QnQSec CTF 2025 — osint

I started by making a small mind map of the overall chain to keep everything clear

And Here are all the challenges I worked through.

Soo bring your tea and let’s start our investigation. ☕

Here the first lead is

Chloe Stekar

So From the image, it looks like an X/Twitter retweet format so that part was simple

Flag: QnQSec{QnQ Corps}

but let’s keep digging into this account and see what we can find

First

First, this points to a position: Market Lead and Employee since 1990. In another post there’s a link (as alt text in an image):

https://drive.proton.me/urls/MT3F5GABY8#nQ2rWPt3Vuas

It requires a password, so I noted it and moved on

That post led to another account with only one post, which pointed to:

[embed]About US medium.com

Soo after checking this account

Senior Java Developer at QnQ Corps

So we have two people from the company, plus the official account:

Chloe Stekar
Alfred Dantre
QnQ Corps

let’s see the next task

ez since we found 3 users but let’s focus in official one for now

Quick search turned up three official accounts:

https://www.linkedin.com/company/qnq-corps
https://www.youtube.com/@qnqcorps
https://x.com/qnqcorps

From YouTube we can get the email:

qnq.corps@gmail.com

but Not directly helpful yet.

using google dorks

not make sense so i backed web archive

Bingo we found flag but no idea for which challenge so

another user add to our list

psychoresearcher

[embed]psychoresearcher's gists GitHub Gist: star and fork psychoresearcher's gists by creating an account on GitHub.gist.github.com

ok now make sense how we get that flag

and it was for this challenge

anyway in the videos there is nothing interesting

but here is the trick if you checked the playlist there is 2 videos

so if we see the second video

Unlisted

mean a video that can be watched and shared by anyone with the direct link but does not appear in public search results

and inside the video

we can see the site

QnQSec{https://uw5ru2vjsxnuagvczxn0rvzfugo.wordpress.com}

but since we are in this site let’s see what we get

First item on the site: a Telegram bot

https://t.me/QnQCorps2Bot

From the bot I got this Google Doc:

https://docs.google.com/document/d/1DnS2OhLUfLPA29pyyNTOGRrH4iMX08qjn8Q5rxjLxhU/edit?tab=t.0

So looking for hidden msg or something like that but didn’t find anything so i check who did this docs

and here we found new guy in this company

let’s check him

Ming Mulang
mulangming81@gmail.com

and this was the flag for

now we have

Ming Mulang -- mulangming81@gmail.com
Chloe Stekar 
Alfred Dantre
QnQ Corps (official) 

and there is many information now Soo i sort my ideas and see what we have and start checking the challenges since at least we draw the company now and we have image but still not clear

The Company is seeking new AI Research candidates,
 so the marketing specialist Chloe is taking care of it.
 investigate the true purpose behind this campaign.

So based in what we have

1- we found the post in Chloe Stekar

and we didn’t find the passwd So

The Company is seeking new AI Research candidates,

we have the src code for that ai and the github for developer

from here we can see Backupv2

he upload the docs/email/Weekly Marketing Update.eml then deleted it

so lets get it back

┌──(oxfun㉿0xfun)-[~/…/new_ctf/qn/Backups-main/Backups]
└─$ git show 9c49825^:"docs/email/Weekly Marketing Update.eml" > "Weekly Marketing Update.recovered.eml"


┌──(oxfun㉿0xfun)-[~/…/new_ctf/qn/Backups-main/Backups]
└─$ ls              
'QnQ Corps.txt'   QnQ-Corps.txt   README.md  'Tomas Frestkin.txt'  'Weekly Marketing Update.recovered.eml'   docs   samples   tomasfrestkin0.txt   tools

┌──(oxfun㉿0xfun)-[~/…/new_ctf/qn/Backups-main/Backups]
└─$ 

MIME-Version: 1.0
Date: Tue, 30 Sep 2025 13:04:25 +0100
Message-ID: <CAO5AgAdN_w9qmGM1CZOXONUPv-X5FVSqDZcAHyofTVEwPxB-Tw@mail.gmail.com>
Subject: Weekly Marketing Update
From: Chloe <Chloe.Stekar@qnq-corps.local>
To: Alfred.Dantre@qnq-corps.local
Content-Type: multipart/mixed; boundary="000000000000a34e670640038d37"

--000000000000a34e670640038d37
Content-Type: multipart/alternative; boundary="000000000000a34e650640038d35"

--000000000000a34e650640038d35
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Alfred,

Attached are the final assets for the upcoming recruitment campaign (logo
variations, banners, and the new sales one-pager).

Please upload the finalized files to the shared ProtonDrive folder we use
for cross-team review.

Per our secure-sharing policy, here's the Password of the Week for the
ProtonDrive upload (valid until end of week):

Password: ZmxhZ3t0aGlzX2lzX2FfZmFrZV9mbGFnfQo

Thanks =E2=80=94 appreciate the quick turnaround.

Regards,
Chlo=C3=A9 (on behalf of Marketing)

from here we have

From: Chloe <Chloe.Stekar@qnq-corps.local>
To: Alfred.Dantre@qnq-corps.local
Password: ZmxhZ3t0aGlzX2lzX2FfZmFrZV9mbGFnfQo

┌──(oxfun㉿0xfun)-[~/…/new_ctf/qn/Backups-main/Backups]
└─$ echo "ZmxhZ3t0aGlzX2lzX2FfZmFrZV9mbGFnfQo" | base64 -d                  
flag{this_is_a_fake_flag}
base64: invalid input

┌──(oxfun㉿0xfun)-[~/…/new_ctf/qn/Backups-main/Backups]
└─$

so that was really weird and dead end for a while

there is nothing the only thing here is

Password: ZmxhZ3t0aGlzX2lzX2FfZmFrZV9mbGFnfQo

Soo after some tries i tried enter it as password without any decoding

i tried

┌──(oxfun㉿0xfun)-[~/…/new_ctf/qn/Backups-main/Backups]
└─$ echo "UW5RU2VjX0lzX1RoZV9CZXN0" | base64 -d           
QnQSec_Is_The_Best                                                                                                                                                                                                                                               
┌──(oxfun㉿0xfun)-[~/…/new_ctf/qn/Backups-main/Backups]

which was the name of the file but it was rabbit hole

Now only 3 challenges left

and those 3

The Company's Customer
which 
The company sold one of its services for 90.00$, investigate the customer.
================================================================
The Company's Money
What’s the name of the Finance department lead
that explained the company's shady services?

The flag format: QnQSec{Firstname Lastname}
==========================================================================
The Company's Channel 2
=======================

So we missing 2 users The Company’s Customer and the Finance department lead

Soo

deep analyzing in our leads there was hole about the channel qnq accounts and website who did it and what is his name why there is nothing about it

So backing into the WordPress

We noticed that WordPress often associates author profiles with Gravatar, a globally recognized avatar service

and Gravatar works like this

https://gravatar.com/avatar/HASH 

[embed]Avatars This guide shows you how to use Gravatar avatars in your applications. Gravatar ("Globally Recognized Avatar") is a…docs.gravatar.com

[embed]Your Free Avatar, Profile, and Link In Bio | Gravatar Create a global avatar and profile image with Gravatar. Get a free one-page personal site to showcase your identity and…gravatar.com

So when we try

qnq.corps@gmail.com

https://gravatar.com/avatar/hash

┌──(oxfun㉿0xfun)-[~/…/new_ctf/qn/Backups-main/Backups]
└─$ printf "qnq.corps@gmail.com" | md5sum
53f3e94148c76a0404016e9bdf67e086  -

┌──(oxfun㉿0xfun)-[~/…/new_ctf/qn/Backups-main/Backups]
└─$

https://gravatar.com/avatar/53f3e94148c76a0404016e9bdf67e086

remove the avatar part

https://gravatar.com/53f3e94148c76a0404016e9bdf67e086

Tomas Frestkin == Head of Finance department,

since we found the Head of Finance department, this part gonna be easier

Now

Tomas Frestkin == tomasfrestkin0 == qnq.corps@gmail.com 

┌──(oxfun㉿0xfun)-[~/…/new_ctf/qn/Backups-main/Backups]
└─$ sherlock "tomasfrestkin0"
Update available! 0.15.0 --> 0.16.0
https://github.com/sherlock-project/sherlock/releases/tag/v0.16.0
[*] Checking username tomasfrestkin0 on:

[+] AllMyLinks: https://allmylinks.com/tomasfrestkin0
[+] ArtStation: https://www.artstation.com/tomasfrestkin0
[+] Coders Rank: https://profile.codersrank.io/user/tomasfrestkin0/
[+] Envato Forum: https://forums.envato.com/u/tomasfrestkin0
[+] GNOME VCS: https://gitlab.gnome.org/tomasfrestkin0
[+] Gravatar: http://en.gravatar.com/tomasfrestkin0
[+] HackenProof (Hackers): https://hackenproof.com/hackers/tomasfrestkin0
[+] NationStates Nation: https://nationstates.net/nation=tomasfrestkin0
[+] NationStates Region: https://nationstates.net/region=tomasfrestkin0
[+] Pastebin: https://pastebin.com/u/tomasfrestkin0
[+] Splice: https://splice.com/tomasfrestkin0
[+] Spotify: https://open.spotify.com/user/tomasfrestkin0
[+] Weblate: https://hosted.weblate.org/user/tomasfrestkin0/
[+] YandexMusic: https://music.yandex/users/tomasfrestkin0/playlists
[+] svidbook: https://www.svidbook.ru/user/tomasfrestkin0

[*] Search completed with 15 results

┌──(oxfun㉿0xfun)-[~/…/new_ctf/qn/Backups-main/Backups]
└─$ 

[+] Pastebin: https://pastebin.com/u/tomasfrestkin0

So the idea here they use Gmail but they don’t use users the use the id

now the last challenge

from last find

So using https://whatsmyname.app/

we get https://keybase.io/qnqcorps

OpenPGP public keys contain UIDs which are intended to identify the key owner (name and email). When a user uploads a public key to Keybase (or elsewhere), the UID is publicly visible as part of the key material.

the idea here that we can get public info from the key

# curl + gpg pro tip: import qnqcorps's keys
curl https://keybase.io/qnqcorps/pgp_keys.asc | gpg --import

┌──(oxfun㉿0xfun)-[~/Desktop/new_ctf/aka]
└─$ curl https://keybase.io/qnqcorps/pgp_keys.asc | gpg --import

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  4699  100  4699    0     0   6775      0 --:--:-- --:--:-- --:--:--  6770
gpg: key E58B7B454D38FF7B: public key "QnQ Corps <Th3_c0mp4ny_s0_g00d@gmail.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1

┌──(oxfun㉿0xfun)-[~/Desktop/new_ctf/aka]
└─$

gpg: key E58B7B454D38FF7B: public key "QnQ Corps <Th3_c0mp4ny_s0_g00d@gmail.com>" imported
Th3_c0mp4ny_s0_g00d@gmail.com
QnQsec{Th3_c0mp4ny_s0_g00d@gmail.com}