All we have from the question to work with is the name “Alejandro”. However, in the two easy starter questions, access to the GhostTown forums was provided. I did a search for “Alejandro” there.
This led me straight to his Facebook account. Which was weird because I didn’t know people were still using Facebook…
On May 28th he talked about his parent’s wedding anniversary, but that didn’t lead anywhere.
On the Ghost Town forums they mention he also had some more social media profiles using the exact same profile picture:
I was able to find his LinkedIn using a reverse image search:
I did not find anything about his parents here, but I did notice he added a lot more to his name.
I then found him on Instagram by searching for his full name:
And here we go:
flag{Carmelo❤Delfina}
I already found a lot of this info while looking for his parent’s names. On his LinkedIn and Facebook he has his education info:
flag{NVU-cybersecurity-23}
The thing that stood out to me was the “Mobile Onsite Oil” sign, with a telephone number. After a quick Google search, Casper, WY came up.
I was also able to find the exact spot he took the photo on Google Maps:
flag{Casper, WY}
Alejandro was in Vegas too, and got a thumb drive from someone named “James”. BlackHat and Defcon happened back-to-back in Vegas, so it could have been the same DeadFace member.
I then saw that there was a whole thread about BlackHat on the forums and it seems like many members of DeadFace actually ended up going:
Lilith was able to track Mr. Rogers through his secretary:
You can search the QR code and get a URL to this specific training, which has the location listed as Jasmine — F:
flag{Jasmine — F}
Here is the image:
I pulled out my Geo Guesser skills and looked for this highway intersection. Eventually I found it in Cornwall, CT.
The way I found the flag was by searching for “hauntings in Cornwall CT”.
This led me to ghost stories about Dudleytown, CT, which was an area just near Cornwall that was said to be cursed. “For many years, ghost hunters have been fascinated by tales of the lost village of Dudleytown — — a vanished Connecticut village that was apparently plagued by ghosts, demons and residents who vanished without a trace. These grave events were said to be caused by a curse, brought by the Dudley family to the New World.”
I read through most of the stories found HERE, and eventually found one that talked about a General and his unlucky wife:
flag{1804lightning}
It looks like Lucky is a grocery store operated in only a few locations:
There also appears to be a mountain range in the background, so that can hopefully help narrow it down a bit.
I was also able to zoom in on this logo on one of the other buildings, but I have no idea what it is:
I went on Google Maps and started using streetview in Utah. On the 4th store I found it:
flag{West Valley City, UT, 84119}
This immediately came up with a Google image search:
You can read into all the cool lore HERE. It is allegedly a tiny village crafted for “The Little People”
flag{Middlebury7}
This one appears to be Caesar 8
flag{Aurora Pharma}
If you inverse the colors of the image you can see some binary at the bottom:
Mirveal couldn’t help himself:
flag{mirveal}
When you open the file it is binary code:
There is a line of Hex at the bottom of the message, so I decoded that:
I then decoded the results using ROT13 and got this:
flag{flipitandreverseit}
