Question 1 - Promise Me (5 points)
How many promises does Wickr make?
We can navigate to the PDF found in the Downloads folder at the following path:
On page 3, it gives Wickr's Customer Security Promises as shown below.
Question 2 - Road Trip! (5 points)
What city was Eli's destination in?
Under Google Maps Queries we can sort the Destination Address column and see the only results were for Plattsburgh, in New York.
Question 3 - Smile for the camera (5 points)
What is the MD5 hash of the user's profile photo?
Drilling down into the file system we can navigate to the Avatar Images folder to the picture at the path:
We can see the MD5 hash was 5ddd4fe0041839deb0a4b0252002127b. Oh hey Eli!
Question 4 - The folder to store all your data in (5 points)
How many files are in Eli's downloads directory?
Navigating to the following path shows what was downloaded:
We can see 6 documents were downloaded to the Chromebook.
Question 5 - Autofills, roll out (10 points)
Question 6 - Dress for success (10 points)
In bytes, what is the logical size of this bird's image?
The question and the name give hints on what to look for here. Found in the Downloads folder was an image called tux.png, the Linux mascot, who is a penguin. Get it?! The logical size was 46,791 bytes.
Question 7 - Key-ty Cat (10 points)
What are the last five characters of the key for the Tabby Cat extension?
A quick Google search showed Tabby Cat had an GUID string of "mefhakmgclhhfbdadeojlkbllmecialg".
Navigating to the following path will give us the Extension folder and any details for it:
Inside the "manifest.json" configuration file we can see the key string is very long. The last five characters were DAQAB.
Question 8 - Time to jam out (10 points)
How many songs does Eli have downloaded?
I didn't see any audio files in the Downloads folder so I kept digging and came across a Music folder at the following path:
Question 9 - It's about the journey not the destination (25 points)
How many miles would the trip have been if Eli took the long way? Answer to the single decimal digit (ex. 9.1).
When I think trips I think Google Maps and seeing what directions can be taken. There were two paths we could take to get this answer. The easy way was to find in Chrome Web Visits a hit for "Burlington, VT to Chick-fil-A - Google Maps".
Heading to the URL we get Google Maps results showing the "long way" would have been 81.2 miles.
What was Eli's top visited site? (Domain Name)
Heading on over to Chrome Top Sites we can see that "https://protonmail.com/" had the highest rank (lowest number) of 1.
Question 11 - Vroom Vroom (50 points)
What is the name of the car related theme?
I had trouble understanding the question at hand during the live CTF but looking at it afterwards, it was much easier than I made it out to be. I did a keyword search for "theme" and it resulted in a picture of a Lamborghini found in an extension path: