is going to be a walkthroughof OhSINT, an easy beginner challenge CTF

in Google Dorking and gonna use someopen source intelligence to solve this.

So the only thing we have which is a bitstrange for me anyway is just an image.

So we’re starting withan image and that’s it.

So there’s no box to virtual machineto start up or anything like that.

It’s all just the flaming thing.

So I’ve already downloaded it.

Not to ruin the surprise, but I haveactually gone through this box.

I know what’s up and I will explaina few things along the way.

So we’ll go ahead and download

that and we’ll give it a bit of an insect,a bit of a hover there.

What do we got?Windows XP, JPEG.

So by the untrained eye, we don’t haveanything here, no hidden imagery.

It looks just like a pretty basic image.

So we need to use somethingto assess this little closer.

So if we look at our hint here sowe’ve got our list of questions.

So a few questions.

What is the user’s avatar of?

What is this user’s avatar of?

So it makes zero sense.

So my first intuition was like,let’s just go find it first.

So it’s just on the desktop.

So is there anything unusual about it if

we just look at it and we can run fileagainst it and it is indeed a JPEG.

So the hint here is EXIF tool.

So when we look up EXIFtool we can find that.

This is a pretty popular command lineapplication, pearl library for metadata.

So I’m not an expert in this,

but I know when we take photosthat there is more data behind the photo

than just the photo itself,the pixels and whatnot.

So we can go ahead and sudo apt install

EXIF tool like so I’vealready got installed.

So once it’s installed we can just go

ahead and look at the manpage for that EXIF tool.

We can see here itread and write meta information in files.

So not just JPEGs but all files.

So yeah, there’s a lot that this thing cando, but we can go ahead and just run it

by default against our image thereand we get some information here.

So going through this, it’s reallya case of what sticks out at us.

Okay, so this is where wesort of take our time.

So version number of the tool,the file directory, things that we already

know, the permissions we could alreadysee that nothing really unique here.

Copyright.

Now, I must admit, when I first saw that,I did sort of skip over it.

And this is sort of what’s hard aboutgoing through this stuff is it’s not like

a video game where there will be a lightshining towards

somewhere that as the player weknow that we need to go that way.

We have to use somecritical thinking here.

I honestly skipped over this.

I just went, okay,I don’t know what that is.

It’s probably not too important.Kept looking.

I was like, okay, well,maybe we’ve got some GPS coordination.

Maybe we do something with that.

And maybe this coding baseline,maybe that’s something.

But then I thought back to copyright.

I’m like, you can just sortof whatever in a copyright.

I mean, you can manipulate allthis metadata input or whatever.

But I’m like, I don’t know,I think that this is the thing.

So let’s go ahead and justdo some Google dorking.

So you can see here I’ve alreadygone to these links and this is it.

This is open source intelligence.

And it took me a little bit to get my head

around to be honest, because Ithought we were going to stay here.

And this is what I’m used to,I’m used to cybersecurity.

I’m used to learning hackingin the terminal.

Like this is where we do stuff.

But open source intelligenceis using the Internet.

So this is kind of wildfor my little brain.

The next thing I made a mistake in when

going through this is Ionly looked at Twitter.

I just saw Twitter and I just assumedthat the rest were challenges.

I didn’t even look at these other two.

So learn from me and what my future self

will be better at is actually takingthe time to look at the search results.

So we can see here we have a Twitter

profile, then we have a WordPress.comblog and then we have a GitHub repo.

And then the giveaway is these are all

anything that says tryhack me or write up.

We can confidently say that these are

people have been looking up the Gmailand some spy talks, whatever that is.

Those are just write ups.

But our focus is on these three.And this is really cool.

I have seen this in other CTFs-

from watching John Hammond videosand other YouTubers and that

this is a part of the challenge wherewe’ll have fake

Twitter accounts or Facebook accountsthat we can go and try and hack.

Let’s look at these three in order.

And if we go back to whatis the user’s avatar of?

Pretty confident out of all of our three

accounts that we can focus on that theavatar is indeed of a C.A.T. Nice.

What city is this person in now?

Again, I made the mistake of not looking

at the other options that I justwas here and I was like, what?

Oh man.

I was looking at comments and there wassome like base 64 encoded comments.

I’m like, is this a part of it?

Don’t waste your time.

This is an easy challenge after all.

So I go to deep too fast.

It’s another thing.

So let’s just flick through.

So we’ve got on this one.

I’m in New York right now,

so I will update the siteright away with new photos.

Okay, so we’ve gotHello Worlds from my house.

I can get free WiFi, and we have some sort

of MAC address lookingthing back on Twitter.

So this isn’t helping.

We can see here that they are in New York,

but our question is,what city is the person in?

It could be New York.I’m just playing.

I know it’s not.

So let’s go ahead and look over hereat the GitHub repo.

And we can see that this is the only

repo that I have, is this people finder,which I think is in spirits.

Hi, I’m from London.

That is what we’re after now,

this next one, and I got a story,BSSID plus wiggle.

Net.So this was totally new to me.

Let’s just go check out Wiggle.Net.

If we look here, we do havesome more information.

This is linking to our Twitter,talking about photos.

And here, email me if you want.

Before we go down that rabbit hole,

let’s just go over Ispelled it wrong, didn’t I?

Let’s just look up wiggle.There we go.

What’s the SSID of the WAPhe connected to.

So we need to use this website.

Okay, you will need to make an accountin order to Wiggle work,

and you do not need to use youractual personal information.

You can just go aheadand use whatever you want.

So the idea here is we have this hint,

this BSSID, which I did look up whatit stood for and I can’t remember.

But we can use this MAC addresslooking thing, put it in here.

As you can see, my other attempts paste

that in and we can querythe database to find where he’s at.

This is where I had the issue.

So if we sort of look around

the map didn’t really takeme anywhere straight away.

I can’t actually see anything on the map.

There is something in London.

And I must admit, this didnot work out well for me.

When I first did this, I punchedit in and I didn’t see anything.

And I didn’t take my timelooking around the map.

And I must admit,

it stands out now because Iknow what I’m looking for.

But if you tried this like me,

don’t feel silly that you didn’tsee it or it didn’t work.

So we can see here that this MAC address

actually does come up on theirdatabase, which is just nuts.

I was reading an article about thiswebsite, and it’s kind of crazy.

Okay, so this is actually new territory.

I don’t know how to what is the SSIDof the WAP he connected to?

So can I interact with this?

There is a name.

There is a name.

It’s very small.

I definitely didn’t copy this the first

time of the wireless accesspoint that he connected to.

So what’s his personal address?

So, we can find that out ifwe go back to his GitHub.

Interestingly enough,

if we actually go to his pull requests,there’s pull request here of that README

file where he’s added,messaged me on Twitter for my email.

Probably not a good ideato give out publicly.

We can see.

I’m a little confusedbecause it’s got it here.

So the pull request was made meaning,

but he committed it, but he didn’t,like, push it to the master branch.

So that’s why we don’t see thisgreen message instead, we still see.

I think that’s how GitHub works.

Bit of an interesting thing,just I found from poking around.

So what site did you findhis email address on?

So we found it on GitHub.

Where has he gone on holiday?

So if we go back here I’min New York right now.

New York.Oops.

You can paste it in there.

It’s all pretty straightforward.

And what is this person’s password?

Okay.

I had some issues with this room.

Like, this didn’t work for methe first time because I was silly.

It annoyed me a little bit,if I’m being really honest.

I only found this from lookingat another write up.

So if we use our inspect and we can hover

over, we can see that there is a blankarea here and indeed,

there is just a like,if we just change this to #000000

we can see here that the textis actually on the website.

It was just hidden.

So in one way, that’s cool.

Like a little thing like,

make sure you look around and inspectpeople’s websites,

you might find something like this,but at the same time, who does this?

I think that’s what sortof annoyed me about this.

I would have never, ever, ever found this.

I don’t think I would have ever found it.

Some part of me thinks I would have,

but another part of me is like,I wouldn’t have looked there because I

guess in my head,who puts a password on the front?

I don’t know.

I guess I’m probably just missedthe reason that it’s just a bit of fun.

It’s not supposed to be like,

super serious,but I guess that’s just my brain.

And I think it was really from when things

went wrong on the wiggle.net for me thatit sort of all started to spiral apart.

So I didn’t have the bestexperience with OhSINT.

I don’t think that’s at the faultof the TryHackMe or the creator.

I think it’s just more me.

But anyway, that was my experience.

It was fun to go through the first time,even though it was quite infuriating,

but I much prefer going through a secondtime and sharing it in this format.

This was much better.

It was nice when things actuallyworked out and getting to show you.

So I hope you enjoyed.

This has been OhSTIN from TryHackMe.

Go show some love to the creatorand the community.

I hope you enjoyed this video.

If you found it helpful,please let me know.

Leaving us comments.

It does help me.

It’s very motivating to see somepositive comments in the description.

If you have any feedback,like if I’ve done anything different

to you or anything like that, I’m alwayskeen to improve, so that would be great.

And the last thing for me is I havea monthly newsletter that I thought I

would let youknow about and let you in on.

If you want to, there’s a link below where

it’s just a littlefriendly monthly update.

And I still have to write last month’s.

But yeah, I’m usually on to it.

Anyway, that has been the video.Enjoy.