# Hey detective, can you help me - ARACTF 2023

## Description

Ada seorang cosplayer dari China yang sangat aktif bersosial media, dia kadang memposting foto cosplaynya di facebook dan instagram. Dia pernah berkuliah di universitas ternama di China, suatu saat dia dan temannya berkunjung pada toko boneka untuk membeli sebuah boneka, tidak lupa dia juga berfoto dengan sebuah maskot di sana. Lalu selanjutnya dia mampir ke sebuah toko buku untuk membeli buku, sebagai seseorang yang update sosial media dia juga mengambil sebuah foto di toko buku tersebut dengan pose terduduk. Ohh iya dia juga pernah berfoto bareng atau collab dengan cosplayer asal China dengan nama 'Sakura'.

English translation version:

> There's a cosplayer from China and she's active on social media, she sometimes post her cosplay to Facebook and Instagram. She once studied at a famous university in China, at one time she and her friend visited a doll shop to buy a doll, she also took a picture with a mascot there. Then, next she stopped by a bookstore to buy a book, as a someone who actives on social media she also took a picture in the bookstore with a sitting pose. Oh yeah she also took a picture together or collab with a cosplayer from China named 'Sakura'.

## Attachments

- [Sheiscute.mp4](https://github.com/n1mdacybersec/CTF-Write-Up-Collection/blob/main/2023/ARACTF/Lomba/OSINT/Hey%20detective%2C%20can%20you%20help%20me/Challenge/Sheiscute.mp4)
- [instructions.txt](https://github.com/n1mdacybersec/CTF-Write-Up-Collection/blob/main/2023/ARACTF/Lomba/OSINT/Hey%20detective%2C%20can%20you%20help%20me/Challenge/instructions%20EN.txt)

## Solution

From the challenge description and the attachments in this challenge, I found it hard to search her social media account and this is the first OSINT challenge for me that need to find a people.

My first try was to search by using her face on search engines like Google, Bing, and Yandex. But I didn't find a result that is similar to her face. Until I found a website that could bring the result that are similar to her face, this website is called [Pimeyes](https://pimeyes.com/). Unfortunately, the free search feature is not giving us the source from the images that appeared on the search result. But, it doesn't mean that this is the end, because we can download the images from the search result using Pimeyes and we can use these images for reverse image search on search engines.


The next step was to search by using more samples of her face on multiple search engines. But again, I can't find clue or source to find her account name. Maybe we can find another clue from the challenge description and the cosplayer named `Sakura` is really piqued my interest.

I tried to search on Instagram using keyword `sakura` and I found an account named `sakura.gun`. Apparently she's a cosplayer from China, she might be the cosplayer that are mentioned in the challenge description.
Time to digging more information about her, by looking at her posts on her Instagram account. After spending some time, I found her post with other cosplayer that looks similar to the girl in the attachment of this challenge. Her Instagram account is `yanzikenko`.

I opened her account and I found the exact video that are being used as attachment for this challenge.


Alright, now I just need to find the part of the flag following the instructions for this challenge. But, it seems I can't find the information from the instructions on her Instagram account. Now, I continued my search about her account on Facebook, by using keyword `yanzikenko` and her account on Facebook is `yanzikenko.hii`.

I got the photo where she take the photo on her study at Beijing Normal University (BNU).


The second photo that I got is her photo with the mascot. This is called Molly, she's a mascot of POP mart.


The third photo is where she take the photo at bookstore. In the instructions of this challenge, we need to find the time when she uploaded this photo. From Facebook we know that she uploaded this photo on Monday, June 3, 2019 at 10:25 AM.


Now, I need to found the last photo of her with `sakura.gun` and look at comment section to find the last part of the flag. The last part of the flag is `Y0u4r3ThE0s1nTm45t3R`.


Oh yeah, I forgot about her social media ID. I need to found out about this social media ID and I tried the [Instagram User ID](https://commentpicker.com/instagram-user-id.php) to check her Instagram ID. From that link, I got the Instagram ID `44793134117`. Now we just need to combine the flag according to the instructions.


## Flag
`ARA2023{44793134117_BNU_Molly_3Juni2019-10:25_Y0u4r3ThE0s1nTm45t3R}`