Tags: osint 

Rating:

# Whale Watching

### Challenge Text

>Where is the flag? It is not down on any map; true places never are.
>Hunt down:
>`johnhammond/whale_watching`

### Challenge Work

Whale watching....that format also looks familiar....

```
~ % docker pull johnhammond/whale_watching
```

```
~ % docker inspect johnhammond/whale_watching
[
{
"Id": "sha256:caf5b6f9a508753559f460cca815ba154560dca5db712da0a31fcf5bf61928e1",
"RepoTags": [
"johnhammond/whale_watching:latest"
],
"RepoDigests": [
"johnhammond/whale_watching@sha256:2b7db5e2796fbbd0616d5279b81f0ae151f4a52ad3e0325de7f583ce94848ddd"
],
"Parent": "",
"Comment": "",
"Created": "2020-07-21T18:46:55.1580955Z",
"Container": "4d887a53ffaf63aaeb6de6ab789cb63903de6394076eda1caa0a72cef4f1eec2",
"ContainerConfig": {
"Hostname": "9ec8c01a6a48",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Cmd": [
"/bin/sh",
"-c",
"echo \"flag{call_me_ishmael}\" > /dev/null"
],
"Image": "sha256:6b362a9f73eb8c33b48c95f4fcce1b6637fc25646728cf7fb0679b2da273c3f4",
"Volumes": null,
"WorkingDir": "/cowsay",
"Entrypoint": null,
"OnBuild": [],
"Labels": {}
},
"DockerVersion": "19.03.8",
"Author": "",
"Config": {
"Hostname": "9ec8c01a6a48",
"Domainname": "",
"User": "",
"AttachStdin": false,
"AttachStdout": false,
"AttachStderr": false,
"Tty": false,
"OpenStdin": false,
"StdinOnce": false,
"Env": [
"PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Cmd": [
"/bin/bash"
],
"Image": "sha256:6b362a9f73eb8c33b48c95f4fcce1b6637fc25646728cf7fb0679b2da273c3f4",
"Volumes": null,
"WorkingDir": "/cowsay",
"Entrypoint": null,
"OnBuild": [],
"Labels": {}
},
"Architecture": "amd64",
"Os": "linux",
"Size": 247049019,
"VirtualSize": 247049019,
"GraphDriver": {
"Data": {
"LowerDir": "/var/lib/docker/overlay2/7f795f9d08b0ac44261c2b56f4a30ae29bddb89c69a1d75590defa88c5aaec33/diff:/var/lib/docker/overlay2/fffd497d82b48d90bc45454469b774e0f6e831c7ebbe3e1cd3b8caa2db9f46b1/diff:/var/lib/docker/overlay2/957cfcf3a6d43624eff4fa61db51aab7843adc5473925b80c0f23694e5ba5802/diff:/var/lib/docker/overlay2/f16797ae8423237ff60468b88c86fdf1708e96a16ea073877e32f86ee796422c/diff:/var/lib/docker/overlay2/6f3ebe3833fafd3d9a5ed11ef8324e3e7d6da2ded7d523f68d224130939ceb6d/diff:/var/lib/docker/overlay2/b999c127f3485e563017bb889b7eb53b70053be97788644816afa7999216b02d/diff:/var/lib/docker/overlay2/e50edf4a31c43270f63116258015960e94cd66776c60e7b047009bdff2e32f84/diff:/var/lib/docker/overlay2/4dc9051483fccc9fc3880a2a024700382b224d416f6993ed85291e1f6cbebd61/diff:/var/lib/docker/overlay2/948524549a6d891d2778d1eaf8910254fd0d7d0f78e7249e8f33be364672c87b/diff",
"MergedDir": "/var/lib/docker/overlay2/cdc27c8504bfd4e461db383cc7656babff10b3b272c7d9c280f1c878f14cce0b/merged",
"UpperDir": "/var/lib/docker/overlay2/cdc27c8504bfd4e461db383cc7656babff10b3b272c7d9c280f1c878f14cce0b/diff",
"WorkDir": "/var/lib/docker/overlay2/cdc27c8504bfd4e461db383cc7656babff10b3b272c7d9c280f1c878f14cce0b/work"
},
"Name": "overlay2"
},
"RootFS": {
"Type": "layers",
"Layers": [
"sha256:1154ba695078d29ea6c4e1adb55c463959cd77509adf09710e2315827d66271a",
"sha256:528c8710fd95f61d40b8bb8a549fa8dfa737d9b9c7c7b2ae55f745c972dddacd",
"sha256:37ee47034d9b78f10f0c5ce3a25e6b6e58997fcadaf5f896c603a10c5f35fb31",
"sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef",
"sha256:b26122d57afa5c4a2dc8db3f986410805bc8792af3a4fa73cfde5eed0a8e5b6d",
"sha256:091abc5148e4d32cecb5522067509d7ffc1e8ac272ff75d2775138639a6c50ca",
"sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef",
"sha256:d511ed9e12e17ab4bfc3e80ed7ce86d4aac82769b42f42b753a338ed9b8a566d",
"sha256:d061ee1340ecc8d03ca25e6ca7f7502275f558764c1ab46bd1f37854c74c5b3f",
"sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef"
]
},
"Metadata": {
"LastTagTime": "0001-01-01T00:00:00Z"
}
}
]
```

You can see our flag is in the CMD variable of one of the layers:

>flag{call_me_ishmael}

Original writeup (https://github.com/turnipsoup/ctfwriteups/tree/master/2020/hacktivitycon/whale-watching).