Baba Yaga's Corner

Table of Contents#

• Introduction
• Cracking the PDF Password
• Reading the PDF — Finding the Full Name
• Username Enumeration — Starting with vitrinefox
• Investigating the X (Twitter) Account
• Investigating LinkedIn (via Linktree)
• PCPARTPICKER — Dropbox Link Discovery
• PDF Metadata — Finding the Real Name
• Checking the Archives
• Back to Sherlock — OpenStreetMap
• Creating an Account — Trying Logged-In Search
• Finding the Travel Location on X
• The “Builder” Challenge — PCPARTPICKER Flag
• The Final Extra Flag — OSM Tags

Introduction#

This is a writeup for the OSINT challenge from CTF@CIT 2026, where our team Mont5ab El2hwa managed to take 1st place 🏆out of 1100+ teams!

The challenge was built around a password-protected PDF. Along the way we picked up flags from challenges we hadn’t even opened yet — which made for an interesting solve path.

This writeup was a team effort. Without them, half of this wouldn’t have happened — or at least would’ve taken twice as long. Big credit to:

• Y0un15 — LinkedIn
• 2Fac — LinkedIn

Cracking the PDF Password#

The first thing we had was this PDF — we needed to crack the password.

1
pdf2john VF0000000011-Enc.pdf > pdf.hash
2
hashcat -m 10700 pdf.hash /usr/share/wordlists/rockyou.txt -O

Password: cherell

Reading the PDF — Finding the Full Name#

After opening the PDF, we started reading and looking for anything that leads us to what’s required. First: the full name.

Page 1 ؛Page 2

This was the most important point:

1
Online Handles Observed
2
• vitrinefox
3
• vitrine_fox9
4
• foxinglass
5
• salledenonghost

Username Enumeration — Starting with vitrinefox#

Let’s filter the Sherlock results. The first valid result from Sherlock is:

https://linktr.ee/vitrinefox

That’s a good finding.

From Linktree, we now have:

• X (Twitter)
• LinkedIn
• PCPARTPICKER

Investigating the X (Twitter) Account#

This is all that’s on the account:

First thing — the bio:

Nothing important.

Second thing — the profile image:

https://ar.wikipedia.org/wiki/%D9%85%D9%84%D9%81:Geburtshaus_von_Leonardo_da_Vinci_in_Vinci_(Toskana).jpg

This confirms we’re on the right track — this is the house of da Vinci in Vinci.

Nothing else important on this account. The profile picture was clearly AI-generated.

Investigating LinkedIn (via Linktree)#

Nothing interesting — just a confirmation that this is the correct username.

PCPARTPICKER — Dropbox Link Discovery#

Third link from Linktree: https://pcpartpicker.com/user/vitrinefox/

A link to Dropbox was found:

https://www.dropbox.com/scl/fi/73nkwkuorewxm8h0xywzy/CuratorsExit-Final.pdf?rlkey=hy4xn1e23cmj906c0px9vcc8e&st=uoi3noeh&dl=0

Potential flag found:

But wait — we need his name; the flag isn’t this one, and it also returns incorrect when submitted.

We felt something was wrong after a bit of thinking and searching everywhere. We asked the admin — he confirmed this flag belongs to another part of the challenge.

PDF Metadata — Finding the Real Name#

We found in the file’s metadata:

1
Uploaded by Remy Beauvillier

That’s what we’re looking for — the name.

Checking the Archives#

The hint we had was “Check the archives.” We tried checking X with:

• https://archive.md/
• https://web.archive.org/

Nothing found.

Back to Sherlock — OpenStreetMap#

Going back to the Sherlock results — we had reached Linktree but there was still more:

https://www.openstreetmap.org/user/vitrinefox

That’s the second valid result.

What’s in the edits?

A potential flag was found. Is this what’s meant?

No — it turned out to be incorrect. We asked the admin whether this was part of our challenges or if a player created this account as a distraction. He confirmed it belongs to the OSINT challenge legitimately.

Creating an Account — Trying Logged-In Search#

After a few more attempts, I decided to create an account — maybe it shows different results when logged in. Nothing found either.

I noticed the way we were pulling accounts by @username, so I thought I’d try it directly — maybe he has an account that wasn’t appearing in normal search results.

Finally, the flag:

Finding the Travel Location on X#

We went back to check if there’s anything related to travel. Yes — on X, he was planning a Vacation.

The flag is that location — and we actually knew it from the beginning (the da Vinci house image). We just needed to confirm the City and Country with a simple search.

1
CIT{Tuscany_Italy}

The “Builder” Challenge — PCPARTPICKER Flag#

“Our friend is something of a builder, can you find the final flag?”

The flag is definitely from PCPARTPICKER Third link from Linktree:

1
CIT{N0t_ev3ryth1ng_i$_s3cur3}

The chain is done — but we still have one extra flag from OpenStreetMap that we confirmed doesn’t belong to our current challenges.

The Final Extra Flag — OSM Tags#

We only had two challenges left:

1. One with a food image requiring identification of the dish name — definitely not it.
2. The other challenge ‘Cartographer’s Secret’:

We had nothing to lose by trying:

1
CIT{ch3ck_th3_OSM_t4gs}

CORRECT!!!!!!