# PEARLCTF 2025 WRITE-UPS

Greetings, and welcome to my PEARLCTF 2025 write-ups. This is the fifth international CTF competition that I have ever competed in. You see, Cpt. Moriarty is specialized in OSINT challenge, and that's what I will give you in this write-ups.

## Table of Contents
1. OSINT
a. Hidden Marker
b. Van Gogh's GARBAGE hunt

## 1. OSINT
### a. Hidden Marker
Given the username *spiriteawx*. Tried using "sherlock" tools but found no results. I searched the username on X and found the exact account that belong to that username.
As you can see from his pinned tweet, it related to the challenge that we're facing. I downloaded the image to help my research on the exact location later on.

After scrolling through his tweets, I suspected that the location of this smuggling operation was near Charles Bridge, Prague, Czech Republic.
I opened Google Maps and tries to search anything related with "old cars" near Prague, and it turns out well. I found the exact location of the picture in less than 5 minutes.
The exact location of the picture which was *Celetná*. As what had been said in the description, you have to strip the special character, which then became *celetna*. Time for the next step.

He tweeted this link https://pastebin.com/MWH1g7rE for the financial records of the transactions

I clicked on it and searched through the whole text to find something fishy. After some times, I finally found it.
*"-1","-1","[REDACTED BY ADMIN]","-1","-1", "-1"* was clearly something.

I was stuck on this step for a few hours and was on the verge of giving up. Until I remembered that I can use "Web Archive" to look at the previous version of something before it was changed.

I visited this website https://web.archive.org/ and entered this Pastebin URL https://pastebin.com/MWH1g7rE.
As you can see, the Pastebin had been saved 2 times, which means that there are 2 versions of this Pastebin.
It can be seen by the numbers of this Pastebin viewed, which was only 3 times.

To compare the text, you can simply use "Diffchecker" https://www.diffchecker.com/
There it was, the so called "hidden marker". Copy the *Transaction ID* and put it inside the flag.

Flag:
pearl{celetna_6382938}

### b. Van Gogh's GARBAGE hunt
It's quite easy to solve this challenge. All you have to do is simply use "Google Lens" for the image.
It says that the road was in *Buiten Oranjestraat*. Then, I used "Google Maps" to find the exact location of the shop.
Done, it was a piece of cake.

Flag:
pearl{the_swapshop}