WhiteHacks CTF Writeup - No Place Like Home

Category

OSINT

Flag

WH2021{postalcode}

Steps

Read the description. It reads:

Great! Now this might sound bad, but I have no clue where he lives. Can you help me find out where? Hint: Try to see if the person have any other social media besides the two you've found on the previous challenge Note: Making any contact with the person and visiting any location physically with regards to this challenge is out of scope.

Filter keywords out. They are:

Great! Now this might sound bad, but I have no clue where he lives. Can you help me find out where? Hint: Try to see if the person have any other social media besides the two you've found on the previous challenge Note: Making any contact with the person and visiting any location physically with regards to this challenge is out of scope.

Find the format of flag they want. It is a 6 digit postal code, also known as a Singapore Postal Code. We know Andrew lives in Singapore too from his location on his Twitter bio (Figure 1).

Figure 1: Screenshot of Andrew’s twitter profile

The best place to get clues on where he lives is from his social media pages. From what we have gathered, his Twitter and TikTok does not give much information. The CNA news article he shared on Twitter does not provide any location details. The Pastebin link found on his TikTok bio is merely a recipe to make chocolate lava cake and does not provide further leads.

What would be the next most logical thing to do? If Andrew has Twitter and TikTok accounts, he most likely has Instagram as well. This is just an educated guess. To test out my hypothesis, I went to instagram.com and found his account (Figure 2) by searching for his Twitter and TikTok handle since we know that he reuses his @andrewybh1997 for his social media accounts.

Figure 2: Andrew’s Instagram page

Bingo! As they say, a picture speaks a thousand words, hence I went on to analyze the contents for clues.

Let us first examine his posts (Figures 3, 4 and 5).

Figure 3: Andrew’s first post

Figure 4: Andrew’s second post

Figure 5: Andrew’s third post

Let us analyze these posts one by one, starting with the one of the red car. In the background, we can make out the letters “Fu Lu Sh” and a few covered letters. A quick Google search will tell us it is a shopping complex in the Bugis area. Spoiler: the caption doesn’t contain any clues, it’s just there to confuse you.

As for the post with the picture of the daisy, the caption tells us he is able to view the flowers conveniently since he lives a few MRT stops away. From the location he tagged, it tells us that the picture was taken at Gardens by the Bay (Figure 6). Hence, we’re able to establish the fact that he lives near Gardens by the Bay, which is located near Bayfront station on the Downtown Line. Keep this at the back of your head.

Figure 6: Post’s caption

The last photo is captured in Sim Lim Square, a shopping mall in the same vicinity as Fu Lu Shou. How do we know? Because when zoomed in, the Singapore Pools Banner in the background shows the unit number #B1-37 (Figure 7). A quick Google search for the directory of Fu Lu Shou will not yield any results. However, searching for Singapore Pools in the vicinity will return you results that there is a Singapore Pools in Sim Lim Square. Cross referencing both unit numbers, we can safely conclude the photo was taken in Sim Lim Square. Screenshots are below:

Figure 7: Singapore Pools banner

Figure 8: Google search results

Now, let us take a look at the caption and comments on this post (Figure 9).

Figure 9: Comments on post

Figure 9: Comments on post

From the caption, it shows Andrew wanted to eat salted egg dessert late at night, but the store he wanted to go to wasn't open. This means there is a shop that specialises in salted egg dishes near where he lives.

His exchange with his friend, Linda Goh, also revealed several key details. From the exchange, we can see that there is a Bak Kwa store near his house. In fact, the store is so near that Linda mentions that it is ‘below your place’. Also, it was mentioned that this Bak Kwa store allows for online ordering and delivery. Lastly, it is mentioned that there is a bakery beside the Bak Kwa store too.

Since we know about the 2 malls he visited, let us start from there. Google tells us that there is a shop that sells Bak Kwa in Fu Lu Shou Complex, called Peng Guan (Figure 10) [149 Rochor Road @ Fu Lu Shou Complex, #B1-22 (Inside Coffee House), S188425]. The same cannot be said for Sim Lim Square. However, there is no recorded bakery near Peng Guan.

Figure 10: Peng Guan store

We will assume that there is a bakery in the coffee shop. Now, there are 2 factors to consider when finding out where Andrew lives. It must be within walking distance of both Fu Lu Shou and Sim Lim Square, but which one does he live closer to? Reference back to Linda’s comment ‘below your place’ is very subjective, as we will find out later.

Let us add one more variable to the equation of unknowns. Looking at Andrew’s Instagram Highlights, we can see that he has one highlighted story (Figure 11).

Figure 11: Story from highlights

Zooming in on the photo, we can identify the store in the background is Swee Choon Tim Sum [183/185/187/189, Jln Besar, 191/193, 208882]. Remember Downtown Line? We learnt that Andrew lives near a station on the Downtown Line. It turns out that Jalan Besar is on the Downtown Line as well. Could he live nearby as well? And what about the salted egg caption we saw just now?

Another Google search later, we will find Multi Food Supplier [166 Jalan Besar, B1-03 Berseh Food Centre, Singapore 208877] which also sells Bak Kwa and is near to Swee Choon Tim Sum. Could this be the store Linda was referring to in her comment? If Andrew was living closer to Jalan Baser, it would make sense to walk a shorter distance to Swee Choon Tim Sum for supper, wouldn’t it?

But we must remember, Swee Choon Tim Sum does not serve predominantly salted egg dishes. Then what was the salted egg store Andrew so badly wanted for dinner? The search continues.

After searching a little more on Google Maps, I found Dim Sum Haus Sg [57 Jln Besar, Singapore 208809]. It is close to Swee Choon Tim Sum and also Multi Food Supplier. It is also in the Jalan Besar area and is famous for salted egg dishes (Figure 12).

Figure 12: Screenshot of menu

Also, looking at their operating hours, they close before 11pm everyday, and thus wouldn’t be open for Andrew’s supper. Thus, this must be the store Andrew was referring to. Hence, it confirms that Andrew is living in the Jalan Besar area. With so many areas to look out for, I created a map (Figure 13) and pinned all the addresses I mentioned above.

Figure 13: Map of all mentioned addresses

I forgot to mention, but there are several bakeries near Multi Food Supplier and Swee Choon Tim Sum. They are Butter Studio [147 Jalan Besar, Singapore 208865], LE cafe confectionery [637 Veerasamy Rd, #01-111, Singapore 200637] and Cik Pia Delights [Jln Berseh, Singapore 200025].

Looking at the blue markers, it seems like the places visited by Andrew are along Jalan Besar road. We now have 2 areas to guess the location of where Andrew lives.

After wasting a few tries on HBD blocks and shophouses near/in the Jalan Besar area, we started looking into the Bugis area to deduce where Andrew could be living.

We narrowed it down to a HDB block, Albert Centre [270 Queen St, Singapore 180270] and a condominium, The Bencoolen [180 Bencoolen St, Singapore 189646].

With another 2 tries, we found out that the flag was WH2021{189646}.

Well done! Hard work paid off. Flag captured :)

To be honest, this was a difficult one to do as there are many variables involved, which resulted in many attempts with trial and error. We managed to complete the challenge with 15 tries left.

Also, the story makes sense. Andrew wanted to eat his salted egg bun at Dim Sum Haus SG, but upon walking there, he realises it isn’t open. He may have decided to walk further, and chance upon Swee Choon Tim Sum, which serves dim sum too. He settled and ate Swee Choon as it was his only choice. That was also where he took and posted his Instagram Story. Although Linda’s comment about the Bak Kwa place being ‘below your place’, Fu Lu Shou is not that far from The Bencoolen and thus fits the description of Linda’s comment. That is all. 

Beanary over and out!