// BTLO · Threat Intelligence

Veriarty

BTLO Medium [hashcat, veracrypt, gpp]

proof of completion → challenge page → ← all labs

Overview

DI Lestrade has intercepted a transmission from a criminal known as Moriarty and needs help decoding it. This is one of the most layered and creative challenges on BTLO — it chains together VeraCrypt, PGP, email analysis, ROT47, Base64, ASCII85, a VeraCrypt hidden volume with a keyfile, steganography, and Braille. Every answer is locked behind the next puzzle.

Investigation

Cracking the VeraCrypt Container

The evidence includes a container.vc file. VeraCrypt containers are encrypted volumes that look like random data from the outside — no headers, no signature. The first job is cracking the password using hashcat with mode 13751 (VeraCrypt SHA-512 + AES):

hashcat -m 13751 -a 0 container.vc wordlist

The password cracks quickly: jamie. Mounting the container in VeraCrypt reveals two files inside the outer volume — secret.key and email.eml.gpg.

PGP Key and Encrypted Email

The evidence folder also contains secret.key (a PGP private key belonging to James Moriarty) and email.eml.gpg. Importing the key and decrypting the email:

pgp key

gpg --import secret.key
gpg --decrypt email.eml.gpg > email.eml

The decrypted email comes from pokdyk+5r9ofvxtmjh4w@guerrillamail[.]com to ytrairom@gmail[.]com with the subject “47-64” and an originating IP of 90[.]255[.]27[.]89. The body is a mess of quoted-printable encoded ciphertext.

decoded email

Delivered-To: ytrairom@gmail.com
Received: by 2002:ab0:670c:0:0:0:0:0 with SMTP id q12csp882698uam;
        Tue, 19 Oct 2021 10:44:13 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJzuw93pmfmSXcLonr5ino7tRJQquxRNs0Gf5qHaK2Lekv7+XemWjXe6wZXS4jfs60OOQQf5
X-Received: by 2002:a1c:2043:: with SMTP id g64mr2419232wmg.123.1634665452923;
        Tue, 19 Oct 2021 10:44:12 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1634665452; cv=none;
        d=google.com; s=arc-20160816;
        b=EfRZ4BouLCvWhGxIpVuv/NuewAyPVPcd98HiLVZ9YC6IBKgpJTI3VZ54mRwh26SPJx
         nV60ea72igPc/EZ2x6Rnpf/romJ0Cw/033wZ/VTiIjAfw3IOzqqoBNHKpTvOkAewRBrY
         SJptM0JIftgw4D95MMa5OiJREi0VDXL9A7qj59ZO9FgRO+zTirc2kDZFXjf3uSTOU2GM
         v5fLQ1hTubkhqPFm0woFby7gRI/p1qr8RuVVre2Ie8Q0B1BGzOQZRgL+iN55IgJuB1al
         H66rQfxWQ0H2a+dtxZ69tztFLs9Uw7wQKf30TXcMj/HgSzt346CjLgwOqlBkhSRCJvbP
         pGkw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=dkim-signature:content-transfer-encoding:subject:from:to:date
         :message-id:mime-version;
        bh=ddP9H+42B8wBu/Ujjpr6pzh87J5Km0kvPF6iDXcTdqI=;
        b=tEYT4C2jDWNLIIZDqSR29Twn9IPDeLREdBpNaHM40v0mPE51qfN5vue5VdtqiYtBau
         DRy6SN+fimx9BrbLjYAyfn8hpK/LQ+dsWHI/ilMdIsrinD5ChCKLolfcpkYwDp2/YNY6
         pLUgtTKuNo+rcpppwjxzY4HPwdUQ+g/5HMqGGR8Le1Qw4kDFe/QuUtZp5lYXFIYm3FgQ
         5zUp2rJcv+g3SPUmF08Fcfy1s58wJlIIBfZDFQLaHmLSwLD7iLwSNSDNM0XpgzR4+tOO
         d/JGr+7OdHALnQ5449kjreF8iCkkvCtW/Bxyxe/6i5l4k6JOU5uB4HS7DcbVmdw24Z8b
         c4PQ==
ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass header.i=@guerrillamail.com header.s=highgrade header.b=Bb5Wr2h+;
       spf=pass (google.com: domain of pokdyk+5r9ofvxtmjh4w@guerrillamail.com designates 2a01:4f8:251:657::2 as permitted sender) smtp.mailfrom=pokdyk+5r9ofvxtmjh4w@guerrillamail.com;
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=guerrillamail.com
Return-Path: <pokdyk+5r9ofvxtmjh4w@guerrillamail.com>
Received: from mail.guerrillamail.com (mail.guerrillamail.com. [2a01:4f8:251:657::2])
        by mx.google.com with ESMTPS id y13si1388170wry.75.2021.10.19.10.44.12
        for <ytrairom@gmail.com>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Tue, 19 Oct 2021 10:44:12 -0700 (PDT)
Received-SPF: pass (google.com: domain of pokdyk+5r9ofvxtmjh4w@guerrillamail.com designates 2a01:4f8:251:657::2 as permitted sender) client-ip=2a01:4f8:251:657::2;
Authentication-Results: mx.google.com;
       dkim=pass header.i=@guerrillamail.com header.s=highgrade header.b=Bb5Wr2h+;
       spf=pass (google.com: domain of pokdyk+5r9ofvxtmjh4w@guerrillamail.com designates 2a01:4f8:251:657::2 as permitted sender) smtp.mailfrom=pokdyk+5r9ofvxtmjh4w@guerrillamail.com;
       dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=guerrillamail.com
Received: by 168.119.142.36 with HTTP; Tue, 19 Oct 2021 17:44:11 +0000
MIME-Version: 1.0
Message-ID: <93624b0c4b500d3602bd59e31a6e508c121@guerrillamail.com>
Date: Tue, 19 Oct 2021 17:44:11 +0000
To: "ytrairom@gmail.com" <ytrairom@gmail.com>
From: <pokdyk+5r9ofvxtmjh4w@guerrillamail.com>
Subject: 47-64
X-Originating-IP: [90.255.27.89]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Domain-Signer: PHP mailDomainSigner 0.2-20110415 <http://code.google.com/p/php-mail-domain-signer/>
DKIM-Signature: v=1; a=rsa-sha256; s=highgrade; d=guerrillamail.com; l=356;
	t=1634665452; c=relaxed/relaxed; h=to:from:subject;
	bh=ddP9H+42B8wBu/Ujjpr6pzh87J5Km0kvPF6iDXcTdqI=;
	b=Bb5Wr2h+KYNo61hshUn/kC4d6j2oNkntO6isE6b5OpGkyBRAFGCnJlwevS4dgA2ovv/06OT2+p+y
	wWwKBuc+6d/MTXkSyeuaCeGg1Rr1c0e7mfL4vEmqc9FqVTz2BNwhg3bUJfRPlFn492ok8Unckjl5
	2nbUqTMRv3ce5NV7vK0dfaoO4ml0fzrGUcuetrb3k3Es+hOhmZl8ledg1BNn1TyRd2yn8+bJumwN
	uo6rAweTgpDO/mHHfb2xmX+8Gey5ytr+S8YxSDhn5Q6V/Buce6bGk7nPtgHLzKawjvTPUMquS3/h
	2EUqqPLiTa+U3bLdW67TCtruo9Vdr7nLDMtQYw==

")9=3D3rq(2)+a2(uF{pA)+$qF+('<xw#Gxv`=3D+)"85vg8+v=3DK*b'K4Jq_2v&84vI93?|Fx=
t`=3D+)"83(&8*)"8$a'D5>'<3ac8$vu_*a88&a';4>'_xtd`*aI=3D*)x8"?'F2a'J{rqs%%t_=
xs'&%rq95rpI|;@H|rczr<`G4>=3D94?#d=0A=0A=0A=0A=0A=0A----=0ASent using Guerr=
illamail.com=0ABlock or report abuse: https://www.guerrillamail.com//abuse/=
?a=3DVkh6ARRTE%2BREqAm58XcTPBfIQA%3D%3D=0A

Decoding the Email Body — ROT47

The subject line 47-64 is the hint. The email body is quoted-printable encoded first, then ROT47 encoded. In CyberChef:

From Quoted Printable → ROT47

This produces a base64 string. Decoding that reveals the decoy message:

Axel Vivvian,
We need to meet to discuss the plans. Meet me at Kelvedon Hatch Secret 
Nuclear Bunker, CM14 5TL at 12:00.

Moriarty

This looks like the answer — but nothing here gets accepted. This is the plausible deniability layer. The Axel message is a decoy designed to fool investigators. The real intelligence is hidden deeper.

VeraCrypt Hidden Volume — Keyfile

VeraCrypt supports a two-password model called plausible deniability. One password mounts an outer volume with innocent-looking content. A second password (and optionally a keyfile) mounts a completely separate hidden volume inside the same container — undetectable without the correct credentials.

The key insight: use secret.key as a keyfile when mounting. In VeraCrypt:

Mount → Select container.vc → Use keyfiles → Add secret.key → Password: jamie

A hidden volume mounts successfully, revealing a folder with new files including Decode Me.jpg and a hidden directory.

POA.txt — ASCII85

The POA.txt from the hidden volume is addressed to Vera:

Vera,
If you're reading this message, then you know how to find the 
information about our next meeting.

1bg+2AKWlf+>PVn2E;m<...

Moriarty

The body is ASCII85 encoded — identifiable by the +> character pairs. Decoding in CyberChef:

From ASCII85

The decoded message reads:

And if you're reading this my dear Holmes, then good luck to you. I look 
forward to seeing you and your little sidekick gatecrashing our meeting. 
But know this, I am well prepared for your arrival.

Moriarty knew someone might get this far. Classic.

Hidden volume

Inside the hidden volume’s folder is the meeting location image — Central Perk, Piccadilly Circus.

Braille — Time of Meeting - Decode Me.jpg

The final file is an image titled “Time Of Meeting” showing a grid of red and grey circles arranged in Braille cell patterns. Red = filled dot, grey = empty dot. Reading the Braille from the image gives the meeting time: 5th November, 16:05.

The Full Chain

container.vc (hashcat -m 13751)
    └── Outer volume password: jamie
        ├── POA.txt        → decoy / ASCII85 troll message to Holmes
        └── Decode Me.jpg  → steg → meeting location (outer layer)

    └── Hidden volume (password: keyfile: secret.key)
        ├── Hidden folder
        │   ├── Central Perk image  → Q4 meeting location
        │   └── Braille time image  → Q5 meeting time

email.eml.gpg (gpg --import secret.key → decrypt)
    └── From: pokdyk (Vera's alias)
    └── Body: Quoted Printable → ROT47 → Base64 → Axel decoy message

IOCs

Type	Value
Email	`pokdyk+5r9ofvxtmjh4w@guerrillamail[.]com`
Email	`ytrairom@gmail[.]com`
IP	`90[.]255[.]27[.]89`
PGP UID	`James Moriarty <jim@moriarty-inc[.]com>`
Key ID	`B5B72AEC14C55EE5`

#1) What is the hash type (-m flag) used by hashcat to crack the password? (Format: Hash Type Number)

Click flag to reveal 13751

#2) What is the password to unlock the container?

Click to reveal answer jamie

#3) What is the name of Moriaty's general sending the email

Click flag to reveal vera

#4) Where is the meeting supposed to be taking place?

Click to reveal answer central perk, piccadilly circus

#5) When is the meeting supposed to be taking place?

Click flag to reveal 5th November, 16:05

🔒

// active lab

writeup locked

withheld in accordance with platform guidelines
to avoid spoiling live challenges.
password provided to recruiters on request.