Overview

Two friends of mine told me about this CTF, and I was curious to test my OSINT skills against it, I have to admit I was a bit disappointed. Even the medium-difficulty OSINT challenges felt quite easy, which was surprising coming from HTB.

That said, we finished 805th/6,743 teams (out of 12,695 participants total), not a small CTF by any means, so overall we were pretty happy with the result, even though we still have a long way to go.

Easy - The Raven That Landed Twice

Story

Suncourt keeps its messengers arriving without looking like messengers — a private aircraft leaves records no one thinks to compare. On the night before three Registry witnesses changed their testimony, a dark executive aircraft slipped into Crownspire Executive Field under a sealed passenger list. But the dispatch slip and fuel sheet were not sealed: a gate clerk copied the aircraft’s Mode-S hex 43E91C and its callsign VLR602. Miren Vale, the Aerial Witness Desk’s analyst, suspects the same flight was recorded twice — once in the sky under its callsign, once on the ground under its registration — to hide who truly operated it. The passenger manifest is sealed under Court Courtesy Order CCO-2026-0441, but the technical identifiers remain open. Can you cross-reference the Aircraft Registry, Movement Ledger, Courier Mail, and Skyglass Browser to prove the raven that landed twice was a single aircraft, and expose the operator hiding behind a leasing company’s name?

Objectives

  • Identify the aircraft registration
  • Identify the operator: Vaultrune Air Services Ltd
  • Identify the departure aerodrome
  • Identify the parking stand used at Crownspire

We start with a note. We know the aircraft was parked in a private parking area, that the transponder sent the signal 43E91C, and that it is referenced as VLR602.

c

This is great, we also have a glossary to help us identify exactly what we’re looking for.

c

By consulting the aircraft registry, we find the registration number: 2-RUNE. We confirm this by matching it against the transponder number noted earlier.

c

Still within the registry, we’re also able to identify the operator: Vaultrune Air Services Ltd.

c

In the movement ledger, we find the departure aerodrome, Suncourt Foefield (SCF), as well as the parking stand, 4B, along with the call sign VLR602.

c

We now have all the pieces of the puzzle. The conclusion of this story: the two records describing the same aircraft, one using the call sign VLR602, the other the registration number 2-RUNE , are linked together by the transponder code 43E91C.

c

Flag : HTB{2-RUNE_FROM_SUNCOURT_FIELD_TO_4B}

Easy - The Hull Beneath The Name

Story

The Eastreach docks never sleep while the rest of Valyssar argues over crowns. Cargo moves beneath clean seals, harbor clerks stamp manifests they barely read, and Lord Damas Marrowcairn’s counting houses insist every shipment is ordinary: lamp oil, funeral cord, mineral pigment, preservation salt. But a frightened dock scribe copied a number before dawn — an MMSI from a grey cargo vessel whose cargo office called her BRINE WALKER while her stern letters looked shorter. The Eastreach cargo seal reads EC-4418, and the vessel was gone by midday. Miren Vale, a freelance maritime investigator, needs to reconstruct the vessel’s true identity from the registry and harbor ledger before the trail goes cold. Can you trace the hull beneath the painted name?

c

I start with what the scribe managed to save: the MMSI. A quick lookup confirms the surface story, the vessel does answer to Brine Walker. But an MMSI is just a broadcast number; it says nothing about the hull underneath. I cross-reference it against the Stormcoast Maritime Registry and pull the one identifier that doesn’t repaint with the name: the IMO number.

c

The IMO leads me straight to a berth assignment E-06 logged in the Eastreach Port Authority’s harbor ledger.

c

A painted name can change in a night. An IMO number survives paint, debt, and fear. Miren closes the ledger knowing that Eastreach did not merely receive cargo. It received the first pieces of a pattern.

Flag : HTB{BRINEWALKER_9384728_E06}

Medium - The Ledger Beneath the Hull

Story

Lord Damas Marrowcairn does not command fleets — he owns them through a labyrinth of paper. A single cargo vessel, the ASHEN MERCY, sits at the center of a web spun across five companies: a nominee-owned shell that holds the hull, a management firm that runs the machinery, a coordination house that directs the voyages, and a commodities trader that fills the holds. Each layer is clean. Each layer is someone else’s name. But every thread, if pulled hard enough, runs back to the same hand. The Outer Isles P&I Club has opened its registry for inspection — registry files, charter fixtures, company ledgers, and P&I entries are all available to those who know where to look. Reconstruct the full ownership chain. Prove that the hand beneath the ink belongs to MarrowcairnUse the Oath Submission form to confirm your findings, then assemble the flag from the verified answers.

We identify the legal owner of the vessel asset in the maritime registry: Thirteenth Tide Shipping Ltd.

c

Next, we search for the ISM manager, the company responsible for the vessel’s safety management under the International Safety Management Code, and find Morrow Fleet Management SA listed in the P&I directory.

c

In the charter ledger, we identify the commercial operator, the entity handling the vessel’s day-to-day trading activity: Eastreach Maritime Coordination PLC.

c

Cross-referencing the charter ledger with the P&I directory, we observe that the time charterer, the party leasing the vessel for a fixed period while the owner retains operational control through the crew, is Gilded Knife Commodities Ltd.

c

With all this information gathered, we get a clue pointing toward the flag.

c

What’s particularly satisfying about this challenge is that it lets us build, step by step, a graph tracing who’s really behind each layer, who commissions what, and who actually owns what.

c

On paper, Thirteenth Tide holds the vessel, Morrow Fleet manages it, Eastreach coordinates its voyages, and Gilded Knife charters the cargo, but every thread eventually leads back to Damas Marrowcairn, through Marrowcairn Strategic Holdings PLC, which Controls Eastreach and Owns Gilded Knife. The real chain of control appears to loop back on itself.

Flag : HTB{THE_INK_WAS_DIVIDED_AMONG_FIVE_NAMES}

Medium - The Helpers With Clean Hands

Story

The war of succession has ended on paper, but the Northern Crown Road still bleeds quietly. Villages that once resisted the Crown’s claim now receive “mercy” from the Mercy Lantern Relief Trust — a charity delivering burial candles, lamp oil, and grief counselling to communities broken by the fighting. Behind the trust stands Ash & Wick Provisioners Ltd, a wholesale supplier of ceremonial goods whose invoices are clean, whose warehouse is spotless, and whose registered office is a letterbox on Cinder Lane. The charity’s trustees believe they serve the grieving. The supplier’s director, Nera Sorn, knows otherwise. Above Sorn sits Quiet Mercy Holdings Ltd, a non-trading shell wholly owned by a fiduciary foundation with restricted disclosure — a structure designed so that the same handful of names can sign both the purchase orders and the relief manifests without any single office ever being answerable. The next delivery is scheduled for Harrowgate. The receiving clerk is Sister Merrow. Somewhere in the tender records, the company filings, and the couriered dispatch notes, the chain of control runs from a charity that teaches mercy to a holding company that appoints the hands that make one possible. An intelligence desk has been set up with access to the Companies Register, the Tender Hall, an archive mirror, and the courier’s intercepted mail. Trace the structure end to end and file the findings.

c

The award records name Ash & Wick Provisioners Ltd as the supplier behind every Mercy Lantern delivery the clean invoices have a face now.

c

The Companies Register takes me one level up : Quiet Mercy Holdings Ltd owns 100% of Ash & Wick. The supplier isn’t independent it’s a subsidiary, quietly held.

I check the filings for both entities against each other and find the same name signing for each : Nera Sorn, listed as director of the supplier and as an officer of the holding company above it.

c

The courier’s intercepted mail confirms where this lands next: a delivery scheduled for Harrowgate, addressed to the receiving clerk, Sister Merrow.

A charity that teaches mercy. A holding company that appoints the hands behind it. One name signs for both. The chain is filed.

The charity teaches mercy. The company moves cord. The holding company appoints the hands that sign both sets of paper. Miren does not find an army. She finds the people who make one possible.

Flag : HTB{ASH_AND_WICK_FEEDS_HARROWGATE}