Baba Yaga's Corner

Table of Contents#

1. Introduction
2. Challenge Description
3. The Leaked Email
4. Analyzing the Rentry Note
5. FAA Registry Lookup
6. Finding the Tail Number
7. Verification on FlightAware
8. Final Flag

Introduction#

This is a writeup for an OSINT challenge from the CAT CTF 2026 finals, where my team Mont5ab El2hwa secured 2nd place.

The challenge gives us a single leaked email and asks us to trace the sender’s movements using nothing but open sources: email headers, a linked note, the FAA Aircraft Registry, and public flight tracking data. Below is the full walkthrough of how I solved it.

Note: This is not the intended solution for this challenge. It is my own approach to solving it.

Challenge Description#

An internal investigation recovered a single email from a compromised mailbox. The sender used a disposable address and kept the message short, but operational security is only as strong as its weakest header.

Your task: trace the sender’s movements. Identify the aircraft they used, the company operating it, and the city where that company is based.

Flag format:

1
CATF{tail_number,registered_owner,owner_city}

Registered owner as it appears on the FAA Aircraft Registry. Underscores for spaces.

The Leaked Email#

1
Return-Path: <anon-gzc@grayzone-consulting.com>
2
Delivered-To: s.engel.7@tutamail.com
3
Received: from mail.grayzone-consulting.com (mail.grayzone-consulting.com [198.51.100.23])
4
  by mx.tutamail.com (Postfix) with ESMTPS id 4X2bQ73Kzz
5
  for <s.engel.7@tutamail.com>;
6
  Thu, 24 Sep 2026 02:15:12 +0000 (UTC)
7
Received: from [192.168.1.105] (c-73-149-72-209.hsd1.nj.comcast.net [73.149.72.209])
8
  by mail.grayzone-consulting.com (Postfix) with ESMTPSA id 7B2F31A0032;
9
  Wed, 23 Sep 2026 22:14:58 -0400 (EDT)
10
From: anon-gzc@grayzone-consulting.com
11
To: s.engel.7@tutamail.com
12
Subject: Re: Wednesday
13
Date: Wed, 23 Sep 2026 22:14:50 -0400
14
Message-ID: <a3f7c9d1-5e2b-4a8f-b6d0-89e2c4f17a53@grayzone-consulting.com>
15
MIME-Version: 1.0
16
Content-Type: text/plain; charset=UTF-8
17
Content-Transfer-Encoding: 7bit
18
X-Mailer: Mozilla Thunderbird 128.2.0
19

20
S.E.,
21

22
Departure is on schedule. I will be unreachable for the next 8 hours.
23
The documents are secured.
24

25
If there are any changes, leave a note at:
26
rentry.co/se7-ledger
27

28
Do not call. Do not reply to this address after tonight.
29

30
- V

Analyzing the Rentry Note#

In the leaked email there is a link: rentry.co/se7-ledger

It contains several pieces of information:

1. Flight arrival location: Direct LPPR
2. Flight duration: 7h
3. Arrival time: early morning 24-SEP
4. Most important: Charter: operator handling through Prima
5. Aircraft type: Airframe: G-IV

We need 3 things:

• tail_number
• registered_owner
• owner_city

FAA Registry Lookup#

From # FAA REGISTRY Name Inquiry Results I searched with Prima

There are only two aircraft of model G-IV:

Both have the same registered_owner PRIMA_AIR_LLC and the same owner_city PASADENA.

Finding the Tail Number#

So the first part is still missing: tail_number. It is an identifier that is displayed on the tail of the aircraft (tail_number).

I searched with "G-IV" "Prima" 23-SEP-2026 flight

The tail_number is N889CG

Verification on FlightAware#

I verified the tail_number on FlightAware.

A flight lasting seven hours, heading to LPPR {Francisco Sá Carneiro}

Final Flag#

So these are all the correct parts:

1
CATF{N889CG,PRIMA_AIR_LLC,PASADENA}