Zoro's Detor (Cyberstorm 2025) Writeup

Category: OSINT (Open Source Intelligence)
Points: 300
Difficulty: Easy
Author: Nishith Savla
Date: 01-04-2025

Challenge Description

This is the last social media update from Zoro. He was supposed to get us Croquembouche from the Whole Cake Island...
His last transponder chat with Usopp said something about some street near a hotel he was crashing at.... He got lost again :/
Help me find him, we need him to break a few mountains here!

Initial Clues & Analysis

The challenge provided an image of a scene containing coastal village with traditional red buildings.

The first thing I did is search the image on Google Lens. The search revealed this this is an image of Tasiilaq Old Church.

Another preliminary step which I forgot for a good amount of time is checking the EXIF data of the image. After spending a good amount of time figuring out random stuff, I finally remembered to look at the image carefully. So then I ran exiftool on the image to find out if that’s hiding something.

$ exiftool image2.png
ExifTool Version Number         : 13.10
File Name                       : image.png
Directory                       : .
File Size                       : 1652 kB
File Modification Date/Time     : 2025:03:29 13:11:04+05:30
File Access Date/Time           : 2025:03:31 00:27:14+05:30
File Inode Change Date/Time     : 2025:03:29 13:11:11+05:30
File Permissions                : -rw-r--r--
File Type                       : PNG
File Type Extension             : png
MIME Type                       : image/png
Image Width                     : 1653
Image Height                    : 654
Bit Depth                       : 8
Color Type                      : RGB with Alpha
Compression                     : Deflate/Inflate
Filter                          : Adaptive
Interlace                       : Noninterlaced
SRGB Rendering                  : Perceptual
Gamma                           : 2.2
Pixels Per Unit X               : 3779
Pixels Per Unit Y               : 3779
Pixel Units                     : meters
Copyright                       : https://rentry.co/
Image Size                      : 1653x654
Megapixels                      : 1.1

And bang on, the copyright key contains a link to a website https://rentry.co/ which seems something to check out.

Investigation Path

Step 1: Checking out the link found in EXIF data

On visiting https://rentry.co, we see a textbox and some customization fields.

On checking this in detail, it seems like a online paste / note sharing website (similar to pastebin, but looks better).

And the main thing to note is that the notes can we have a custom url. This seems to be a great lead.

Step 2: Searching for Zoro based on the Clue

The challenge description gives us a big hint:

His last transponder chat with Usopp said something about some street near a hotel he was crashing at

So I went to google maps and searched for hotels near Tasiilaq Old Church

We only get two results here:

Hotel Amgamagssalik
The Red House

Now we need to dive in deeper and check these results for nearby streets.

Step 3: Checking the streets near the hotels and if there is a note for them on rentry.co

Now, first I checked Hotel Amgamagssalik. The street near to it is Suulup Aqqulaa.

Trying different cases and combinations of this like https://rentry.co/SuulupAqqulaa or https://rentry.co/Suulup-Aqqulaa gave us Error 404 Not Found.

Similarly, I checked for streets near The Red House.

Here the most nearby street is Napparngummut. And this is what led us to the flag.

Finding the Flag

The flag was in the note at https://rentry.co/Napparngummut

Flag: REDFOX{TH3R3_y0U_4r3_Z0rO!}

Tools & Resources Used

Search Engines: Google, Google Maps
Paste Sites: Rentry
Metadata Viewers: EXIFtool / Online EXIF viewers
Reverse Image Search: Google Images

Lessons Learned / Takeaways

Importance of Metadata in Digital Forensics: Metadata can provide crucial clues about a file’s origin, history, and potential hidden links. In this challenge, analyzing EXIF data revealed a link that led to the next stage of the investigation. So please check the darn METADATA.
Leveraging OSINT for Clue Analysis: OSINT techniques such as searching for geographical locations and landmarks, can help uncover valuable insights. Using mapping tools like Google Maps enabled us to correlate information and refine our search.
The Role of Persistence and Iteration: Revisiting previous steps with a fresh perspective can sometimes lead to new discoveries that were initially missed. I had dropped working on this challenge since I couldn’t find what to do with those streets before I checked the metadata. After some time, when I picked it up again is when I got the clue that led me to the solution.

Rabbit Holes / Dead Ends

Before getting to know about Rentry, I spent a good amount of time looking at the businesses nearby that church such as stays, hotels, etc. I began checking out even the reviews of those places to see if the flag has been posted in some review.

The challenge also mentioned that Zoro had gone to get some Croquembouche (some type of french dessert) so I even tried to find some Croquembouche patisseries / bakeries but none exist near the Tasiilaq church.

Credits: Nishith Savla, Nayanesh
Discord: @nishithsavla

Cyberstorm 2025 Writeup: Zoro's Detor [by Windows 9/11]

Table of contents