Business Trip

548 Words · 2 Minutes, 29 Seconds

Challenge Name: Business Trip

Category: OSINT

Difficulty: Beginner

Author: OddNorseman

Challenge Description

My company sent me on a business trip to close an important deal with a major supplier. But, ehh… Boss makes a dollar, I make a dime, that’s why I ski on company time.
Flag format: The name of the mountain in the picture (without “Mount” or “Mt.”), wrapped in brunner{}. Example: If you think the picture is of Mount Fuji, the flag would be brunner{fuji}.

We are handed a single file, business_trip.jpg — a beautifula shot from a snowy mountain terrace. Now we just need to figure out which peak this is!

Approach

Step 1 — Check the metadata

After admiring the landscape for a hot second we fire up our good old exiftool!

exiftool -a -G1 -s business_trip.jpg

The metadata has been scrubbed… (Wouldn’t expect less from a CTF!) No GPS tags, no camera model — only an Apple Display P3 ICC profile, telling us it was an iPhone shot but nothing about the location. A quick tail check for hidden data (tail for a trailing archive, binwalk, strings | grep -i brunner) also comes up empty.

[File]        ImageWidth         : 5712
[File]        ImageHeight        : 4284
[ICC_Profile] ProfileDescription : Display P3
[ICC_Profile] ProfileCopyright   : Copyright Apple Inc., 2022

Step 2 — Read the terrain

My wife is italian and I have been enough to the Dolomites to recognize them! By using ImageMagick we can crop out the most interesting parts!

convert business_trip.jpg -crop 2200x2400+150+900  +repage left.png   # big mountain, left
convert business_trip.jpg -crop 1500x1100+4400+1500 +repage right.png  # towers, right

Left of frame: We have a huge mountain with snow on the summit → Some painful Google Maps foo… confirms this to be the Tofana di Rozes.
Lower right: a bunch of clustered rock towers → the Cinque Torri (“Five Towers”).

With a bit more Google foo of identifying the pairing of Tofana di Rozes filling the left and Cinque Torri below-right we end with the panorama from the Rifugio Lagazuoi A reverse-image search (Google Lens / Yandex) of the photo confirms the same location.

Step 3 — Bigger is not always right…

So I almost got stuck on this, because the instinct is to submit the enormous peak dominating the frame! The Tofana di Rozes. That, and every other named summit on the skyline (Antelao, Sorapiss, Pelmo, Civetta…) were actually just decoys… The prompt asks for “the mountain in the picture,” and the mountain that this picture is actually of is the one the photographer is standing on…

That mountain is Lagazuoi.

Flag

brunner{lagazuoi}

Reflections and Learnings

Stripping the file for EXIF/GPS and appended data is free and can end a geolocation challenge at Step 1. Here it only told us “iPhone, 2022,” but that negative result is what confirmed this was a pure visual puzzle rather than a stego one.
The layered limestone and piste layout narrowed it to the Dolomites before any reverse-image search — Lens/Yandex then confirmed a conclusion already reached, rather than doing the work for us.
The trap is naming the dominant peak. Re-reading the prompt literally — the mountain the picture is of, not the mountain in view — flips the answer from Tofana to Lagazuoi. When a prompt’s wording feels oddly specific, that specificity is usually the challenge.

osintgeolocationmetadataexiftool

OSINT