Osprey 1, 2, 3
Osprey 1
Event: DiverOSINT CTF 2024
Difficulty: easy
Points: 100
Solves: 203
Challenge Description
On 29 November 2023, a US military Osprey (V-22) crashed off Yakushima Island, Japan. The challenge requires identifying the number of this aircraft and its call sign at the time of the crash.
To obtain the flag, you need to provide the aircraft registration number and its call sign. The flag format is: Diver24{XX-XXXX_CALLSIGN}. For example, if the aircraft registration number is 01-2345 and the call sign is CALL01, the flag should be Diver24{01-2345_CALL01}.
Note that there are three challenges related to this accident in the CTF. Each challenge must be answered correctly to unlock the next.
Solution
For incidents of greater importance, such as aircraft accidents, a record is usually kept. When we search for “V-22 accident list,” we can find a record from the Aviation Safety Network.
This record includes details on the Yakushima accident, showing the aircraft “Registration” as 12-0065 and listing the call sign Gundam 22.
Diver24{12-0065_GUNDAM22}
Osprey 2
Event: DiverOSINT CTF 2024
Difficulty: easy
Points: 100
Solves: 114
Challenge Description
On 15 February 2024, a memorial service concerning this accident was held at a US military base. The ceremony took place at approximately 16:46:37.
To obtain the flag, you need to provide the location of the ceremony using the OpenStreetMap Way number. The flag format is: Diver24{123456789}. For example, if the Way number is 123456789, the flag should be Diver24{123456789}.
Solution
Searching for the ceremony we can find this article.
“A 1 ½-hour memorial service began at 10 a.m. inside Yokota’s Taiyo Community Center to remember the eight fallen crewmembers of call sign Gundam 22.”, it says, so not before sunset.
This, however, sounds oddly familiar:
“A half-hour before sunset, approximately 600 people, mostly airmen in uniform, gathered for a brief retreat ceremony on the athletic field outside Yokota’s Samurai Fitness Center. The 5 p.m. assembly …”.
By taking a look on Google Maps, we find that next to Yokota’s Samurai Fitness Center there is Yokota Training Field, the only training field nearby.
Sadly, you cannot find it on Open Street Map the same way, but by putting the two websites side-by-side, we can find the osm location around the intersection between Tunner St and Airlift AVE.
With OSM query features, selecting the field we find it’s way number. Diver24{810021666}
Osprey 3
Event: DiverOSINT CTF 2024
Difficulty: medium
Points: 479
Solves: 24
Challenge Description
The crashed aircraft was apparently parked at some airport on the night of 15 November 2018. To find the flag, you need to give the elevation (in feet and integer) of that point. You can consider there are no discrepancies in the times of the various data sources. Also, you can refer to the latest information about the airport (no need to use data as of 2018).
The flag format is: Diver24{250}. For example, if the elevation is 250 feet, the flag should be Diver24{250}.
This is the last challenge about the Osprey crash in this CTF. It also had a limited number of attempts.
Solution
We can find on JetPhotos (a platform I used for multiple OSINT challenges going forward) all the pictures of different aircrafts uploaded by users alongside their location, date and registration number.
By filtering through registration nr. 12-0065 and year, we find a picture exactly from 15th of November here.
And it has the location as well: “Kraków John Paul II Balice Int’l - EPKK”.
AIP (Aeronautical Information Publication) offers detailed and accurate information when it comes to airports. And when searching for AIP and the aforementioned polish airport, we can find this site. By translating it from polish and searching in page “EPKK”, we can see the official Aircraft Parking Map.
After an hour-ish of wandering around the airport using Google Maps Streetview and a couple of easter eggs, like an ultra-modern church and a funny selfie of two pilots (consider it my challenge for you to find them), as well as zooming in hard on the background of the JetPhotos image from earlier, I identified the tower in the background on Google Maps.
Upon yet another lengthy side-by-side comparison between Google Maps and the AIP map from earlier, you can identify the parking space in front of the control tower as Apron-13, with an elevation of 774 feet.
Diver24{774}