Description

A woman named Zikora Ifunanya Okafor has gone missing. Sieberrsec has called upon you to find her.

Intended Solution

Step 1: LinkedIn

• Search for Zikora Ifunanya Okafor on LinkedIn
• Visit the LinkedIn Page
• In the Experience section, you’ll find two things:

1. A pastebin link, https://pastebin.com/u0F0RfGe

2. A part of the flag sctf{m4yb3_ under Remote Hardware Engineer - Google DeepMind

Step 2: Pastebin #1 and #2

Pastebin #1

the next part lives here: https://pastebin.com/edtDHuvj

however, you need a password. perhaps if you had the first part of the flag??

• The first pastebin directs you to a pastebin link, hinting that the password needed is the first part of the flag.

Pastebin #2

try looking through social media accounts. heard that she likes to go by the alias ZIOdragon. maybe you could find something?

• It’s time to look through social media once again.

Step 3: Instagram

ziod.ragon

• Search ZIOdragon in Instagram

• Visit the Instagram Page
• You’ll see some random posts, one about some sausages, one about image metadata and one about a logic puzzle
• Realise that there’s nothing valuable to find there, and look through the follower / following list

chino.nsok

• Find the sibling’s Instagram Page with 1 post

• In the highlights, ziod.ragon commented with a partial flag z1k0ra_wa5_!
• turns out that insta doesn’t show these highlights/story comments while on web and I was gaslighting myself into thinking I was blind
• In the post, ziod.ragon commented with “1-uL5OY6aQbCkz4jw9zqNwW8FgvO1KUY_ 😍😍😍😍“

Step 4: Google Drive

• Deduce that the ID is part of a Google Drive link
• Test Google Drive formats, namely:
  • https://drive.google.com/folders/1-uL5OY6aQbCkz4jw9zqNwW8FgvO1KUY_
  • https://drive.google.com/file/d/1-uL5OY6aQbCkz4jw9zqNwW8FgvO1KUY_
• You’ll be directed to a picture of a snake with two fake arms (the bane of my existence)

Step 5: Guessy Steganography

Impressions

• Arriving at this picture, test it by uploading it to https://aperisolve.com, but you’ll find nothing

• An Yi also mentioned about how the top rows looked funny, reminding me of QR Codes and AI Image Upscalers, but it was just “regular steganography”.

• According to Xi, brute forcing is possible (?), but seeing as how the solution space is $2^{24} = 16,777,216$ combinations of bit planes / channels, I was stumped

Hints

use https://georgeom.net/StegOnline/upload

RBRGRRGBG, where every row has one r g or b with one row in exception of 2

have fun gng

• Based on the hint from the An Yi and Xi, deduce that the bitplane combination is R7,R5,R4,R3,G5,G2,G0,B6,B1 or R7,B6,R5,G5,R4,R3,G2,B1,G0 (solution space reduced from $2^{24}$ to $4$ hooray!)
• Alternatively, brute force the combinations of bit levels and bit channels with a heuristic English language checker (see naive brute forcing script here)
• You’ll receive a list of three poems from the extraction, and a part of the flag nev3r_ after it!

Step 6: Poems

I was told I will be directed to a tinyurl but all i was given were these 3 very strange poems

Dawn

The night folds up its velvet tent

And stars retreat without a sound

A silver hush hangs in the air,

While sunlights paint the waking ground

The trees stretch out their shadowed arms,

The rivers catch the morning’s gold

Each day arrives a quiet gift,

A story waiting to be told

04/02/26

Ocean’s Memory

The ocean keeps what we forget

The footprints washed from summer sand,

The laughter carried by the wind,

The shells once held in tiny hands

It gathers secrets, storms, and dreams,

Then hums them softly to the shore

A language older than the moon,

Repeating what was lost before

04/04/26

Between the Pages

I found a world inside a book,

A place where time could bend and roam

The paper doors swung open wide,

And every chapter felt like home

I met the brave, the lost, the wise,

Walked distant roads and crossed strange seas

Then close the cover with a smile

Yet carried all of them with me

07/02/26

• We need to find the ID for a https://tinyurl.com link based on these poems
• I was genuinely stumped and had no idea what to do at this point in time as I had been assisting in answering tickets for 5 hours at this point
• Eventually make the connection that the dates give the line no. and word no. for each poem, so for example 04/02 would mean line 4 word 2
• This gives us the link https://tinyurl.com/sunlightsheldclose

Step 7: Blog

• Clicking on the link brings you to https://storage.googleapis.com/zikorablog/index.html

Inside the Blog

• Looking at the suspiciously placed download button, inspect to see whats being hidden and find another two parts of the flag

• m1s5ing_1n_ in the space between where the download button is and where it should be
• 7he_ in the CSS

Attached to the Blog

• Downloading the images, you’ll see that you need a string of numbers to complete the string of numbers 030008020107__________

Coordinates to the Zhejiang Museum Wulin Branch	Reddit says that these 免死金牌 had 333 characters.
Location of the Nile River with respect to the map orientation is West.	A quick Google search reveals that there are 138 Pyramids in Egypt.
Google AI tells us that the author of 《本草纲目》 tried 365 kinds of herbs and plants while writing the book.

• 333: The Chinese text is coordinates: 30.2773218, 120.1634463, pointing to a museum/object related to an ancient 免死金牌 / 丹书铁券 (“death-sentence escape pass”). The inscription has 333 characters.

• 4: The map location shown is West of the Nile, but since the image is upside down, the Nile is to the “west” from there.

• 138: The drawing means “pyramids”. The clue asks how many pyramids were “seen”, and the commonly cited count for Egyptian pyramids is 138.

• 365: The question references the Chinese herbal medicine book《本草纲目》in which the author Li Shizhen tested 365 kinds of herbs while compiling it.

• The final ordering by senses is: Heard 333 → Touch 4 → See 138 → Taste 365

• Combining it with the other numbers in the main blog and padding with zeroes, you get the Hex key 03000802010703030304010308030605

• Inspecting again, you find the AES Key in the meta id in Base64 w6VMVC2Kcvp1+2JUjuzdzQ==

• This is a AES-CBC Decryption, hop onto Cyberchef
• Cyberchef detects it as a Word Document, download the output as a file to obtain the final part of the flag! f1r57_p|4c3}

Thoughts

• certainly a well put together challenge and definite suitable challenge difficulty
• retiring from osints from now on ✌️✌️✌️

Flag

sctf{m4yb3_z1k0ra_wa5_nev3r_m1s5ing_1n_7he_f1r57_p|4c3}